{ "Event": { "published": true, "date": "2021-07-22", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-07-22", "timestamp": 1626998581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "eb6dfeeb-f1c5-48e9-8df9-301fe9ebfd92", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76dc5c5f-eaa1-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626926476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626926476, "uuid": "e50c8595-fd4b-49bf-91b6-242c833d6f3d", "comment": "Malware payload (Mirai)", "value": "d48616430595e0540bbd4e2d1bead1ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626926476, "uuid": "0db41c96-5171-458e-9cb7-ca3ea8a7779a", "comment": "Malware payload (Mirai)", "value": "0010f6669c111fa1204842a3f32e4bd0258b3bf5ca9b0c89fd05e9a175f53388", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626926476, "uuid": "a9a181fa-1496-4b7d-8e62-0fd10481d713", "comment": "Malware payload (Mirai)", "value": "a84591653241471de9b268fcda22ff23663b632d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626926476, "uuid": "c8a174af-5d17-47ca-937a-019b963a435f", "comment": "Malware payload (Mirai)", "value": "59dc8ab81c5b177ecbd314c960b09db95803d0753ed163e6df45aee97e9db32e5cfad89dc951c6cd449aa68ffa916014", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626926476, "uuid": "20a994b5-f30e-40d4-be75-7d5568391cf4", "value": "T1FCB2F699B9D6CB06C9C15177FB0F869A3F255398F2EF33036F122F21168796A0F66114", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626926476, "uuid": "3f52a7fc-593c-4f63-ba66-f4f970211814", "value": "384:mvBsO0Rx3cpd2/PTpfAkL5wfx+BV2c1m59AhFx4eNw7Vs6WSE:m5lIcpk/PGKIwbm5iSWw7ISE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626926476, "uuid": "c278bb3a-d1fe-41e5-829d-7ce31a4e52d0", "value": 25576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626926476, "uuid": "173144ed-514d-4398-be49-f921847ce407", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626926476, "uuid": "5189a233-f426-4381-ac49-8cf4697be910", "value": "d48616430595e0540bbd4e2d1bead1ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea649c7-eafe-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626966325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626966325, "uuid": "e70ee74c-f10c-4607-9732-ab15e4f445c9", "comment": "Malware payload (Formbook)", "value": "d59accd992813d35bb00a4b3f84c4ffe", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626966325, "uuid": "809d31d2-f33c-49d1-b7f5-005992bd4346", "comment": "Malware payload (Formbook)", "value": "002e54405b1ce6dd9710be53d71e832fcffc92fb63fc8ef3a37d14e0867c4c10", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626966325, "uuid": "bcdf8474-e56c-465a-8cab-fc0a2cba652c", "comment": "Malware payload (Formbook)", "value": "851d437a71d1a156e0adb9f553611865b8c90d94", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626966325, "uuid": "e0203fdd-20a8-44e5-825b-8cf32c434c36", "comment": "Malware payload (Formbook)", "value": "9da8b076b4afd24b3065d9cfc1714e595ae12b8f322cf35c466f401110fd5f03440570f9d85a606cdc0e1d3c1936fe0b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626966325, "uuid": "77f64c81-8a91-43c1-beae-0855275c85bc", "value": "T146551271A6B17A21ECA2D5F20D3FB038906D4C3A9EE26709EB45F2337136667C09953D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626966325, "uuid": "1aad769b-961c-4393-b9e2-552301c01ea4", "value": "24576:beO5efoW4hdgaEwAq4P1opC4O64Qgawpf0kkwgAEfH75:hFW4sasq4PONP4QoN7za75", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626966325, "uuid": "f78efbcb-9672-4ecb-8871-8909023c6b60", "value": 1333760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626966325, "uuid": "822710a0-6061-4f93-9240-b5463062eb18", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626966325, "uuid": "6994d1ed-5956-497c-9ac6-5294b8bed98e", "value": "new order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f46d0a-eb17-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626977266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626977266, "uuid": "d93a51b0-2b59-463c-b24e-67bf54cb06cd", "comment": "Malware payload", "value": "bad05e5a760ce7c6044eb5107f2163c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626977266, "uuid": "8dd9a0ef-cc0d-4edb-a98a-0ab840db5332", "comment": "Malware payload", "value": "004068094b6adb0e6548b6334afd2dad79312f09e94e04a1d1206874028bdda0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626977266, "uuid": "ab908c36-a425-4b69-8ad3-1a8473b5940a", "comment": "Malware payload", "value": "7162df123875e84d916e0c5ded180fb9e30d8f4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626977266, "uuid": "fcb70854-b607-4c74-bef9-f84a75dc07fd", "comment": "Malware payload", "value": "9be5adc8b978a5d94ec9b2cfb220c52d7ed864088ec009fae907308f83622a10a15a4a90371e2f7c5d0d10259c7e557e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626977266, "uuid": "9b6e54dc-0f5e-4da5-ad85-497ff1e0c7e9", "value": "T148F4F1097B80AB4FC1BB4E7B85512C10EBF1D526570BE7877CC223EC698E76A4717292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626977266, "uuid": "48ebef8b-ff1a-4d72-8980-3acb4ceeb917", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626977266, "uuid": "39722abc-ce64-4066-8151-445444de8073", "value": "12288:w92kft8mOL5KrEA8i4JQXoiB0iubmmdZhNHqMx+Br/Voy3WEStzbPoy:c2UuKI04JQXoiyiA71duzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626977266, "uuid": "0db290bd-a889-4987-9d54-85c5468554bb", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626977266, "uuid": "5acc8403-c928-4c1e-ab6d-f301847c10fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626977266, "uuid": "78453cc1-3c89-455b-8be2-ad225df309e7", "value": "bad05e5a760ce7c6044eb5107f2163c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4667e59d-eb21-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626981371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626981371, "uuid": "5c429e6b-d1a8-47f2-99d9-801c6088a610", "comment": "Malware payload (AgentTesla)", "value": "e4a4399e36ec35372d36c2c3fc3b9da3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626981371, "uuid": "d0e4e09d-62b6-470d-b171-79a31d96a0ed", "comment": "Malware payload (AgentTesla)", "value": "00738e5877d85de04dce218a652c689db6ce03926ed4d27efaa2b9f2670e8739", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626981371, "uuid": "58593a04-68cd-475a-bc70-e538c42d5f75", "comment": "Malware payload (AgentTesla)", "value": "ae82e758d2e094955ff96aefa95c46eab4ea6823", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626981371, "uuid": "06458e84-1dae-459e-8698-8b4e56b1dedc", "comment": "Malware payload (AgentTesla)", "value": "0f481a086ecae471b45c04bc8e176e3296dd9f43bb8106a721b8a7d340daad8c6a229c040efc6af20d3fa13b7b7e02d8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626981371, "uuid": "5cba2ad6-bd3d-4450-9e72-003dad32ad20", "value": "T18A7423B2714BEA52F9C11FB225DC0D4365BEA1247F2B81D0CA2FDA6A46D810DD5037AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626981371, "uuid": "a8cfe2e2-3f87-4d71-a022-517798e7fb50", "value": "6144:mOWbL5gkSXBdhouxRVaQhnQJ9SfJgK+zec4FunDnLmUAu8OZX9XqFCam/jtIlChg:mOKOXBd7LaunQJYf1ZhuDnLp9HMWBQCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626981371, "uuid": "ff74730e-8204-4e87-b66c-ab25acad7337", "value": 360441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626981371, "uuid": "3a3b4b5b-1005-49fb-a6ff-03245798a5a9", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626981371, "uuid": "3620bc81-f5cd-4c59-b2d4-e1b37dda18fa", "value": "HSBc20210216B1.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0689264d-eafe-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626966231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626966231, "uuid": "24878af1-48ec-4ec8-ab10-60ecef401471", "comment": "Malware payload (Formbook)", "value": "975a4017075c97740e54740fc8d24f77", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626966231, "uuid": "e75d09f3-215f-4902-8bce-b9619f02fd2a", "comment": "Malware payload (Formbook)", "value": "01d8b4b3103b1ecee2ced7a9437bc2c512918199ed9238040b775ee7196e8ede", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626966231, "uuid": "b77c1c29-aee6-43a0-940c-4b0353db4add", "comment": "Malware payload (Formbook)", "value": "0a483229a6fa9a61575bcdd3068a5707d17034c5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626966231, "uuid": "94fcfcbc-4249-4271-9e32-d8fcbde58602", "comment": "Malware payload (Formbook)", "value": "a959cb5108039265657c64eebf584757c157f7c90af5620a2d5e88b5f787718e29bb01913ce79fef214dfcd72acabd6a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626966231, "uuid": "7c22e257-73be-4cf5-bd99-1f0984792bd2", "value": "T1CA5512319947AE20DE2D57F0F056790C94FFAE964B12C8A36909F283257EEF0D357622", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626966231, "uuid": "0aee6382-a5ba-4fef-91b2-da191a38cb1d", "value": "24576:o2fw17LGeaqT49SbLoW6j1qiF35O3sVzkEohNyJrXz6Q/fWrpqWnnQIEb:16aqT46aq65usO4n6wWkWnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626966231, "uuid": "d345d7f2-97ea-4464-8eac-8fa65ceff5d0", "value": 1326080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626966231, "uuid": "0327a107-d81e-4506-a0db-5a3e2e799c9d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626966231, "uuid": "bf2c1959-33b4-4c18-aaf2-5b9dc4a2f3fb", "value": "Swift-Payment_Details.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eb464e9-eafb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626965037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965037, "uuid": "c2b27821-188e-4610-b8fb-5a84a1eace86", "comment": "Malware payload (Mirai)", "value": "31b4a360878e1b5677d43f1934fec2f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965037, "uuid": "b84390ad-a2c1-43bb-baeb-64389dad6a11", "comment": "Malware payload (Mirai)", "value": "026ed4a5c1170328f18284c7b4a049d3d4944512ad40f35bb1df860c4cca5d93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965037, "uuid": "7c1546a2-2d3a-4438-9823-0abdb29db2f0", "comment": "Malware payload (Mirai)", "value": "708bf4a9d67db42d40df0c0a5c61def932c5d8b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965037, "uuid": "5f030a6e-5b4a-4fe4-8d71-d78f35f885f7", "comment": "Malware payload (Mirai)", "value": "043f639889367b859f94ef1da3db34c9f1fbfbb2dad92c3ef3f038e648cada03c51c5daee01bcc630300215fdc298ae2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965037, "uuid": "5e9cae36-1bea-4e30-8b1d-809056aca27f", "value": "T13C63A506BF214FF7DCAFDD3749A91B05258C640B21A97B397E34D828F64A24F19E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965037, "uuid": "1b12f4cc-882a-4c6c-bdb7-2044cd49c969", "value": "768:QxNCJ0EYlDYhHnrwqsFDwLX3U6ngBhN6PNUpGXS5SyeweVKe0n3oNWpkmPqXitMF:QxNCJBYlZFwwjhwPTXSNxIKzn6CpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626965037, "uuid": "4d1964b6-9e69-4f2c-a346-3cb6e7157782", "value": 71528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626965037, "uuid": "b3fdfffd-455c-470d-8531-516cf15a9af9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965037, "uuid": "5c240043-8649-41cb-8d30-2913dc514a33", "value": "31b4a360878e1b5677d43f1934fec2f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1753241e-eaed-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626958958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958958, "uuid": "924ee372-c71a-44fc-bdad-13b7928bc761", "comment": "Malware payload (AgentTesla)", "value": "8e2aa51f45393d980a4d9b20947976b6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958958, "uuid": "7d817413-269a-48c8-b717-ed082a3ab6ae", "comment": "Malware payload (AgentTesla)", "value": "02e6972eec66f1f2b9898fa662d59c1f47856f180dad385d766399ecaf763f5b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958958, "uuid": "1cedfafb-7b50-4b90-86f9-78656764e963", "comment": "Malware payload (AgentTesla)", "value": "44742c0e7752ece4ed49c40d0f1b4e893c291005", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958958, "uuid": "ba932977-ee82-40f2-a7bf-4224d37f1978", "comment": "Malware payload (AgentTesla)", "value": "161b7528f172eb1059aee374bac1d20ba9003394044666fb91bd64118129598ca32d2ad99045a88d70131a0797c8a599", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958958, "uuid": "332355ba-40dd-4f51-87a0-c610cc770aac", "value": "T19305383439FA501AB173EFA98BE479E6DA6FB6733B07645D1091034A0723A81DEC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958958, "uuid": "e98c4f39-d18b-489d-9f6d-c8e76e58870d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958958, "uuid": "03927996-b4a7-496e-ab2f-25576e8da09b", "value": "12288:KWyWaA3xU+8SeWYL6dKsEP19309tXzWhMlDf1xqispXhS4bc1Paz+WJWskVCyjUp:KnfVrt9MTGZSC8keQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626958958, "uuid": "ed8270cf-30ff-41d7-9304-515a98821df4", "value": 850432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626958958, "uuid": "05d53518-0a4e-4c5a-aec8-8655c3ece634", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958958, "uuid": "af58b6a5-4d31-4760-a95e-494a4c8c396e", "value": "DOCS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac0a7b29-eae6-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626956201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626956201, "uuid": "9e84fe20-db3a-4ae1-b482-f903368f0d8f", "comment": "Malware payload (RedLineStealer)", "value": "d2792e1448fdf7a225b51b4688b855c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626956201, "uuid": "a4d916a0-5e94-441e-8cec-6735b5cc322b", "comment": "Malware payload (RedLineStealer)", "value": "02e9bbebcc372e37d18f0dfed9c2dc5e50a23b7305aa3527accedba48bbd8432", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626956201, "uuid": "ac498621-9ab0-43f3-bbe5-5a8f144e3723", "comment": "Malware payload (RedLineStealer)", "value": "5e00613e000595c45914848ef69b820208c19eba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626956201, "uuid": "4dffbc2a-eda6-4ca1-995f-539615522ccd", "comment": "Malware payload (RedLineStealer)", "value": "0b2c2e24cf1f4f40bf4c5480f1e8f4a668187fb9e16d1ba2db90e68f09a2e744798a0ee1e3157c2091073e34b16fb4b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626956201, "uuid": "d120fcb8-4d63-4209-b9e8-0e36067a3305", "value": "T193045AE26F937E4DC8B600B4D4834BF33D79196C59059CA1C7E8B62F5CA7181F286AD8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626956201, "uuid": "7a509220-eb60-4674-8664-2a3677db1c34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626956201, "uuid": "f6032b2c-8de3-40c4-a88a-3839f22c80f2", "value": "3072:Kc4QcWNrreQ8mI59tx0Cptj3k7OftYmpsdl6t9TjkovED:pRPrreZmI1qeV3MOfGssdq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626956201, "uuid": "eb2ea670-730f-460f-9152-3d1a3faf2ad7", "value": 180880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626956201, "uuid": "e2ee8755-386f-4de1-8f7f-a900f38afd98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626956201, "uuid": "78bd5936-901d-42bb-bc6f-6d5fabd4e285", "value": "d2792e1448fdf7a225b51b4688b855c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "831ab543-eb3e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626993928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626993928, "uuid": "731978a2-d495-4d2f-b09e-4a52a2b69636", "comment": "Malware payload", "value": "724d45be834559d7982a485300e661fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626993928, "uuid": "757d2bb0-a5d2-4e6b-ae96-e09f3e431945", "comment": "Malware payload", "value": "032b52e76afe703e90f82916593870f7c9defdc8feff1da9cf8ba1d2538b1f15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626993928, "uuid": "589bbc49-a1c3-4428-bdb9-2c7fe48b114d", "comment": "Malware payload", "value": "9d70e2457e5b25cabe9c9dd015cd3ed9112d4bbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626993928, "uuid": "ce86dd8d-47f7-41de-bfd2-824225c05590", "comment": "Malware payload", "value": "2d7ed8032bc78daf0208ad8172da32784fb677864b5cf1f6cd540dd4fc761d402b02f98c948f5a12bb2d240c2cedea6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626993928, "uuid": "a6795299-f14e-45a9-812d-4e14c9bd6fc9", "value": "T1CD463351C979C6A2C1C0E2745B25E67B8C552D4A71FAC782C8E4CF47B268EB50FF5328", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626993928, "uuid": "e079af82-d76c-4887-8d32-01e2b5b2bc1e", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626993928, "uuid": "1863957a-0627-4a8e-926d-583c9ff28272", "value": "98304:ErCabvtBIF3Vy6fsS/6xX8Qhynw6I5ChsSjxkTgHChd1Y6gfye9dSFn:8HxBwXfsa6xMiIwhIsSN5HeGHymdC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626993928, "uuid": "080a22e7-1c0f-426d-bd67-2999283ff55a", "value": 5635448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626993928, "uuid": "dbfeefe8-4a89-4377-8012-5afd27d7260d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626993928, "uuid": "923a3c16-058d-4396-8a5b-e66a456fe702", "value": "VapeV4 Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc29dcb9-eaea-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626957973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626957973, "uuid": "ad5012df-c7aa-4930-b4d2-9644ebc7035e", "comment": "Malware payload (RaccoonStealer)", "value": "85ccac3064ee0b602935f2b9f5fb6656", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626957973, "uuid": "ef1ab5e6-18d1-4cf5-83cc-3199b4bb5e0f", "comment": "Malware payload (RaccoonStealer)", "value": "0427b3ecda18d67665d14b989d6296fe02b74cf27b8721a5fd09cc14a92493b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626957973, "uuid": "2df952a6-021f-431f-825c-aeb3c31dbd3e", "comment": "Malware payload (RaccoonStealer)", "value": "0f1d9b825b0ac2e344408eaeb84631ac042fbc8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626957973, "uuid": "53628c32-94b7-4b28-a9cc-e8147ff04465", "comment": "Malware payload (RaccoonStealer)", "value": "bb697132d30bcfb396a4bb154f3c315ffc7bf3fffc7987b047095b02cc54b805b705ceba081a6027cb2882104563c6b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626957973, "uuid": "3e218ac0-2687-4f71-a555-fc7734ef739a", "value": "T17AA41214FA91C036C5E607721CF7C7D179BEBC961A785523664832CB9E703C2AAAE347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626957973, "uuid": "54d456a6-7bd1-492d-a87e-1c7466c8d4be", "value": "6acba419afd0f4919c1c58d62b0b66c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626957973, "uuid": "092ac583-ed0d-4b1f-a06f-47e57d370f49", "value": "12288:5Mh5Dv2DaC/U5+GPq0emoOulYtwdhDHylkN3y7:U5Dv22oU5fPXeZOulcwdhDHyWy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626957973, "uuid": "42f5c25b-6ffc-4fce-ac11-41cfe1f1a85b", "value": 463872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626957973, "uuid": "01df6306-0967-4924-9bd2-9b71f5cdc751", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626957973, "uuid": "4f9eda42-dd3e-4a2f-ba1a-c36468168bc2", "value": "0427b3ecda18d67665d14b989d6296fe02b74cf27b872.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e1188f7-ea8d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626917764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626917764, "uuid": "a8de4c2e-a561-4d33-ab84-026f12739847", "comment": "Malware payload", "value": "4c2c7a630e152f74991a566563534780", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626917764, "uuid": "820ad19a-f736-4ad9-979b-6e0ea09439d8", "comment": "Malware payload", "value": "06433fa9ea9bd8e9feb56a1ccda9d1dee221a546c6e72b609e9c574f070497ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626917764, "uuid": "53a1c2a6-de66-414c-aaa6-82511df6ac82", "comment": "Malware payload", "value": "2b120723719045d79bd494fe6bd32818acf92abe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626917764, "uuid": "b0310758-0ea6-44d2-a148-634b1c6dfbf3", "comment": "Malware payload", "value": "c958e0a3c2d3d9e52728e493224919e475e399aa7f68cc85cd89953c4dd2ac04fc9e7a9ea1ae0d284e4e8fc3d54e0efd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626917764, "uuid": "ee34df58-820c-4b61-8466-90eaa88b496e", "value": "T12D43190292518A53C4D21B7EBB9F462936237E149B9F331167287FF82B427EE173D522", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626917764, "uuid": "14cc3ca8-99de-4347-8199-f3435bbd0c32", "value": "1536:9wn4AmjqcxIYinQoxo7Ivm6p70RvPQamTcQu9u0sx:fCQoxocvm6p7UAamwQuQ0sx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626917764, "uuid": "226fec25-9df9-4a73-a416-e40d8c9f8afc", "value": 57102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626917764, "uuid": "a65f84e7-ed34-4771-b669-e9dd523288ea", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626917764, "uuid": "3b85e1ac-80c5-46ec-a161-5c65c9b577f1", "value": "4c2c7a630e152f74991a566563534780", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e50282bb-eabb-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626937828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626937828, "uuid": "1c2728c4-aace-4655-b5c8-da79c5b68299", "comment": "Malware payload (AgentTesla)", "value": "53129cf39b6b180a20bef666da18f6ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626937828, "uuid": "3245aedc-ac15-465c-b8e2-5e3168eb4154", "comment": "Malware payload (AgentTesla)", "value": "06798301d113e18d6e6ffe3321628911d604bbc65ff5b465986155abd29f09dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626937828, "uuid": "86c9d0fc-5ae2-43ce-99bc-b66705c6ed19", "comment": "Malware payload (AgentTesla)", "value": "62487b332736b0a29584e625e43c6822e7c60422", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626937828, "uuid": "5a8c68b7-12b6-4f33-aa65-fd45a0f20fa1", "comment": "Malware payload (AgentTesla)", "value": "b9fe3a319ee9273f795b29963f06088e8d86664dfc6bea6755a1f2386c951e26d0d1063b38e654bb38706fafed67c43a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626937828, "uuid": "08fd606c-4845-4f11-b726-e0be703d0cdb", "value": "T1FEF4F2193780AF4EC1AB8E7A84511C10EBF1E526570BFB876CD213FC198E79D8B13292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626937828, "uuid": "2ea7c458-c18f-4707-8f36-906f6bf1f54a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626937828, "uuid": "86f4d690-17ab-425a-96c6-fb4d76097ffa", "value": "12288:vv+zXC2Dql7mgKP3JTpJ8XOqLccB3vGPPjBfhlgvXsRiakEKZvX+yP:+zXC2DAgP1pJ8+qLd3OP1fhafP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626937828, "uuid": "13fd5a94-147f-4167-8600-8b9c88c4f042", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626937828, "uuid": "924181a7-fe04-47a2-9a88-b0863b20efc3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626937828, "uuid": "e1f85ce3-f10e-4b3d-b573-4f8ae2c9e2f7", "value": "53129cf39b6b180a20bef666da18f6ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a3d66bb-eaa1-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626926482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626926482, "uuid": "580f9b64-2ee2-4817-b665-3b2d5b53582d", "comment": "Malware payload (Mirai)", "value": "2db191b671690efab71681e15bb9918f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626926482, "uuid": "87815230-1f86-4776-b815-5756cdb0004b", "comment": "Malware payload (Mirai)", "value": "07c6053dacc5dda6362d18bce85758ef70b9e21b1a9c06038e471471a056df01", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626926482, "uuid": "b8237bcf-abd2-4b5f-94c3-c34cc9bd4a5d", "comment": "Malware payload (Mirai)", "value": "0235f62a9bead83eb0aede9d97f8d8fcb058f265", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626926482, "uuid": "22b0ca7a-f62a-42e5-bd71-c395d8efba1a", "comment": "Malware payload (Mirai)", "value": "02d242c1b8b716ad0516d4f382cdbbfe5fd54cb33b53c8c45c4a4eb8760bfbe083b88a55dbe89644cc6c0d35ec8810cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626926482, "uuid": "b8c6ab5d-500a-4a87-a505-b843d64347f0", "value": "T1AAF2954A2A365FEDF769C6358BB34A30A75833C526E0D284D35CD9004FB434E686F7A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626926482, "uuid": "03cb5377-94d2-41a4-80b4-81077a5164ae", "value": "768:gpoNymYqc24UVftC0SAfOoLcwXgZMnMN9xMFNMVRL2rXdWvZCSCl2W:TomFy+PxGmi1CXdWvZ/Cl2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626926482, "uuid": "5cea6b93-08a7-455b-922d-abcdc82cbbef", "value": 34660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626926482, "uuid": "dd806d86-8531-48ad-bf36-3f927726e20e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626926482, "uuid": "5de21d7d-4211-4255-96eb-e9d8325f12c4", "value": "2db191b671690efab71681e15bb9918f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d1196ed-eab3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626934218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626934218, "uuid": "95c29bdd-60d9-426a-8fad-40e74bd3a7a2", "comment": "Malware payload (AgentTesla)", "value": "f868c1e77be92a2bdcecd727781b39c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626934218, "uuid": "a3fbb4e8-557b-46bb-97d2-326746646caa", "comment": "Malware payload (AgentTesla)", "value": "089c2e88733184ca2e648ccfe560f808b82962a83291023584ca69cc34d0957a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626934218, "uuid": "befd36e8-fada-4a17-8bae-68f7c416a2b3", "comment": "Malware payload (AgentTesla)", "value": "ab1a4db47be725a80e4b03b9f5caf9dae8f680e5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626934218, "uuid": "9a08e9cb-4760-4f01-aae9-62288157edbd", "comment": "Malware payload (AgentTesla)", "value": "6718eaf859bab4a59bbab019886d0df72c6fa256dced7d5304c1103fcc3807e7a0e95b83616c49f11ebd7287dce33fd2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626934218, "uuid": "6a381bf5-a5f8-414d-8224-b18c4053b8a8", "value": "T145F4F1093790AB4EC17B8E7BC4501C10DBF2E5276707E7876CC216EC299E39A9E17396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626934218, "uuid": "ce9b93ee-78a3-4857-ae98-2625f02f0d86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626934218, "uuid": "ba597273-e12f-4c56-8c05-d711dd162265", "value": "12288:aoSLVwbAvenOr9okDd5XAbX8sziL2tvoqzmGEWZ6mxcMJDe01FAU9FEEip+yl:a9VwbAvenydXgBiytpzrGGe01Frgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626934218, "uuid": "47b23c4f-2b3e-4a86-ac07-1014ee189710", "value": 776704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626934218, "uuid": "2cfad818-2c17-4ea8-b2c5-6f739528df0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626934218, "uuid": "05b1015b-57a7-4fe1-ac6c-24211f230c27", "value": "S2107Item.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4554b6c9-eae3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626954740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626954740, "uuid": "f324cdf5-284d-4bd0-9c0c-3e43cef43725", "comment": "Malware payload", "value": "3eb2ea9527590196759a92fdd24eaf8b", "object_relation": "md5", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626954740, "uuid": "c7bf25d2-c40a-4cae-82d5-1b7cf56debca", "comment": "Malware payload", "value": "0bd168703d2bb6a6d5fffe115c4834f4057bcb7f7877369a3230a82badce3d15", "object_relation": "sha256", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626954740, "uuid": "fae22255-e0e7-4c2a-a71c-323b6198b75b", "comment": "Malware payload", "value": "22cb16a1c4331efa0f228484578b54708dcc1f0b", "object_relation": "sha1", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626954740, "uuid": "ead1deff-4de8-4a93-936b-92a6c6fa6cc5", "comment": "Malware payload", "value": "87eb82deeb184aa5ea7d30c75c6e20aa88f8c3f7c400757b6b8c01e18b332aac5e04891a7963e697252132150b672d8c", "object_relation": "sha3-384", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626954740, "uuid": "a306d2e1-d246-414e-be67-0f8ae189da23", "value": "T14046BE457BA860E4D27A8139C946861AD6717C421B614ECF316CFB5E2F337E39E3A312", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626954740, "uuid": "5fa444ea-f5c6-4ac6-85da-03ffc6c5cebc", "value": "98304:VY5A1bGRlQ3f53eyibmw8a0FDIhnuijpaLU4UUU3UUUtvFOvLU4UUU3UUUtvFO:hyQvReydwFkOnuijpaLU4UUU3UUUhFOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626954740, "uuid": "bc23adb1-fcf2-4550-bdc7-0b9f831aeca9", "value": 5865472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626954740, "uuid": "07548468-18e3-42fa-8ad9-a1b50ce0661c", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626954740, "uuid": "2592668e-0f8d-41a8-ac17-8d506a527831", "value": "DCBR.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27398812-eaed-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626958985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958985, "uuid": "60e64d7e-b9b7-4f67-b2db-d9bda317fbcc", "comment": "Malware payload (AgentTesla)", "value": "df77aaa6e3e3aa36d253ef893063452f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958985, "uuid": "caa1ee59-3b0d-4525-a362-01219b2abb53", "comment": "Malware payload (AgentTesla)", "value": "0e50b895ed10c7cc4ecab501bf363451c24b654e3c3da3ef889a6bd13856bd12", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958985, "uuid": "81dffe47-04ec-45d1-8e66-205bf5af22ae", "comment": "Malware payload (AgentTesla)", "value": "db0f0750d0bbe620db17a719f74c06746a2e05de", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958985, "uuid": "3868a0dd-493f-49b6-9ee9-7b5bd61c7917", "comment": "Malware payload (AgentTesla)", "value": "44c14b2e8743c1eae6b09d9cfba4a045bdf30ac6545f4238441227003339666a63c085ee0e9491299daebed6a6ac8e6c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958985, "uuid": "aa22ae6d-db42-4d87-b6c9-3fe54f5472c8", "value": "T155E4D174A31BA708CD3883FD2C15D15127FAA01E936DD6782E98907CBCB2BBC5BE1651", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958985, "uuid": "4946a5e5-96a1-4122-9ed0-13a0e57ed1ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958985, "uuid": "f61c22a1-f04a-46c0-be7d-774c92670fea", "value": "12288:wn0OAfW+vT15kICu0WIv6nm/HGwMuev0WfcvHVU/vDE232syaUVKnp:03AOyT8hW7jruev0WfcPGizahp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626958985, "uuid": "4a8dd4d6-59e4-4801-b1dc-dd9858d470f3", "value": 707072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626958985, "uuid": "abd973de-ef4a-465b-a5cb-2e82ed0b21a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958985, "uuid": "de7df726-04f4-4472-8a22-c8810f38e6aa", "value": "Payment 67830.00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a092539-eae4-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626955312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955312, "uuid": "e7f086ae-5f6d-4287-8111-a591f7c5dbab", "comment": "Malware payload (AgentTesla)", "value": "974a56eac20cc277e84a6ccbfb71ee6d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955312, "uuid": "52c97a7d-e735-43bd-b057-b5e2e555927a", "comment": "Malware payload (AgentTesla)", "value": "0f2f011ab5408672f97b1fca323554daf40b35bbfed4e587bcffea8a08ccf979", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955312, "uuid": "c0a2b1a9-b0ed-44a4-b8aa-705345977ca8", "comment": "Malware payload (AgentTesla)", "value": "6029d991f11141d1ffc2353cfe7eff6c77fdb4db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955312, "uuid": "c56b483a-6bcc-43b5-9645-b1605b810917", "comment": "Malware payload (AgentTesla)", "value": "69ef0de742e712584ab6e675ecbf12eebc3a0def3fcbff650a7107a25dc56b76a358e22bd01aca182a370f9fb7769d3e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955312, "uuid": "d63fab25-a9e6-4502-9683-9e156c57cd24", "value": "T1BBF4E034A31BA714ED3887FD2C15D06167FEE01E621EDA383E98907C7C72ABC56E1652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955312, "uuid": "1fa1f6d2-d4b3-4016-98f5-bd26c27fe0da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955312, "uuid": "a32b6fae-5719-4a47-8203-1c3b6911dfc2", "value": "12288:mdoDiqLuQpVxuiEDEZmrGp70C7bRb55xbckxVpCDIqsyaUVKnp:mdoFLuDEZpXRHjkDIqzahp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626955312, "uuid": "b070312b-a6bf-48e9-b627-c8ff2e957cda", "value": 728064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626955312, "uuid": "7f325e65-38ec-4397-b416-6e32c9fa866c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955312, "uuid": "d24412ec-8267-4456-881a-234752710ea9", "value": "Payment slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79cd6e5b-eb1f-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626980598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626980598, "uuid": "35608b67-ddfe-441f-9d77-8de73cfb4d90", "comment": "Malware payload (Mirai)", "value": "395ac0eef6353f4ad4483a050fc07881", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626980598, "uuid": "6f1b9427-5ac1-4df5-a756-787444356085", "comment": "Malware payload (Mirai)", "value": "0fe47240559e626a4d1f19906e1f793c38c0bdb377b1130790533293f5955915", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626980598, "uuid": "8edd1b42-5c2d-4170-8df3-98b51516554e", "comment": "Malware payload (Mirai)", "value": "3b31a1541cacd252780eb458f90964f79e16cf26", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626980598, "uuid": "f484c26d-bee4-4704-9997-66fbe48fc18b", "comment": "Malware payload (Mirai)", "value": "b1456f4c1bc28a4474eeddf5baece23b458bd94aa05b0b4cc98a9de88e66a3eab0db7c257d9845efce5ced04de244bf4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626980598, "uuid": "e76a6476-fc68-4266-bdf7-bd87ffa8bace", "value": "T1B864F1CAED01AE75F9D54779BA1F074973B28BE8D3C3B110E624C6143AEE6468B391C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626980598, "uuid": "60c6d259-53f1-4c8a-b2ae-6a1673b7d10f", "value": "6144:7O/QJHZweEL/NOjCHm7FZZnc2oNsKqqfPqOJ:78QpZsKCai2HKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626980598, "uuid": "2224a2d0-346e-482a-abff-c64f27d51a1e", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626980598, "uuid": "3ab2551b-2195-4980-86ae-e190c5e5c0cd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626980598, "uuid": "e64f87b1-f67d-4d3b-941f-181c95ef3fe6", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5436e0dd-eac3-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1626941021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626941021, "uuid": "2f8ee1fc-8cce-4f1e-8521-5bb51fb0a184", "comment": "Malware payload (DanaBot)", "value": "c358fccdefea503eef6a283d59b8a153", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626941021, "uuid": "78ba5432-4ae9-4dba-ba81-38848ce4a503", "comment": "Malware payload (DanaBot)", "value": "1033608024fd29faf3d43c466bc7fcfa70eed6c3e907ee57a85ad54cc2853692", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626941021, "uuid": "78faf81d-0755-4959-91a6-770612dc81d8", "comment": "Malware payload (DanaBot)", "value": "6de2695919e9da1ef37486989953edcf3dcdaf1a", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626941021, "uuid": "79facbf2-fc06-4bd8-b41f-bc04c8f0ce87", "comment": "Malware payload (DanaBot)", "value": "02097c9a6e2a8ffcc3d85717c2ee78ad9d3659181eed974a5d587810023f473689c9ff2c47c396a9d40897812f1a59d7", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626941021, "uuid": "8b3dc705-b214-4a06-8888-06d35a304f75", "value": "T19B3523C47590DC72E2700E3844E7CB98233DBEB49E6D82137A447ADFAE311C562AD75A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626941021, "uuid": "0f1626d9-8c62-4501-8f07-b84a4c7a3a80", "value": "010b99662693ba25ba201961c31754d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626941021, "uuid": "c0e19c83-6c19-4307-9342-f49dea5dce63", "value": "24576:YV1sjxZUW3FWQ0lYa/5VZfINIVGgqyNLz:YV1sjIW3gxlYa/5VBIN5c3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626941021, "uuid": "30eebeb9-249c-4c8f-8bd7-9c8bf80b9225", "value": 1146368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626941021, "uuid": "fe5ca9f8-9cfa-4101-8828-9c01d5176661", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626941021, "uuid": "7d809303-de1b-419f-9bfb-bf19d33373c1", "value": "c358fccdefea503eef6a283d59b8a153.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acc07991-eac2-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626940740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940740, "uuid": "49d13dd5-4354-46dd-9379-05b1ce4a5930", "comment": "Malware payload (Formbook)", "value": "686dc98567009e47eac88e95804b9dde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940740, "uuid": "9b0c2212-cf3d-40aa-935f-88f0d55ac146", "comment": "Malware payload (Formbook)", "value": "11d84c7f9c579c2e58f4acc04d488d5f1c6cc0439609099eabec42444f5ef952", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940740, "uuid": "b0191625-5e66-4c97-80e1-ec29a786b5c4", "comment": "Malware payload (Formbook)", "value": "5788c30289d12f69d5cf323049d8d3c3a3e73cda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940740, "uuid": "7c12e41b-9e9e-48ba-b044-cc126d1bc1d2", "comment": "Malware payload (Formbook)", "value": "bc04d396d094bf5911c3824fa97dd2e852870b9f21b940b5e52865ff7d085e9a31d8c7f2ab6cba1e353d9df3f28ebb2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940740, "uuid": "fd8245e4-8b26-4383-958f-63d7fc4d9bb2", "value": "T1350402A8A73CA21ED374E5310512EE7A0A8484FA51FFF1F7C7D1184EAA493C41A1D79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940740, "uuid": "037c2322-de1f-44de-ab60-208288c8bb85", "value": "1eef928161ef7d2982c39057cbea43bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940740, "uuid": "5a586e35-e4a3-4a4b-86ac-e1c50fb24cf4", "value": "3072:6C/f5NIRlNlcHX0QuidYsPBpdpqbIYW/4Steoi+i1NVKlqxuk7n44QCvx7Ics0cz:RqlNlcHXbUApdJ/4+iXN0lqxNj4xC7rc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626940740, "uuid": "c9bb8daa-eeb0-42e5-96b5-589751c141d0", "value": 177125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626940740, "uuid": "8df85dd3-5727-4861-bb8c-f3d10028055e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940740, "uuid": "b93d6b00-6e61-440a-9ba3-433c6648760c", "value": "686dc98567009e47eac88e95804b9dde.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f292a4b7-eb3f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626994545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994545, "uuid": "37b4b449-f115-459a-bfca-7b431111b2f9", "comment": "Malware payload", "value": "58d9b1ac5e7b09fa78ce0bad2a8ebcda", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994545, "uuid": "9d77fa54-a7bd-443b-b763-e1d502997316", "comment": "Malware payload", "value": "12040583fb7b5254f9007e466cffc6465910ff07a8682b3efd5b4d2bdc47d54d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994545, "uuid": "7a800c12-d790-472f-8041-6d5b9c4cb491", "comment": "Malware payload", "value": "31fdac20be641a8b576bd0b00c80b9a18223ac2f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994545, "uuid": "4a09581e-0e33-4e10-9537-ef9e468bcbb6", "comment": "Malware payload", "value": "2c0d8f7e8c274442230188403fa9ce30d5c1f750af840458b26d7ce8d785fa1a55a9a5a80e5c674f8f66b637432abf7a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626994545, "uuid": "9eed011d-47a7-4a4f-82e3-58fe8bde7222", "value": "T1F2B22A82AA83F9F5F824C7B5D837AB727372F42F2459ED96DB5B1C30A842001D25329D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626994545, "uuid": "8fcbb178-2db7-44c3-bc7e-0646f90d4394", "value": "384:fIDU0VIjqfLKKor1aKMztkxI9489HdTwLvPV5l01yXA1dTJq:wDU0qjMKKA/mJbdELvNr0EQ1dTo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626994545, "uuid": "bcce0720-a49a-490f-ad09-14efd2f2bb72", "value": 23592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626994545, "uuid": "ddf0a900-7e18-4e62-9e72-8d3fbedbfd71", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626994545, "uuid": "57999554-5665-49b8-bff6-dd5bef2d7c4a", "value": "58d9b1ac5e7b09fa78ce0bad2a8ebcda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ea4bac0-eac1-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626940180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940180, "uuid": "51cee428-fad8-43d1-8570-0453e0571bd3", "comment": "Malware payload (AgentTesla)", "value": "c665a5f0a16497e73f40203a95baa253", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940180, "uuid": "661dfc0d-2c09-4445-aa23-c9215979bd93", "comment": "Malware payload (AgentTesla)", "value": "12cb2d376ff851b5fd9c84646c29c5a13e086e542d5c8c247ccd127247c7cb24", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940180, "uuid": "c806739c-b881-4c55-a797-f5e18289db81", "comment": "Malware payload (AgentTesla)", "value": "0f69e08f761766d60a0884fc2b88258c78116322", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940180, "uuid": "e943be72-703a-43b4-bd60-3484793313d3", "comment": "Malware payload (AgentTesla)", "value": "0d61fa9dd5fdffa7ff12afd82a4e0a23b338df02acc4aeb52947027d5f8c1e5d51102e46b88f2b110a4ba72c166638de", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940180, "uuid": "bf5dbdee-9c91-4060-af50-0ed59bd46452", "value": "T19915CF2D7217A630EDF583BACC9D81505BFEA41FA91AC6392DB4ED6C783376809DC085", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940180, "uuid": "3a1d706a-c92c-4f10-b827-820808ac3e32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940180, "uuid": "d9c860c1-b7e0-4385-8b5f-cbd701f3e444", "value": "12288:LzfuShvmnQRtqT62HNEcYQ5cI6N5370xqZz4HyGsOp8Ag4xc2syaUVKnpq7:nuSokQNHN/YDN5mq14tpyoc2zahpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626940180, "uuid": "2684dde2-3245-477a-9cdc-d06c9ea446b4", "value": 918528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626940180, "uuid": "3d0d0288-0144-4fc6-acd3-276686a18ccd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940180, "uuid": "bf69812a-c1ac-41dc-a6f0-b7748d05cf58", "value": "DmpaXFlZBIW2jGG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c662ee7c-ea89-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626916302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626916302, "uuid": "551848d9-a085-49b6-9e30-9fd7ec1e32f1", "comment": "Malware payload (Mirai)", "value": "f61ca607fd9df7662649450799237651", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626916302, "uuid": "c6a25fb4-d704-499b-80d5-428e4f585b08", "comment": "Malware payload (Mirai)", "value": "13053be69b8b59c9c46e884ffab61e4be13fd091fd4bf6d3223a053301d4c384", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626916302, "uuid": "2687bd21-9422-4744-a86b-03af72cba151", "comment": "Malware payload (Mirai)", "value": "33512806fe77a2a012483b1d1f90afbd1f9628ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626916302, "uuid": "44d04000-f6af-4470-b46f-b35050bdc066", "comment": "Malware payload (Mirai)", "value": "34e3222991a1a31d0d2cbe6352997abab9de3f28e73236c961c8f8414b3242524146308f8d1b241b24acf18662313ad3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626916302, "uuid": "d9d25228-ed90-4b49-93be-d20fe389840a", "value": "T1BC03D5937906EEB7F40EE77A48D347247270BD564E531A2263677CB69E322D0382AF05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626916302, "uuid": "980c3245-7407-40c6-b545-bd0ecf2c41ea", "value": "768:5CZhvcSDwpkxNQNu1rwI1l4oB8uIdL0KnvHrkwRxvaJXCZgWxepQ8bQ:atcSEpsQNurzl4Y8uq0KnPnv2XCZ70p6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626916302, "uuid": "d2b29e9c-c065-4d4c-98e8-d9b3c74962a6", "value": 38347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626916302, "uuid": "d9fe6322-5d23-462a-ae3f-8d3a5a415fc2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626916302, "uuid": "a4c99d2c-759c-4524-b5f6-53d11800b4a2", "value": "f61ca607fd9df7662649450799237651", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a8166a-eb35-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626989931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626989931, "uuid": "49414dcd-4990-469f-bab0-92a304e1f072", "comment": "Malware payload", "value": "29183814f45616d831fdc139e3113718", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Pegasus", "colour": "#15B0C8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626989931, "uuid": "d0cd0fba-fcfc-4156-9b3f-a9abe95d9a21", "comment": "Malware payload", "value": "144778790d4a43a1d93dff6b660a6acb3a6d37a19e6a6f0a6bf1ef47e919648e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Pegasus", "colour": "#15B0C8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626989931, "uuid": "f2723c11-000d-43cb-824a-9952b44bd7ed", "comment": "Malware payload", "value": "aa47b601dd3a01cf0ec5e2e6da5c4f90c49ba71d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Pegasus", "colour": "#15B0C8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626989931, "uuid": "ebf19de9-6d39-4fc7-baea-422244310a32", "comment": "Malware payload", "value": "b49d802f2103a7e98d9705461e0ce4a0f5dcddab462b27394b0a1e1559c81d3a4d8134f83f57647f9f37a731baa979b8", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Pegasus", "colour": "#15B0C8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626989931, "uuid": "2cd53bff-bf77-4746-ada6-4a0c4f9eea03", "value": "T1777612B3F749E8A5D0E3A2339671521660224C708F13EAA33E5EB5341FF7EC45689E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626989931, "uuid": "0138c2ef-130d-4e30-a5c1-b933d84164b5", "value": "196608:pJVfGouCB8oMxqANNjYYUMLRoCRMggq2k+E9p+o3k:prf7uC/Mxq4YSLRowMPqj+E9Io3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626989931, "uuid": "f413bf64-86ad-4c0a-b62b-d1981f18c70b", "value": 7335631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626989931, "uuid": "027882c9-a37d-438e-a4d4-b31688e1df99", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626989931, "uuid": "82b4421d-0d3f-4546-ab50-30f185cb48d7", "value": "com.lenovo.safecenter.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a86ca3d1-eae6-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626956195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626956195, "uuid": "e07798f4-d495-4659-80ad-e26e5d421c58", "comment": "Malware payload (RaccoonStealer)", "value": "171625eb0cb811f1df8798436a942928", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626956195, "uuid": "169d2240-e70f-4e48-a5e2-53845cc1e0c4", "comment": "Malware payload (RaccoonStealer)", "value": "145793398014dea6cf0cdb29c644cc1156cccf80949bbd6a013237b9481a6451", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626956195, "uuid": "2933ee6e-6eb7-413a-b1af-5196096aceeb", "comment": "Malware payload (RaccoonStealer)", "value": "cab439f717d4ffc160fe17a58f831391f4bb4aa6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626956195, "uuid": "eeabe812-9e14-477a-b5c2-ba98b71a257e", "comment": "Malware payload (RaccoonStealer)", "value": "967672d953cd60e7a6ef2ffe69b22f35b09cb24ced3ad70643075e1fd5c11aa609f229eb50e4fde3871de3b942b5f552", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626956195, "uuid": "a8912935-9d88-4898-bd39-9d4380e92ccc", "value": "T142A41214FE90C872E15392701CFBDB916A2F79A28C39858733A427ED1E7029556BF347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626956195, "uuid": "6345129a-bdd1-4356-bb19-78e1956fefcc", "value": "61ef104eaca526f41b548a0ec177afb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626956195, "uuid": "4e58c005-2d89-44cd-94c7-53ce95466eb4", "value": "12288:yLsmIzb6OAqsg0EUhOIzETuBYjHN6k8UcyZ:yBg1SBYDNMyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626956195, "uuid": "7f1e6930-11f8-4b34-9f7c-4497b933d65f", "value": 480256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626956195, "uuid": "094f4896-fae5-444c-99e8-64772abb83ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626956195, "uuid": "95286158-5b52-4188-8836-5cd11cc0b086", "value": "171625eb0cb811f1df8798436a942928.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91e7e9c4-ea8c-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626917502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626917502, "uuid": "db18ee37-c76b-4252-b7d3-e4c82ddfb16c", "comment": "Malware payload (Mirai)", "value": "01d650df6b3d16e446587f1183e7c253", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626917502, "uuid": "e99eb04c-26dc-4435-b211-50973731e453", "comment": "Malware payload (Mirai)", "value": "15a62276442946b9f1d0da8d20f1ed912d30e0bcecb5f43e227146dcd0f5dfc6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626917502, "uuid": "d08cc67e-8da6-412b-a90e-f57cda67fe09", "comment": "Malware payload (Mirai)", "value": "0602298b8108a57a9518ed25b60717ced72b242d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626917502, "uuid": "c86da642-02f5-4835-8d0f-d6658feb22e6", "comment": "Malware payload (Mirai)", "value": "040519fcc2e8a42f98b57b2885b5597381173e46baff8ef208652aab3308c36b3d3543b86a339ed9daba996773f211d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626917502, "uuid": "56cb766e-e9e6-407c-9932-954a726692b4", "value": "T1F503F902AD41CB17C2D31BBAB6DF87AD3B2579059B9B33017A297DF41B47BDC2628211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626917502, "uuid": "173e5d13-1530-4514-8dfc-e8438047220f", "value": "768:bOyZIXf9Ydo07WfPyTLdQFAb0jJVKDTN2vZ27QngCrIep9AzlGQ:SyZMyXiwLdQFFFgDRMaQn/np9AoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626917502, "uuid": "0d4071ef-091a-4dad-abd0-526bdcd5668a", "value": 39763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626917502, "uuid": "e6e17cb3-32b6-4b90-a77f-15f95b23ebb3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626917502, "uuid": "68030d8c-b01d-48b8-8e9d-d274bbc12b76", "value": "01d650df6b3d16e446587f1183e7c253", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c0e3b2a-eac3-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1626940927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940927, "uuid": "dd5b28e0-9e07-4e94-b6b2-c1389e17ba2a", "comment": "Malware payload (AveMariaRAT)", "value": "36cbb216a9737402f9dfa4f7e7528d89", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940927, "uuid": "3ea9033c-3de5-4c8e-b7ff-640f6649988b", "comment": "Malware payload (AveMariaRAT)", "value": "16439cb0cbdf7399d29d66620895e9d23874e303638c8cf016239b9bc54e8d5e", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940927, "uuid": "4f188297-141b-441e-a040-eb871e9b8378", "comment": "Malware payload (AveMariaRAT)", "value": "43c641a1b5df61fc9078f6c86f26205358de674c", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940927, "uuid": "b14b8f7b-fbbe-417c-9115-77ea9ea2ec25", "comment": "Malware payload (AveMariaRAT)", "value": "f4202bd841c6f32765eef48d0c140d636d9851067952e7f17b3cb441c68a71576ca0d7ef8e827b89ce6bf38fbd4e5b90", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940927, "uuid": "898f9911-31a5-4930-bb29-14275685e539", "value": "T180B412721D5ABDA2CBBE177222B716045F3251776F07B68CB8C4099C076B3048B6B67E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940927, "uuid": "863df683-027d-4ea1-866f-940720f27c95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940927, "uuid": "f8fd8d69-9279-44d8-aa7b-6566274fedac", "value": "12288:DcU6OCS1O1p6xp2q3ImT77khlhuhxc+Ne:jCfg4q3d7A/yc+w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626940927, "uuid": "339f1434-d4e0-44fb-ba16-14529b0ec716", "value": 516096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626940927, "uuid": "16ff1721-7c63-4e78-a185-595098658fc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940927, "uuid": "e0108314-86d1-4acf-b219-ec9bb3409839", "value": "36cbb216a9737402f9dfa4f7e7528d89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1c15401-eaf2-11eb-875b-42010a9c0053", "comment": "Malware payload (Hancitor)", "timestamp": 1626961338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961338, "uuid": "fd2f62bc-6d91-4c23-a4b0-2c9b6f4279eb", "comment": "Malware payload (Hancitor)", "value": "b11b59f8b566048f4d57962eea548076", "object_relation": "md5", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961338, "uuid": "5077d373-d651-4df6-a008-8e3f7947f49f", "comment": "Malware payload (Hancitor)", "value": "166e48faaaae49f2d925c49d0febf96f0c9c8acd7457c1b542a60227b9068e4c", "object_relation": "sha256", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961338, "uuid": "365d9a8b-4057-4bd2-927a-453bf9c63a73", "comment": "Malware payload (Hancitor)", "value": "ce410e9091d92cacca15afb770311e069e9efa44", "object_relation": "sha1", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961338, "uuid": "a2517cfe-1bc7-4c9e-9992-1caacab926de", "comment": "Malware payload (Hancitor)", "value": "6ab100f56e1185018da5d43670a8588ddf5d140d0233bf611db58dec063e9d6763fc69a923f23401b72aa10c48cb5fcd", "object_relation": "sha3-384", "Tag": [ { "name": "Chanitor", "colour": "#3242A0", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626961338, "uuid": "e92f0b40-3de5-496c-b5f6-9eb8fd2c0722", "value": "T1E0748B11B241E922C196123A0F9DD685273ABCF11B35C6CB36AC7FAF9FF52934526342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626961338, "uuid": "ba58cd75-fe7c-4bb5-9d82-2aa45f6fa3dd", "value": "6144:oMZJUzBZaf84VE4l/ML5xEop3fduk3hOdsylKlgxopeiBNhZF+E+W2kdAcvvvvv8:PAO84VE4l/MLzEgl3fPEDvL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626961338, "uuid": "bd947bb6-eced-4735-bb79-027f9d537805", "value": 351232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626961338, "uuid": "f11be874-01dd-4d6e-bd3d-42a170a7727e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626961338, "uuid": "bf2c8df3-076e-4981-ab04-2fe12dcf2bba", "value": "0722_5065418752.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c40ca65-eb0d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626972844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626972844, "uuid": "bc4ab11f-3e89-4149-b35c-5ab8183402d9", "comment": "Malware payload (AgentTesla)", "value": "f0d2f3d209b220c52f1453c280574138", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626972844, "uuid": "1dc74259-8580-4f6a-a28a-3afdfcb03829", "comment": "Malware payload (AgentTesla)", "value": "16ca9330a520fa98fb78ba1fb3aef9e49ef6e0a9df70a696a239e9f4925d2714", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626972844, "uuid": "e7439f1e-f54a-45ae-80a9-572283365561", "comment": "Malware payload (AgentTesla)", "value": "563ea7d4e0df7d834a498d662340d528d5dff3d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626972844, "uuid": "e5c05104-2fbb-4301-a2fa-efe53a463f3b", "comment": "Malware payload (AgentTesla)", "value": "b1353fc0d41b2b83023451fc9c27f8da38509ca086fff6066eb6447f0778e872fd0dd8dfa93a77b3c48dfaa402045925", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626972844, "uuid": "964b2aaa-da3b-4296-b239-133fd9916a44", "value": "T15D05F175A32B9148CC3887F91C78D0A12B7BAC2D652EC33C1A94F17D7DB36785AE1285", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626972844, "uuid": "f6136106-f332-4f30-a532-87ef8fa69d21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626972844, "uuid": "76648d92-ea6b-4df1-a9cf-8ed4aacad44e", "value": "12288:9bOVe0b97T02BtaUc0r47/NdWCbsLf2UwOlOAflBzzwZgTCibyaUVKnp:9bOVeKgkmlFYr26lOKlBzztCiuahp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626972844, "uuid": "a02b8a36-4f6a-45b8-ad25-a95107fa1971", "value": 829952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626972844, "uuid": "50c042bc-e41c-4da7-a854-25e1e2bda9c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626972844, "uuid": "061426e9-67b4-4465-83b4-c336c6e81799", "value": "shipping documents pdf,.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c4d444-eb03-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626968433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968433, "uuid": "7dbf84d0-c952-434c-8f65-afe5075bd02d", "comment": "Malware payload (AgentTesla)", "value": "118f0e5d6a1c91a5b820741669c495d7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968433, "uuid": "740c4ab0-a6b2-40a7-98bf-e9cc80695106", "comment": "Malware payload (AgentTesla)", "value": "16d0e36df66a1ba451c25a5f5c1fcccca5cb415a81cb8820f89811232c4fc3b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968433, "uuid": "1fc482b3-c332-4059-b988-263030df006a", "comment": "Malware payload (AgentTesla)", "value": "933d498bf7eea29d1dedd4b597692d62c6dc53d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968433, "uuid": "0d56c8b7-81f6-4fa4-b573-1f6dcca23f51", "comment": "Malware payload (AgentTesla)", "value": "e6988d5d0369f1f464c32f7a73e384e7ead1d9164a8d62f4c8195240f5688d8134caa0a567b8103fc5e62dbf68e23416", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968433, "uuid": "fb798ee1-3395-45b0-8cb3-f68a96f5f4c5", "value": "T1C7158C525ECE865EC2694DB69731AC5682314CBA2948F3132EC134FDD93F3ED899F602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968433, "uuid": "11415027-1fba-4933-bcd9-14554de2bbbe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968433, "uuid": "84dbf8ac-1c33-4599-b106-3903d9ff236f", "value": "12288:nwRHMJfTDAe9AVLYy6t4XlJIT7652mgkSMPQipP5q:nwRsdT19qMy6tIsnipQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626968433, "uuid": "7cdd0bb5-b9ec-4b27-9216-4d6aaddba417", "value": 883200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626968433, "uuid": "37d17553-5417-4959-b262-d0042f2e9cf4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968433, "uuid": "79467781-cc42-431c-99c1-f571bd5cf96c", "value": "118f0e5d6a1c91a5b820741669c495d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f52d51f-eac2-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626940610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940610, "uuid": "2c872c87-7e46-4076-a194-09c8e71ae31d", "comment": "Malware payload (Mirai)", "value": "65485532764325b89b675a4b48c2d662", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940610, "uuid": "c8c945e5-691a-4d49-9efb-2a42ded0d07b", "comment": "Malware payload (Mirai)", "value": "180952103cde9d3d9b2fbfc57817eb7810d791bd3e3dcaa61cb4f4dbfabf7e3f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940610, "uuid": "e061edd7-b948-4cc8-803c-264a6b3b5a26", "comment": "Malware payload (Mirai)", "value": "633f405d9bdf92e8bac134ad2d73ca579e353845", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940610, "uuid": "82d63092-e9a0-4167-8be9-e04616abe01b", "comment": "Malware payload (Mirai)", "value": "ef0cd571da95dc75fc0e323b2713d3ac96dbba6d497fab052eba88f8748b1cc2625db2e19282204756e7973691e2918c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940610, "uuid": "1ff826cd-94ba-4841-9de1-a79257e67a79", "value": "T14BB2D0717015B8B3C7E200779AEDCA43BB841EF8D0E873291465099DEAD9D42BAF1147", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940610, "uuid": "3eed7982-0b81-43fa-9ac1-a811fd59eb18", "value": "768:fX9nxn8o9wnBoWzEQf2EjKb3pDWs3Uozg:ftn+o9wjfBAZvzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626940610, "uuid": "a3453bfc-19df-4a43-87d4-2b3bbca3cc77", "value": 25004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626940610, "uuid": "1a13403a-51eb-4d90-85b2-335ab577dce6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940610, "uuid": "cd1a1c26-0768-45a5-a3dd-53eee68e130b", "value": "65485532764325b89b675a4b48c2d662", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00f2786d-eae4-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626955055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955055, "uuid": "9f3ecdca-023e-485b-8547-94f859318b76", "comment": "Malware payload (AgentTesla)", "value": "99d846bbf242277134ba3b6cb92ab2eb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955055, "uuid": "44238d4c-39a5-456d-876f-9924d83482d1", "comment": "Malware payload (AgentTesla)", "value": "1988aecd504c91c63584f0ee4aa3d1a9d6f0f879763e7fc695230ec2703cb07b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955055, "uuid": "e5174b1e-957d-47a5-b8d5-110897ce5660", "comment": "Malware payload (AgentTesla)", "value": "96dcb922a1213c55bce5edeada748112b760d9db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955055, "uuid": "035f2542-ce3a-4d58-b8c6-bf5d85717207", "comment": "Malware payload (AgentTesla)", "value": "fe1b1c54e7ff8bf84801db74a3df69286e9a862655ea6bda4a31919c970e1add37275b0d12727e4ee2781d04a35db7c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955055, "uuid": "d4d0e9b2-ad2f-4518-b6dc-0070b0fb3c42", "value": "T181159D125DCF865EC2694DB69731AC5282314DBA2A48F3123EC135EDD93F2EDC99F602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955055, "uuid": "a7ace83c-f77b-42ed-90a1-4de8c986003c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955055, "uuid": "554a4060-d886-491d-987c-b3dbcf24fe9f", "value": "12288:Sk2xCTW1mL3ySOqN2LFffpScuKSgLfXSwUSMPQipP5K:SZxCTW1mzyJFwcuxoVipw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626955055, "uuid": "40238f7b-eca9-44de-a831-26377b55d39f", "value": 915456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626955055, "uuid": "6cbe6eef-fcfa-4f66-a60c-1edeb00fde38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955055, "uuid": "4df2ab9c-c6f8-4019-bf7e-278b57caa4c6", "value": "Released Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f3f340b-ea8c-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626917498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626917498, "uuid": "dd0d2955-fed4-4bae-a615-f5a259496b2a", "comment": "Malware payload (Mirai)", "value": "811c537de9fc79f15e5330a8227d8ec9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626917498, "uuid": "39583d71-c5b7-40dd-8077-56266f7ab8eb", "comment": "Malware payload (Mirai)", "value": "19f8dbe18e4252e55ceb7fc820cea3def4901be6f0305d0a510423ae80b002be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626917498, "uuid": "f8fc07dc-611b-497f-bfa0-828f3410345a", "comment": "Malware payload (Mirai)", "value": "d80494e6193b7966c6b523c91e4c62f843d962b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626917498, "uuid": "052b84d7-492e-40f3-9592-d85dcd4147eb", "comment": "Malware payload (Mirai)", "value": "558fe2123aec60fd945e2039d8963641f3e8c26029ed83533cefed1d56a4f0f7e8fab1c87e3958fa36ddced02a75b193", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626917498, "uuid": "74f81124-0fe1-406c-bda0-8eb58b9259f1", "value": "T19D03F942AD41CB17C2D31BBAB6DF87AD3B2579059B9B33017A297DF41B477DC2628210", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626917498, "uuid": "1a29a0fb-6a03-455c-b719-1fd091f57b5f", "value": "768:VOyZIXf9Ydo07WfPyTL8QFAb0jJVKDTNdvZ27QngCrIep9AzlGQ:kyZMyXiwL8QFFFgDRTaQn/np9AoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626917498, "uuid": "1e882577-397e-4690-8e33-8583b2650346", "value": 39763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626917498, "uuid": "dd21ebb4-e4d1-4232-a59d-23e47c8a1700", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626917498, "uuid": "ead85cac-79c3-40e4-8645-7b16795c5584", "value": "811c537de9fc79f15e5330a8227d8ec9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2487c72c-eb42-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626995487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626995487, "uuid": "a1be5dcd-87c3-465a-bf9c-9c95460e7092", "comment": "Malware payload", "value": "533f075cb707228a6c46a3ccdd9e5ce3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626995487, "uuid": "3cda1187-cd8a-4774-bfd4-c3662d0566f3", "comment": "Malware payload", "value": "1b926057f856a1e998a55a925ee07fe8132a5ec47db59315be55d06a13363ac1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626995487, "uuid": "aacde30a-3ddc-44f9-a6cb-d5d636fd7e26", "comment": "Malware payload", "value": "c82066d64ced30a790aac4de89aa8ea4f62c4556", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626995487, "uuid": "8f1d60ef-5442-4531-8388-d6521b326e49", "comment": "Malware payload", "value": "bd37dbdddf99d666ce06434ba84e531c8d2431ecacd36a3a06ffb0961a0022787b226a668676bf89bee482835d8c3ce7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626995487, "uuid": "c60b2a89-9410-499f-9a9a-d14d151f1fb4", "value": "T19CE24B35BE62186FC4C85E7A55E74725B6F6434F38F88A3B3C220E9CBF04A447253669", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626995487, "uuid": "f5d02631-cba4-4792-ab98-f2a4820a76fc", "value": "384:OGHQmVI7tBJ3aXoOCZM4P8IFU+pMqdY9HlMaGACqqYjDw:OwQmVI7l33FNO+uKaGACqqYjDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626995487, "uuid": "58d7145f-a0b4-4dd2-8ce1-5d82844c8997", "value": 32920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626995487, "uuid": "c8d695f4-9858-4aba-8a63-3c678008af9c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626995487, "uuid": "1e6dc73c-246d-4d5e-83fb-83f5f457676e", "value": "533f075cb707228a6c46a3ccdd9e5ce3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d381b248-eae9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626957556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626957556, "uuid": "87683fad-1549-4e8e-9f0a-c77b25a3c0b0", "comment": "Malware payload (AgentTesla)", "value": "506887f557d9399e9cd663b65b2271d5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626957556, "uuid": "ca39f862-7870-427a-bd92-5c05cb206aa8", "comment": "Malware payload (AgentTesla)", "value": "1ba742a8035002362e46828bcb7a24342bed430d6bcd59999afd520dba3de81e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626957556, "uuid": "72d7d48a-b278-4dfd-9923-0a93843aa1b7", "comment": "Malware payload (AgentTesla)", "value": "4ff9f4cc2408073bf91b87a92ba6f6d74efcead0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626957556, "uuid": "fefac21c-7599-4f70-b699-cd3b23870074", "comment": "Malware payload (AgentTesla)", "value": "606bf5378d25690bda1ed0e143fe54bd649db8b214d69522dc2d6f83c3c796475992aedff654c5efe212aadbf2919679", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626957556, "uuid": "c3b3abdd-4661-4bfa-b181-a4dd78ad60cc", "value": "T11FF4E174A31FA714DD3887FD2C58D06127FAE01E932DD6383F9890BC7DB2AA856E1641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626957556, "uuid": "598c5326-3440-43e0-980d-ed80a90a1974", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626957556, "uuid": "360bc4ac-6193-41c9-89f6-3cc6a250cbe9", "value": "12288:SduXHHM91/db79sRsFPbN8RkjGdu6sBnIMRvx8Xl+2syaUVKnp:SduXnOvXBN8+jGdDsxJtx2hzahp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626957556, "uuid": "d000ba1e-3433-4759-9bb0-a80604487773", "value": 760320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626957556, "uuid": "6b3a48f5-2308-44d8-a222-592a7c87908b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626957556, "uuid": "aa386eac-d130-482a-aa15-e6b646a4ac23", "value": "QUOTATION 22072021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2420d009-ea9b-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1626923761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626923761, "uuid": "f68a4673-9edd-48e9-add2-c93b0e62a0d9", "comment": "Malware payload (NanoCore)", "value": "922bbf421cd0c9b155f45388db7c8718", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626923761, "uuid": "e35227a2-1243-4fab-9786-09b84f325bff", "comment": "Malware payload (NanoCore)", "value": "1bf63394fcf232d3a303d17df87252e2f47c43205edadc99ed15a50c9e193ebc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626923761, "uuid": "28698fbc-7dc5-4c95-9376-29d74da7929e", "comment": "Malware payload (NanoCore)", "value": "993cd3bc36c7d903846cf9ee4fb1e8e01dec4947", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626923761, "uuid": "55c185f3-bfcf-494e-ad8f-3f40bafbfc89", "comment": "Malware payload (NanoCore)", "value": "32a9090cf950269d447a951ab09747fae99230674e935b0d72b03e79bce35a7da51443f255c81485230d251701d8c69b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626923761, "uuid": "4a9926e8-91de-48c0-97f9-6466370c9be0", "value": "T156351201B7C184B2E5732D36593DAB14AD7A7C201F399B6FA7D0086EEA355806634FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626923761, "uuid": "3131a6b1-8b42-4bd9-8dc6-fee0d3e85754", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626923761, "uuid": "e22f077b-9910-4fc5-8227-15c5083d96c3", "value": "24576:BAOcZpJ/cpMh+itmP6UvJmoSSvVUYG4Y7:bLRit6YoSyVUYG4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626923761, "uuid": "ce68235c-b834-45fb-a6d3-2642cfe34f3d", "value": 1105214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626923761, "uuid": "e39cf0f9-698d-4804-8471-e059478fe45d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626923761, "uuid": "4edc2306-0171-470e-936d-303bfb56df63", "value": "922BBF421CD0C9B155F45388DB7C8718.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f843c1-eb03-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626968562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968562, "uuid": "92c0b5ba-a3a8-4bcc-a160-667625ac3c2a", "comment": "Malware payload (RedLineStealer)", "value": "6f56e641e32df6a900e9d1df8cbf9d75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968562, "uuid": "35623c32-e4ed-4d1f-8ba8-3ee0ab52ceaa", "comment": "Malware payload (RedLineStealer)", "value": "1c71882d62d7a36cf44d0853be20224422fc43dc9f495492b72bff3f1f6d5f9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968562, "uuid": "4892da8e-358a-4166-aa5e-79a0c01c49b9", "comment": "Malware payload (RedLineStealer)", "value": "198390a6e05195d781272dd281d927b057ffa479", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968562, "uuid": "96c652d5-7350-4497-93e9-09470079281f", "comment": "Malware payload (RedLineStealer)", "value": "6fd50b74059103d814871b29d0a9ee0a8a19dd97cfffd11282d5a8a56214c34079192fd7f2790b72d315db1049173250", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968562, "uuid": "dcc6bcc1-4099-497e-a733-7672bf5f362f", "value": "T101B3A4E660550EE1DDFA053DFF0A0A163581FE5AD7C93AD0BCEF168853A28BC2D08756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968562, "uuid": "933b3b0b-3528-407b-878b-cf6badf35d7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968562, "uuid": "08fda9f0-8a7f-4a17-b1e6-e92b431d3156", "value": "1536:YjdwGhs5F+k1eKlkjYLXUimzf9IdtSyR8KAR:YjdwGkF+kRvLXndtF8KAR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626968562, "uuid": "56d91bcb-55b1-4b3a-a00c-8ec1c6696530", "value": 109056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626968562, "uuid": "c7060d4c-c2a1-496d-a691-7c4cb0d2d749", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968562, "uuid": "d2e20dec-10ae-467b-9e7c-4ee4960b7a6c", "value": "6f56e641e32df6a900e9d1df8cbf9d75.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72214e5f-eb08-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626970707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626970707, "uuid": "54f16622-96ab-491c-8006-54e8b8ddf6d1", "comment": "Malware payload (AgentTesla)", "value": "bacc98ebdf2f1565f597959c6d8206b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626970707, "uuid": "ef29cd02-f2b2-405f-9cad-04977b022317", "comment": "Malware payload (AgentTesla)", "value": "1c8aaaf7bc3a1bc66019e9c9dfe13128368a7ea086a670fee41c9f28b1837fe4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626970707, "uuid": "d07c4348-4457-452c-b32e-3662a553ad54", "comment": "Malware payload (AgentTesla)", "value": "06305b159bbb94f2f2b6ce99f393c1ab1ebbd93d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626970707, "uuid": "a26b1ec6-747c-4dd4-89bd-0e140a645a7f", "comment": "Malware payload (AgentTesla)", "value": "0e9c2f5dcfb0f0dcebc785834f5e763ea8e1f2848505a385d61aa9ae21c51544ee4db95621bc27f1b22341d6e145e126", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626970707, "uuid": "40e55ac6-dedd-4c55-9132-604b2bb47cd1", "value": "T17EA48C3805685A23C67AA673D268E701FFF05A937240CE1A5BC7D5CB1E1360369CEE5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626970707, "uuid": "029c70b2-4c6a-4897-aaaa-d19db47ec437", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626970707, "uuid": "13908dce-2329-412f-af28-ec5f2d42d414", "value": "6144:6OML53822w3Ha2aAzmau6GGnoRiSzmMQbL+Qt7wv4cH/hjW9LTbrJbzcoy9WL:sNz62aAyR6Ho/hQbSQt8v4cH8Zl/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626970707, "uuid": "d3bd12e2-20c0-4282-8019-b260858e79d3", "value": 462848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626970707, "uuid": "782d9c2c-510f-4671-9679-89dea0aadfad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626970707, "uuid": "8dd3f1a4-4f4c-443c-8e54-870cead8badb", "value": "HSBc20210216B1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be64935-eae4-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1626955073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955073, "uuid": "4a318def-5514-4ff6-a429-f981fe62f4bb", "comment": "Malware payload (GuLoader)", "value": "b7cdda847140697b7bb7866b06d2a225", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955073, "uuid": "e44a9195-0e7c-433a-b6ad-90ccbc3141f5", "comment": "Malware payload (GuLoader)", "value": "1e7447cb7adb3336fcf6d2837781a2ab0d9f9fd3060cde3a47293bd34a883cdb", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955073, "uuid": "f4b11fa5-36be-416c-baa1-eaac7513cdf6", "comment": "Malware payload (GuLoader)", "value": "874d1157c6e65813383c6b4bffd4d48948993c88", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955073, "uuid": "8f3f820a-ae09-4dc8-aa0a-840a694b04db", "comment": "Malware payload (GuLoader)", "value": "8f186af37fbfd22555aaae83372d29f62ee51783bc5179b3cdcde4fe80c00d5dcd6c3fbe8619d36ef0bbc9ee86f8a548", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955073, "uuid": "bd8b0ee2-9add-4ed1-a43c-9bf991254317", "value": "T13C4522B26D51D726E0B615F990C7645A7894EEFA1730826132FEB605B2F013143DB39F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955073, "uuid": "246a753a-7513-4225-b6ca-b33458d4ca35", "value": "24576:nPaV0dsm4NwrrC+F5BNEggUPmQIE9Nc3HCcbRPJHVYgt0W/uMCrYjxaY5SAF:Pw0Jl3OUbIEsXdbRxbh/aBYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626955073, "uuid": "5ee0d4bc-8c37-4bbb-8f42-ce12f2423213", "value": 1267200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626955073, "uuid": "bfb8d7dd-acfe-4d0d-9a39-25de10bbb42b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955073, "uuid": "d6f87556-8cbc-46e3-ba4b-46efbd697c0c", "value": "MILKA CHOCO COW BISCUITS AND CADBURY OFFERS,TWIX,SNICKERS,BOUNTY,GALAXY.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e2e4891-eaeb-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626958272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958272, "uuid": "92c34af2-4693-457e-8e63-750e1db37328", "comment": "Malware payload (Loki)", "value": "4e7c50fb3577f51f87e113c2fc40d5e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958272, "uuid": "89d41230-48ee-4ac4-8c8d-82640f2544c2", "comment": "Malware payload (Loki)", "value": "1ea40cca77e0d4e409a0a2364b57d43b05ee46736b2b656744054790e0c8608d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958272, "uuid": "d6d47e60-912c-4cb0-82ed-63ba13fb4a95", "comment": "Malware payload (Loki)", "value": "6bedd0186bccaf9e5e2ae9581ef75f3754efafd5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958272, "uuid": "4e79867f-934c-4cf9-ba0d-d376e150d82e", "comment": "Malware payload (Loki)", "value": "35b9499afe5a85c69e01c4263ec10abde27a4dfe6bed576331f852fc7ce00e65a42e3bb4965de50310430cd349332f29", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958272, "uuid": "77727d4b-7273-4902-93d5-287dfd37da14", "value": "T17144CF10B6C0CC73C2A10A3604E7A7946A7EFC666E3D865777447BCF6E712C1666D30A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958272, "uuid": "f293e327-7215-4845-9f65-7acab0f83155", "value": "d1928a342020b866506f1f9f22fa697b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958272, "uuid": "280f3f65-85b0-4f97-9195-7112ca399379", "value": "6144:k5W0qPpHKMALL5qLyX9nalrFzBnmytldWS:kurAH5GyALhm2ld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626958272, "uuid": "a48e28bf-1bc2-4423-be37-aaea822150ed", "value": 255488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626958272, "uuid": "a9da0e1a-1d0c-4c27-ae6a-a122f830efeb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958272, "uuid": "5a90277a-4267-404a-ba77-5dd5935f631e", "value": "4e7c50fb3577f51f87e113c2fc40d5e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af4f5591-eab3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626934302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626934302, "uuid": "d44997af-6a95-48e3-a76b-c952856f94de", "comment": "Malware payload (AgentTesla)", "value": "ad0aa820dcbc9a5e4287457c8eaf6cdb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626934302, "uuid": "241b6314-ae74-438b-84a1-59239f4196ed", "comment": "Malware payload (AgentTesla)", "value": "1f36a33a58c5ff8769f6476da0bce547f0dee33b6128cb95b27e6074fc920f5f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626934302, "uuid": "39ef7dc9-9525-4270-adf6-8ae9f55ba254", "comment": "Malware payload (AgentTesla)", "value": "366b710a60122772ca55b7dbc7a01a64ff9c848f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626934302, "uuid": "e4912bde-72bd-4efe-bd18-cd6156da7647", "comment": "Malware payload (AgentTesla)", "value": "3a646272bbed450c6c50b7c8f1a1409fcdc513f6d8c57b4fe997039f59beda5c290307e38810b1117fb398ab6a4f3390", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626934302, "uuid": "0c2214da-d120-4fe0-a633-c9b3eb8e7d80", "value": "T10A458C61F307EA98EC2213B8C876D8F12263BD6DD525892F359E7E1DB9B334150E2907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626934302, "uuid": "07466dea-79fc-41c7-a259-f5ef82f60875", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626934302, "uuid": "3bb32d99-b48e-4b23-be41-22f9e826c19a", "value": "12288:6gVPfTZwuKkZ8JHmwUYcJPPPZI5TJRGB1EVirf6PUU28d1PeqYNyaUVKnp:JfTSdkOlwP3kTXGB1yi4xVeqahp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626934302, "uuid": "75f1bb30-3d4b-4d05-94ff-f03947fedc90", "value": 1169920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626934302, "uuid": "d6b821dd-a940-4e30-a033-df511c092d8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626934302, "uuid": "93a2c5c8-e8c8-41c5-ac51-3631bb6fc437", "value": "Technical Drawing Specification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3094e5ab-ea80-11eb-875b-42010a9c0053", "comment": "Malware payload (Heodo)", "timestamp": 1626912185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626912185, "uuid": "71328781-fb8e-4c67-a8b7-babc3c2fa586", "comment": "Malware payload (Heodo)", "value": "6aec6aee754419c449358e21fc5cadea", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626912185, "uuid": "35cecdc4-468f-4bc2-92fa-ce07aff26129", "comment": "Malware payload (Heodo)", "value": "2049636dacf350e2d08a2c977750ccbf4b8cc13732aac3863be940facd7a5989", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626912185, "uuid": "6e45ad85-dace-48a6-aeb9-0b42c80de2d4", "comment": "Malware payload (Heodo)", "value": "76bf3a742f006eacbf948423b5154b9344b839da", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626912185, "uuid": "2aac0d44-de8a-4cac-b2b1-1047d689309f", "comment": "Malware payload (Heodo)", "value": "add08ec3be10358c567a82c3686897d4e77709b98af8899d609613363d0382d9735eac6184cee7d60a77c4979f5ede59", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626912185, "uuid": "d9669012-1b58-42e0-8431-af284e42cf40", "value": "T129354A55BCE104BAC13BF2314896A2A1F6327C6943316BD71F8165BA1AB4BD03A3D7DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626912185, "uuid": "ffb568fc-545d-4f60-8afe-5df7ebb350f6", "value": "11816731f87952ce23da086b67eb30cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626912185, "uuid": "6deb6f1d-028a-4a13-b204-b9ea388b2e7e", "value": "12288:yS7oCiYqlAOsxk8wf5HUyDKpLHNPXo3gawdCaBSPZC1XZxWjT4lYJ:roCsnEkHxD4Tdo3GIyX2T4lYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626912185, "uuid": "eb77b8cf-0275-4a33-8bae-bd1c8d7d0e14", "value": 1091083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626912185, "uuid": "15a7800c-2579-4633-978d-e9f7658e038a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626912185, "uuid": "99fb46c4-61a4-4412-a648-1913c5dd791e", "value": "ZlvFNj.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f6e00c7-ea9e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626925041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626925041, "uuid": "6800344a-d103-4202-bb43-75cf7ef95c0e", "comment": "Malware payload (AgentTesla)", "value": "f6fa09a57fafac2e5cddc581361cd39b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626925041, "uuid": "ba9a8b32-997f-4627-9950-432e3ba73eb2", "comment": "Malware payload (AgentTesla)", "value": "21b566d7ce91cf64d9161fde5a3c1370252ac57128427181cf42ad81a8fdd241", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626925041, "uuid": "ca291245-381f-47c6-bb48-cb9b7c933218", "comment": "Malware payload (AgentTesla)", "value": "23b4dbe6b269c05e5d383a29221ec6151b6d5b5c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626925041, "uuid": "f36bef52-e156-42a4-a950-0cd989ea2eba", "comment": "Malware payload (AgentTesla)", "value": "ff2cb141de014524a8230ef8bae3c05906388df2fd9b4488239ad6b867f4dedf9dea58338d0c274f1417aaf3497e1c14", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626925041, "uuid": "a0c5e5dd-8ba0-4a64-afa7-e48957ed176f", "value": "T1993402ADAB2D67F4C214F2B432AC62BE664013F0592F361367A12B999F0D7E15730F85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626925041, "uuid": "2e0eaeae-7cc6-43e2-a009-b883e2efcff4", "value": "ad7593902351b94d30c5d42690419916", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626925041, "uuid": "0bf687a3-74fa-46dd-8368-fdba6a4c8a1b", "value": "6144:kW/GEVbVavD+NmmwLe+KAc45JpP3Gz+aju1TDl9uLh:9/GEV6+PGpkIJp/18udOd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626925041, "uuid": "6d0cf57f-533a-4868-8fdc-4805ece0ff19", "value": 233360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626925041, "uuid": "27ba761d-65c1-42ca-97cb-058fe5c3259f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626925041, "uuid": "663aa3c6-5f87-401a-955a-4eb45e28948f", "value": "SecuriteInfo.com.Variant.Zusy.394472.4088.27156", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf99fde-eaa2-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626926728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626926728, "uuid": "95f0a51d-abc4-4a77-bf11-18300b45d8fc", "comment": "Malware payload (Mirai)", "value": "b0045db070ce66eee2c1e77d3a9c96a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626926728, "uuid": "931dd734-501e-4928-a21e-674af1feccfe", "comment": "Malware payload (Mirai)", "value": "222ce13aead18b075331ab14d4f39e7172dc8269003935015a89c821b11aca75", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626926728, "uuid": "f904fade-3357-4ceb-911f-a55b24103aa1", "comment": "Malware payload (Mirai)", "value": "e6e178c12bd6e0db9e46a86ee3dd11549d6d3f20", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626926728, "uuid": "f2a517a6-141c-46cf-abf9-d1311c838bbd", "comment": "Malware payload (Mirai)", "value": "3366ad092edc2924b48b45a032529d2ea6354f80ceb06b6fadd3b169618e423d8cba0022bc5cc8a3d94bb6adf91a24a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626926728, "uuid": "6edf3054-d426-4890-a2f8-23af5e5cbd00", "value": "T16BA31A5AFB808F07C0D22775BADF82513323DB55D7DB23065628ABF43F867AA4E22505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626926728, "uuid": "f6ff5e45-61b1-4255-bf8c-359ac83f0d3a", "value": "1536:3wn88dlACc/wzxVGMc/rsalb8iZIWnBG8i6A3AJCwPwzzw/97C0/aifgs:4diCc/wzxVGMc/rfIso6A3jwoM/9dIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626926728, "uuid": "9e8ca9b2-76d5-491a-b0de-404b4f1b8231", "value": 98345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626926728, "uuid": "a5bca408-a04c-4895-a9ec-9855958c6ec6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626926728, "uuid": "9e4c4a81-894b-4420-baf7-5f02a6bda030", "value": "b0045db070ce66eee2c1e77d3a9c96a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15f6fe74-eab2-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626933615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626933615, "uuid": "ad78a7af-212a-44fb-8c75-2ddb696c0465", "comment": "Malware payload (Mirai)", "value": "24088d9e6e23acdac830af0505ecb228", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626933615, "uuid": "4132050b-ed38-4ad4-b2e4-4d017437a388", "comment": "Malware payload (Mirai)", "value": "23e9cba48eabb462c299778346f997eb4acb522f5ffe599d0cd5b8ed691491ec", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626933615, "uuid": "c57dddae-38b4-40a3-b193-6341d5d94818", "comment": "Malware payload (Mirai)", "value": "cd9b3b66b6eee09b2cbb03cc09f660e1109fb11d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626933615, "uuid": "cbfb924d-39cd-447a-87cb-2069accbc0b7", "comment": "Malware payload (Mirai)", "value": "2b81e469087907f7f90986807ff718ae350861a325f8edfa8a9703048607c15964b1b8a8f8e1409acd74f3a4ae1c5e41", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626933615, "uuid": "fc92f1ba-a7d8-4095-9ec6-d50972b59955", "value": "T10F64029BE9727C4BEE474FF021A70A461BFCD2DAD3C659907368844439FE24293647C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626933615, "uuid": "a1399863-930e-42db-989a-f0d7e1f34484", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6cok:7O/QJHZweEL/NOjCHm7FZZncj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626933615, "uuid": "25316610-bdf3-4554-9567-485058277b99", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626933615, "uuid": "04368c1d-4450-4eb3-a642-397d2cd74906", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626933615, "uuid": "5d7370eb-9ed2-42dc-ab2e-ff5351947007", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70abfbf3-eae4-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1626955242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955242, "uuid": "572dd23d-937f-455c-886f-7d968e4c0deb", "comment": "Malware payload (OskiStealer)", "value": "7cdabce07469c95df2bfe4bb692757d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955242, "uuid": "37875ec9-e861-47fe-9543-40488ca1c609", "comment": "Malware payload (OskiStealer)", "value": "242acd2bd4415b211de8afd058570aac478e1c257d31e908a2823b8fb3788ede", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955242, "uuid": "485833dc-80ea-467a-b371-321a1453a620", "comment": "Malware payload (OskiStealer)", "value": "be7905986d224b15517c5b41d4fc30fec309bd8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955242, "uuid": "32cc7c43-d249-49bf-8d1b-4ccf55b9036d", "comment": "Malware payload (OskiStealer)", "value": "d61d90d51664e6bec791ee27d7d35de8ac87324c3277d319db0560a20347d062a447cecd992f679e72c20ed5fe0d452b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955242, "uuid": "12759a21-4f7a-4807-b63a-20fb33de4220", "value": "T13D455C2AB303D080FE6D15B2CDE4FBF0051BFC2BCA0E991715953E96B477AAE1676142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955242, "uuid": "71288110-45de-49a4-86ae-6003b5ef4d9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955242, "uuid": "f38cd9ca-c1dc-4995-9a3a-e8ad196ab1cd", "value": "12288:L0GiqKFs/QF1NnQKO4DvL7hcomsEZPBUzOlCNmQOk09lIhZ2B9syaUVKnplRjG0R:B6F9FHnQKOO6z59lymqkcmzahpr7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626955242, "uuid": "d7731970-f9d0-4829-9a3f-32f3a61e0e4a", "value": 1181184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626955242, "uuid": "cbd0c058-d429-4d27-a0c5-34ded34d8045", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955242, "uuid": "0e5416ec-bbdb-4ffb-bc4a-e4c85106a2c7", "value": "DOC98374933_JULY2021.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18d298be-eab8-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626936197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626936197, "uuid": "1baf310c-611a-4f01-b410-17c9b7b6721a", "comment": "Malware payload (Formbook)", "value": "b9bca038d7532ec8a1a9ba0e867061bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626936197, "uuid": "a7a08b8f-a5fb-497a-bce7-525c9aa1f3c5", "comment": "Malware payload (Formbook)", "value": "24d91f6c3dcad36d65e45821d520aaabc2f4a87bb1ab512d6807377010d5680e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626936197, "uuid": "f34a82be-44d7-4cb0-bc8a-3370fbfae06b", "comment": "Malware payload (Formbook)", "value": "6596ac1216bf03d88482415755c499ed6388cab4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626936197, "uuid": "69947cd2-1dd7-41a9-b367-863ec64caaf8", "comment": "Malware payload (Formbook)", "value": "4b44d18e1c10a91a5106fece7aa1bb9d460357ee14d29fdcc49e2ee35f3fe86ef250dfc1f7ed7e797d9b94454976ab42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626936197, "uuid": "30a87483-e518-4eed-96bd-1087afd29355", "value": "T12ED4F1683258BBAEC57FEB79C5480C2067B0A123831FE786AC5751FD1C4D782CE66297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626936197, "uuid": "72a7752a-7bcd-45ca-a3a3-f8ce861a13fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626936197, "uuid": "4e45958a-78a9-401b-860b-f523b5430dbc", "value": "12288:NRzBs9vQVJ16RzfqfJ3druK3MfxoH6prHTdtqMVkhV8Rb:NQ9vQr147qfJ4nxxHTni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626936197, "uuid": "870c0a0e-3b2d-4269-95aa-ce3cfe43ab70", "value": 605696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626936197, "uuid": "a2375a2e-2434-409f-a5e3-4c686cda6167", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626936197, "uuid": "516b2d90-1184-4b93-8725-05fffb774c78", "value": "mal.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf40ee93-eae9-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626957549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626957549, "uuid": "5e4ded79-1d03-42b9-bbc1-80e54f9e3bdc", "comment": "Malware payload (Formbook)", "value": "020c3201638570f2858099e3e522a9a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626957549, "uuid": "ea3a960a-ab4a-4cae-b477-487d1775b208", "comment": "Malware payload (Formbook)", "value": "24e635e80cecd03066225b27fdb524c4542586b22dc820e05f8a02072008c674", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626957549, "uuid": "c8983303-724a-4211-b572-e21a965329ae", "comment": "Malware payload (Formbook)", "value": "c3977925522b50fc59c2d2e1e014e24052d36fce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626957549, "uuid": "dc6609e8-1000-46f9-8785-6ac4677117ee", "comment": "Malware payload (Formbook)", "value": "add0257e765dbacf1ddc7bf960e4d3aa41a2f00a59c94f98e859e65a6887cb04d10d74a5ac12a7bb0113c5387e6cb978", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626957549, "uuid": "75c88ed4-8875-4f74-b612-1d55f4becc0f", "value": "T170159D164ECE866FC2684DB69731AC5682314DBA2549F3132EC134EDD93F2EDC99F602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626957549, "uuid": "d16f5c19-51aa-4c57-99d8-fa55fd1286a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626957549, "uuid": "c2da64cf-1143-472a-8a15-15a151e00770", "value": "12288:EevfpBhp6/J8jv5kD7D8i9Tjo/REzfzxuynJ14SMPQipP56:fvxB6h65kvD8A0/RAipg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626957549, "uuid": "72d79c81-1b45-4bd0-a3a4-6d8d03f8e1bc", "value": 941056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626957549, "uuid": "0199d2db-c294-4e14-a646-132aba508dcc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626957549, "uuid": "45c2d701-930a-4c2b-bd0e-72bc0d25d9b2", "value": "#6495PI-29458-2020.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "912a87c0-eaf5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626962598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626962598, "uuid": "fdee80e7-b5ab-4759-ba0c-9f10ffca0f0a", "comment": "Malware payload (Mirai)", "value": "bf15c27e74a5d5c0d494ec3684df2498", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626962598, "uuid": "2af82597-fd9b-400c-b4ea-15b7305680ae", "comment": "Malware payload (Mirai)", "value": "262f1e831ce256418ed5592425404e2490d599f472cbba91f95968d18978144a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626962598, "uuid": "78eed339-e29d-4101-bfaa-7549e210ec8e", "comment": "Malware payload (Mirai)", "value": "d6e9d51bf5d932db1338181e763e000ddf343724", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626962598, "uuid": "f66cd551-e6cd-475d-a7d0-5d6e7e6f18ea", "comment": "Malware payload (Mirai)", "value": "fb49b7e3ef16de788921dae8011b7f5f3a176eda8d9c97bc78adcfb9c98392f8e70c916c14cb9312c497f29eb1b8aa8c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626962598, "uuid": "7963cd86-8712-4954-be96-9f5dda20f7bd", "value": "T12264F1CAEF01AE35E9C01679BA5F034DB3768BA9D3C7F111F610C6193ADA1899F76084", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626962598, "uuid": "a3a9b942-9cbb-42b2-a6b0-43b7b1c42e24", "value": "6144:p3lOYoaja8xzx/0wsxzSiCoNsKqqfPqOJ:p1CG/jsxzXCHKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626962598, "uuid": "2af1cf6d-cf38-4f9d-88d8-565d4c164c90", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626962598, "uuid": "54ad28d7-773a-4ffd-8336-c9922c2525ce", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626962598, "uuid": "4477e6d1-5844-4fcb-8c18-141f3a939ced", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5cca7a3-eaf4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626962230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626962230, "uuid": "82a941e1-031c-486a-8982-a1f7785e745b", "comment": "Malware payload", "value": "ed72247927e807190e0efc16fc3d910e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626962230, "uuid": "973376ca-23d7-473e-8396-06264dab1893", "comment": "Malware payload", "value": "295d0aa4bf13befebafd7f5717e7e4b3b41a2de5ef5123ee699d38745f39ca4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626962230, "uuid": "856b27f6-cf3a-4c36-a7ed-1bafdbcddea2", "comment": "Malware payload", "value": "7d0a74e561b2d05f0798e032677b415b4b760b30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626962230, "uuid": "051cab59-14c8-491a-a4f1-c1508847993b", "comment": "Malware payload", "value": "322d4b1de1ed805662f8c2be85a6777057f5e2472dd22446c1d2b7b30aee68622e87f5695aefeb078837d60698a659fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626962230, "uuid": "69c437ec-3ac0-46a0-87bb-b7c533f04920", "value": "T1B1C4F080B349C8D6F52A59F15C2A97701442FEBCA469844D64DBB61E4EF234220AFFDF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626962230, "uuid": "44ad323f-2558-4a1f-9026-3389c9bbf476", "value": "c9fb262a54dc5bf64023fafdbba32455", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626962230, "uuid": "6473fa75-9f13-4756-8486-acc6846a1dff", "value": "3072:Zkp9Js5aBFWosyzhIXj4Ix0RBZbAi4BGijv4xiQgFUm0ZJgRlLPwKIhyWc/yHSZU:Wp9JoKzhIXj4Ix0rZbZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626962230, "uuid": "790b7128-2302-4cfc-8d1e-a56304ae68aa", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626962230, "uuid": "965540ae-9816-414f-a114-18cdcf49686f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626962230, "uuid": "331f636d-b547-4418-b9b0-17aa96b02113", "value": "295d0aa4bf13befebafd7f5717e7e4b3b41a2de5ef5123ee699d38745f39ca4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b52071d1-eb0f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626973826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973826, "uuid": "7d1f9f9c-ff65-4b01-ae13-e93939b16bcd", "comment": "Malware payload (AgentTesla)", "value": "eaf39a263bece3cbd0d6b70e22c12d8f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973826, "uuid": "d647ce40-88af-40b8-85e8-b31d52d5c4db", "comment": "Malware payload (AgentTesla)", "value": "2bd20bf1f968993cf9f212761a86b1745abf4990ddcd5d5c553f456dcff3535f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973826, "uuid": "deaff18b-356a-450b-9ca3-5b44618ab7ec", "comment": "Malware payload (AgentTesla)", "value": "6ca9713419a03c0d1ab3e7a17dc3256bae2acb59", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973826, "uuid": "48b0c75e-074b-4b60-8150-9ae983d2e999", "comment": "Malware payload (AgentTesla)", "value": "90c812f775467497dc6d189943836dd42abcff8d7a85894fe35f698f5d8a003ed9d75b1025b023a73c5f635543b25b20", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973826, "uuid": "c2c74f70-7371-4174-b2f5-9d0c691dea8a", "value": "T154F4F1153B80AB8EC57F4F3A80419D10DBF1E6666707E7876CD223EC195E7D94A233A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973826, "uuid": "690c6b0d-338f-4fe7-810a-becc79243994", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973826, "uuid": "fffaef1e-7edf-4e2a-8c05-a8b0ac2f17cd", "value": "12288:CYtMBhsEtFHuGMaaEowPYqafsjTa2lQQqgum9HRPNk36p8MJTcdB2QnUfxEVO7/W:HMBztMa1ow8fsjTVxjP/EnMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626973826, "uuid": "0b118a4b-11c0-469f-90b2-5e6865064143", "value": 784896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626973826, "uuid": "235e0993-6660-429a-9c03-b88ba3a7071a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973826, "uuid": "c6aadc6c-a8f8-446a-a9ec-6d672ef4409b", "value": "Payment $67,765.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "476086ee-eabb-11eb-875b-42010a9c0053", "comment": "Malware payload (BlackNET)", "timestamp": 1626937564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626937564, "uuid": "054085a5-2c2d-4be9-bc4b-1a974928c04f", "comment": "Malware payload (BlackNET)", "value": "a18b7cb1fe97912ffc3e38d76ccc0462", "object_relation": "md5", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626937564, "uuid": "e1b476dc-63c5-4873-ac62-7cb24ba02b48", "comment": "Malware payload (BlackNET)", "value": "2d5e2831e24496bd74a7a2317f824657905cdadaeb00f5c6e33e9b75c5231a2f", "object_relation": "sha256", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626937564, "uuid": "d5a98e86-373a-4b27-9ce1-72cb98d33d09", "comment": "Malware payload (BlackNET)", "value": "c5908c111223d69f532973643381983ba385c1c1", "object_relation": "sha1", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626937564, "uuid": "c777ced6-df5b-4fb3-9f52-275e0ed922e1", "comment": "Malware payload (BlackNET)", "value": "31df5c87e79c90a48c3b2e6dcc82e9b4827e59f3e1a1ba6c3166d7b66bded0e5ebcda0262c09be2116534c3596a1496d", "object_relation": "sha3-384", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626937564, "uuid": "bc822af2-18a7-458f-9094-7e7507eefbae", "value": "T11C93F94237E84919D2BEDFF8E8F1610846B4FE2B5D22D75D4DCD109E16B2B818D90BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626937564, "uuid": "e07e2fd0-0a01-4791-a18d-928fa86c75b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626937564, "uuid": "9c6983da-06b4-4a16-90b1-e3148ca255bd", "value": "1536:io3Sey87DXUa7/732cIP9IohFnsuPI50ZoyeELE0/rmf8okfRwhpE0beVCEq/LrD:PzT+P1Tnsug5IoyeMrm8Rwhq0beoEqjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626937564, "uuid": "13d543f9-e057-4e43-8cae-f8a9cbb84f77", "value": 90112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626937564, "uuid": "a50ae09a-1b4a-4425-92a1-902d15e741a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626937564, "uuid": "73df3a80-3811-4dc1-9625-06e177d089a6", "value": "a18b7cb1fe97912ffc3e38d76ccc0462.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc68ba0d-eaad-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626931774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931774, "uuid": "de5ce48a-86b7-4aec-beaf-30a5194137c7", "comment": "Malware payload (AgentTesla)", "value": "2567be7ed91809c33f43f1a37a3eb1ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931774, "uuid": "1720d19c-58dd-4218-8b35-1633d9a1268c", "comment": "Malware payload (AgentTesla)", "value": "2d7312010d890025b8e61e9ed20a7e0fa79d5c97a19ddee26d7be69abaa97ca2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931774, "uuid": "431b9a6d-6fae-4852-8bb3-bbe1e4a66289", "comment": "Malware payload (AgentTesla)", "value": "0f8900de0a25353089e96e2c0c10d7f6742abd77", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931774, "uuid": "8bcf7fb2-f869-425b-bf80-95ec2df98015", "comment": "Malware payload (AgentTesla)", "value": "4ce3b2e02f530fc15617904f4ced645d96a7d8fb9a177d775bd711212c9dad177b00a790a125049b731396fb675d1a4e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931774, "uuid": "fd452a1e-17c5-49e8-935c-d2fe724a7c2b", "value": "T1FBF4F1385317AB2ADD3482FA1C15D28297FA8056215ED7752E84C0BCF8E27FC67E029D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931774, "uuid": "b53c3b5a-dc58-4149-af01-4127bb1edb9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931774, "uuid": "09b744e0-b06f-406c-988c-f408f790203a", "value": "12288:6ybArMZ8CvNWzNs8CL7MfzN8AhuUitj+O6IyOoN1QwKqxgdiG9HP4SHx08syaUVO:OCvH887WpeUiIO5w/adi6lRTzahp1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626931774, "uuid": "fa771fcb-7973-428a-aeb7-00e51bc2c8d4", "value": 754688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626931774, "uuid": "9bf04619-da5d-438b-876c-d83f83091581", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931774, "uuid": "cb6f299e-aa1a-48bd-9342-17d786b03b01", "value": "ORDER_SA.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a36fea7-eaad-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626931502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931502, "uuid": "85a8eb38-77e6-4be8-b5f3-3a40d5ced823", "comment": "Malware payload (AgentTesla)", "value": "a72443c2ed0344ee479b1ab6f5ad151b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931502, "uuid": "dfc4805d-fca3-4deb-a5e5-52fd523ec3dc", "comment": "Malware payload (AgentTesla)", "value": "2d858522bfce2071f029aa5afea4dbaea3dafbfc4ae140671ffdba3bfa5cf82e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931502, "uuid": "45073a96-0b52-4e81-9fcb-9ee350a6f71c", "comment": "Malware payload (AgentTesla)", "value": "a9801f7b05736f67d75f1e78bc0957fd32c439ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931502, "uuid": "948e729f-81a8-4f9a-b05e-92eacc54c65b", "comment": "Malware payload (AgentTesla)", "value": "7f36a563d6e753412463148d881cdf75eaca3a1cea11c798d0b20227924943c66ef3175800ad9baa72b6430b9f0ce190", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931502, "uuid": "1ec9c19b-2613-4b07-8dce-ce94a1d390b7", "value": "T16705CF35F2179B04DDB8C3FB085881506BBABCE9B21AC7396E44B1FC68736786AD1711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931502, "uuid": "32ecc7c4-169d-42e7-8afd-5d57d040622a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931502, "uuid": "9fe9d6d6-d7a6-4f95-bae4-934a99708d2b", "value": "12288:CXE3X/F5GeLHduxUyFVsAnA131+dT+0IuQsS6jbZodUpiV1eQ58JDyaUVKnp:jX/F5HLdWHn1A9Q+0I1uKUpiZo2ahp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626931502, "uuid": "87c27ed8-7735-4917-a382-216ca32e5436", "value": 853504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626931502, "uuid": "711b435f-ca40-49ae-8113-8d7afadbc99b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931502, "uuid": "cdc8a569-25c7-4766-8441-8a16eaf31044", "value": "PURCHASE ORDER-890003.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13fc688b-ea8b-11eb-875b-42010a9c0053", "comment": "Malware payload (NetSupport)", "timestamp": 1626916862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626916862, "uuid": "25d9a74d-3c9e-4854-a8bf-fae73bcc7b6a", "comment": "Malware payload (NetSupport)", "value": "0a3a5738d94c64e3ce080f672bf577cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626916862, "uuid": "977b1d0d-75ee-425c-b10b-0aab00191913", "comment": "Malware payload (NetSupport)", "value": "2daad8278e0ddd4d247303aced4b1d41c75ce94be3a9e0bf9b655c1746ac22d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626916862, "uuid": "aac18515-2ed8-4fe9-a448-e65eb7660bfe", "comment": "Malware payload (NetSupport)", "value": "5ce6fc7a48e795b84bf628c54b9f1d2aad0a6c23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626916862, "uuid": "acb799eb-7de8-4892-bc25-6ea9bdc99bb8", "comment": "Malware payload (NetSupport)", "value": "b9c8c47ed1ac5fbcc7b46774ddd7b57900dba99946df40e45ce2ebcb8683881f28acdfe6755d287ab4815eb696519fb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626916862, "uuid": "cc15b683-3311-4304-b0b5-67610eea75a7", "value": "T16B54131773D4C85BDB6117308A7A6877D771EBEF01CA474BB38406B47AD23CAA91A2C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626916862, "uuid": "369a3c7f-d099-4e63-8523-5eb2cb2c9a31", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626916862, "uuid": "802e8a6d-0cd2-4dd5-8e82-9541dea18d24", "value": "6144:CPXykV7wei+w1R7OdSTBsjoLLdnzfweTKibj31grJnlPla:9kqei9Ru0k8LdnRTKibjlgrJXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626916862, "uuid": "231d9000-e8cb-46ca-8355-938991875fc8", "value": 292217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626916862, "uuid": "d9253723-6c98-459b-89d4-1621d492356b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626916862, "uuid": "18210a53-6202-4917-9983-a2d367b4c94f", "value": "2DAAD8278E0DDD4D247303ACED4B1D41C75CE94BE3A9E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3bf3a1e-eadd-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626952348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626952348, "uuid": "d12ce677-010d-4a8d-af09-2b606ea12547", "comment": "Malware payload (Formbook)", "value": "f03bf8d3ecc2ae4b40f836c59ac09bdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626952348, "uuid": "4bb29ae3-53ae-47c7-a192-42ecf78898b7", "comment": "Malware payload (Formbook)", "value": "2e4cf88a434d484057fcc090cb7de5deb6d30c8e00da339c886f2482f6a7ebe1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626952348, "uuid": "33a51ca7-d387-49b9-95e6-8e1a9f50fdad", "comment": "Malware payload (Formbook)", "value": "58f48a5a960eac4ee1f33ea16075cfd44f37b3a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626952348, "uuid": "9285af33-617b-45b2-8978-acf4b46cf627", "comment": "Malware payload (Formbook)", "value": "c9d0caae1cd529ae7535fbc936bd3bdbd3949dfdc881e66201729df16675dc242f6afb3087b8e927c74828a153a01f6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626952348, "uuid": "90836c9b-18c7-40bd-a0d9-2ecdf48e37a6", "value": "T1BEE4E078671FA700DD3887FC2C59D1512BFAA01EA25EDB683F9880BC7C72AB856F0551", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626952348, "uuid": "ec7997f2-0a81-4f36-8a71-e25db968f3de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626952348, "uuid": "fe644ef4-a30f-4563-8e9c-cf1671be2e0a", "value": "12288:4G0UB38XcvIFwXbrQtx0ChxIWzZc8o5UJAfEsyaUVKnp:4G0E8XcQWbVuSt5TfEzahp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626952348, "uuid": "6b609b96-2c09-4ee5-b89f-212dd5afee24", "value": 714240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626952348, "uuid": "75f23c87-a7df-4adc-8493-b2b5707c0bf5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626952348, "uuid": "591e4f8f-8f38-4e76-b8c5-f5415eb7f0b7", "value": "NQBNpLezqZKv1P4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bf26aff-eac2-11eb-875b-42010a9c0053", "comment": "Malware payload (njrat)", "timestamp": 1626940712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940712, "uuid": "aa016068-e9b3-43f3-b5e6-d62d9225e7e9", "comment": "Malware payload (njrat)", "value": "6c6a951636ae4dee7a842c6af1d43236", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940712, "uuid": "1f4c879d-eb8b-4c60-ac1a-394f24dfd797", "comment": "Malware payload (njrat)", "value": "2ebc7cf945c4eba60eb0f25f6b58eb8d7d0558f6b5622530b2b3808987173952", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940712, "uuid": "3cf5bdfb-e7e5-4b14-a647-9943ed3a711d", "comment": "Malware payload (njrat)", "value": "387e2f026ca3ec2a291b09fa76f88fe40ae7007c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940712, "uuid": "8295c889-c741-4893-b596-2d2af4c204ea", "comment": "Malware payload (njrat)", "value": "3fc01ad59d1c9147d156cc3d8af0866ab8995def379dd94e0f9afea4e0edf1546313a5fa32905036200bfbb2df21fa6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940712, "uuid": "690f7f18-b6f3-4975-9ae6-45c542a43d04", "value": "T1244523568F2C17A4F0A7F2F458E8A67CF3A8FE1096C15C530B763588D8B5335B0AE526", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940712, "uuid": "0bfb116a-870e-4eef-92e3-759b3febaf93", "value": "d5d9d937853db8b666bd4b525813d7bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940712, "uuid": "42997847-e610-4359-96d8-937653f22bbf", "value": "24576:Xa34mgPdQJZbdZCOhDff3rNQE9lpylqdEoM3/kWfTDBnq7ZU+9A9D+HgNkVvC:XaT0W7CO1ffb3ryl13MWPsqk9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626940712, "uuid": "3c570017-804d-4393-bad8-6ba5f7d3ea01", "value": 1261568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626940712, "uuid": "357d7cf7-f918-4831-b6f4-85ec263ca125", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940712, "uuid": "40e4e82c-5c7c-42d5-9429-a89743117c4f", "value": "6c6a951636ae4dee7a842c6af1d43236.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5cf0d7d-eaad-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626931843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931843, "uuid": "b1349e15-dd64-4d3c-b42d-ced982923c2f", "comment": "Malware payload (AgentTesla)", "value": "fb06ed245f080393bbfe1ae577053085", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931843, "uuid": "2d275ebf-013a-416c-9047-3e150120bd72", "comment": "Malware payload (AgentTesla)", "value": "2f639103b3a2a16f0eacad22c7df0a037c3a45d74cfe09ce96f86e13fe74a1b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931843, "uuid": "1194628d-a46c-4068-991b-c9e388819aeb", "comment": "Malware payload (AgentTesla)", "value": "a003c960669f5a64ae182dcfc9d7185750a84f0d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931843, "uuid": "3b49eb54-dfd4-4167-8ea5-42dd3a0ceb18", "comment": "Malware payload (AgentTesla)", "value": "022202b7beade903bfe80c6132d9fd26749274421e72714d7b36b6148b73ba23f68e5e64ce3533cad72bef961bba55ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931843, "uuid": "7370e9c8-86a7-4fec-8702-c14732f2ec19", "value": "T114159E524DCF866FC2690DB69731AC5682314DAA2949F3132EC134EDD93F3ED899F602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931843, "uuid": "b7179f13-4555-4367-94e0-b225e7dfa4a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931843, "uuid": "2826998a-3b79-4a75-8993-797a1b5a17fc", "value": "12288:YCiAT/vfFJSOdJpyog7hJLobe+2F2uUd9iCm34olKf2CSMPQipP5q:TiA7rSMJpgz9+2iPCipQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626931843, "uuid": "50378836-5629-419a-b680-fbc2962fd46c", "value": 915968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626931843, "uuid": "6eba34aa-cf8f-4187-8188-556d07fc90c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931843, "uuid": "e7faa8ab-17b8-40a0-ba9a-c061552e526c", "value": "P44898408970-1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "443e2478-eb03-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1626968482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968482, "uuid": "ea4a25ad-3921-4f49-8395-29171e158991", "comment": "Malware payload (CryptBot)", "value": "23d06cb01b6fafde451493778bd4f0b0", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968482, "uuid": "ba3591c4-be54-4448-894c-9e23c5e264f9", "comment": "Malware payload (CryptBot)", "value": "3140427b921ff6b832fa2c68ddc8ba328d57fa9c20ca6b917abf920c0dabf416", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968482, "uuid": "0531db81-c792-48e1-8482-499e113896f2", "comment": "Malware payload (CryptBot)", "value": "197bb65aaf4efee73b2199345e4f1b835053d3e7", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968482, "uuid": "e82d2ba4-3e17-45f9-adbb-d005190cbc90", "comment": "Malware payload (CryptBot)", "value": "48d2bccb236a22dd8aa5c814781fba239a73cc07ac9e4cc5cf2021fdc090e6f1402698dd06521f83a3fcfaa5111ea82f", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968482, "uuid": "224389e6-542e-453a-93c0-62749a8cc8f7", "value": "T1A2D4222478A1C537D923487048E2D624967FAC315E7885833B9A27FFEE323E1A77D251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968482, "uuid": "73de8c12-ca64-43bc-8788-eca82f3140e8", "value": "f8220ac65423f0267d42ab4cbda2e1d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968482, "uuid": "bdd33776-789b-41b7-b05d-1cdfe130f4af", "value": "12288:YzpKCfl+0UU4QxAPB996Zf4tppXrp30O07nXXzhoI3e/xcZUCO7lyL+D:6folQxAPB36pK/XNEO07nXX12/Jy6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626968482, "uuid": "07f56c26-430b-45f3-9fd7-1dbc15ec98e7", "value": 656384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626968482, "uuid": "e2f419c0-fab9-4d5d-bc9c-5cf0a64dd53e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968482, "uuid": "4ee2a61e-8922-4a61-ab7f-f738b1245538", "value": "23d06cb01b6fafde451493778bd4f0b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eca2b69-eb03-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626968446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968446, "uuid": "3861926b-3b29-4957-8661-45522600a825", "comment": "Malware payload (AgentTesla)", "value": "6733d5e8934eaff7c0087e7de2c8e62a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968446, "uuid": "3f4afc0e-b9d1-4ec1-ab24-5ce06b70a667", "comment": "Malware payload (AgentTesla)", "value": "3441d4122b712a32e1c0518f02903a632ecbf557fbab71c510c732474d326cd1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968446, "uuid": "99ce40d6-246f-4c2f-b930-ac8c5a318f43", "comment": "Malware payload (AgentTesla)", "value": "6c0b89dc4c773e51d660780450cbd148f2ff3211", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968446, "uuid": "5e2d37eb-e7d3-43a2-85d7-259110a8d36d", "comment": "Malware payload (AgentTesla)", "value": "b4482e05c3d5b7e342c15df2179b1f6ab39c3bf74eebdc1ed5a47f11ade3465cf25b4084b1a887a7a25fa11699d8096e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968446, "uuid": "1ff57a84-4274-482a-9b61-5eb3c90b979c", "value": "T1E6A49C3805A54A63C27AA2B3C264E700FFF05AA37250DE2957C7D5C71E1360369DEE6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968446, "uuid": "05688bdb-4061-4a9f-9bc3-f88d83ace5c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968446, "uuid": "3066046e-d8c8-40b9-ae7c-ea3eb9f0ec16", "value": "12288:NUdeni+TLedHTiw3CzfM5B2OR0GU4V24TfWOQCs/I:KciCqdziw3KeRHtJHs/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626968446, "uuid": "a596b020-93f0-4fe7-aa92-325eed853ddc", "value": 479232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626968446, "uuid": "7a6b2c82-30ce-49dc-a2f8-8ad4c70eb64e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968446, "uuid": "421c142d-4123-435d-a820-be777fcb52eb", "value": "6733d5e8934eaff7c0087e7de2c8e62a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad6f74bd-eb03-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626968659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968659, "uuid": "122f3f11-c5df-4aef-9116-e94d64a3e51f", "comment": "Malware payload (Formbook)", "value": "2e056a357f0332e78b9cd127df8458ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968659, "uuid": "468539d9-eb6d-4c45-a0e9-1b5a026bb477", "comment": "Malware payload (Formbook)", "value": "35cace59334f4d4cd0714de7c3ffbe2d6817bcb19f1bfc642c5d4d47d5bd309d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968659, "uuid": "73967c80-b819-4061-8b62-1f8adb5306ac", "comment": "Malware payload (Formbook)", "value": "864caefe2f4fd07dd6cf7af2e03d2a0710deba44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968659, "uuid": "ffd90324-68a4-447e-81e7-cb7b05a4e126", "comment": "Malware payload (Formbook)", "value": "ab9fd5aafa7b176c21bb20942a7f33cd425a5c72205b1eb062cc99de10f14b94e52b7475cfb80ddceb5cee01adbd8732", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968659, "uuid": "77567db6-19d1-49d1-8c3a-ff7c4248608d", "value": "T146358C61F307EA98EC2613F8DC7AD8F02263BD59D525892B358E7E1DB9B334150E2907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968659, "uuid": "3db0ef79-88f7-45e1-abe4-2e5cf2b6fa3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968659, "uuid": "caa39862-8eb7-42a2-94c7-165ef6851f39", "value": "24576:Vl2SdkepTc1uj/Hcnua9N0IvnEwfp6ahp:VZdO1uDN5a1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626968659, "uuid": "bcf3d67d-2073-4ca9-81ce-5716c1696b33", "value": 1155072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626968659, "uuid": "ad940fb4-d62b-4a16-a0ad-6359dfc49081", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968659, "uuid": "29826bf5-60b6-4dd6-9f4f-2afea555069b", "value": "2e056a357f0332e78b9cd127df8458ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e42e5cda-eadc-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626952000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626952000, "uuid": "a9b0d2e6-0f16-4b01-b757-035dea5b2441", "comment": "Malware payload (RedLineStealer)", "value": "a61f6f94009c04607f1ba923adcaba0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626952000, "uuid": "1aa4ede6-7503-437e-80d1-51ee6a77c2e8", "comment": "Malware payload (RedLineStealer)", "value": "36022c868a49fc44968f6647239106f536b2cae40340ad69e3772f7be482daf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626952000, "uuid": "cdd26f58-4868-44e2-9956-07222f42f284", "comment": "Malware payload (RedLineStealer)", "value": "71b964ba1d7a6ddcebb9fadf29efba3f440c00af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626952000, "uuid": "3833cdf0-eed1-47f8-b798-160ced6c7105", "comment": "Malware payload (RedLineStealer)", "value": "97bbc27d10d507a99ede603be5330f93fc924a15bc0a3190fa39855a05f84c3e82ee74fa910c35de4863e97661982d20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626952000, "uuid": "f629e15c-04b7-4089-a0fa-c0855a46c038", "value": "T1C80523428F7C1633CD9AFE7D8BC12EC21ED60D0B1903E63E4D8A6169760BB596F53162", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626952000, "uuid": "0f2bf04a-7bc8-40b8-993c-3e3129696fb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626952000, "uuid": "4e18d4a1-2995-4328-9d8c-533468c14926", "value": "24576:MsPAnkJ5S+3GQGf+7n1dBJaP9xG9L0S16:MNnUE+3RpD8FxG9L1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626952000, "uuid": "2818fb58-932d-4277-8925-04627ea73d72", "value": 815616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626952000, "uuid": "5aa6ec62-ca2f-4cd9-9dea-97e5a8432aa6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626952000, "uuid": "a50937f0-9a65-4868-9492-4bc190eb4d3d", "value": "a61f6f94009c04607f1ba923adcaba0d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18530530-eae1-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626953806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626953806, "uuid": "7802c10b-69f1-42cc-83c6-2d930ba1ef54", "comment": "Malware payload (RaccoonStealer)", "value": "c2d56bd6bc9bda917c75d0c8b9ab6b42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626953806, "uuid": "34f3c67c-0084-4295-b093-44b792fc418f", "comment": "Malware payload (RaccoonStealer)", "value": "3653829521ce458cc3baabda0089a847e29e2df5aa900b08258244b5d66f4bc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626953806, "uuid": "dc6b2fd0-18d0-43e8-b165-58ee9bc42708", "comment": "Malware payload (RaccoonStealer)", "value": "96893450f3086c6adb6840335452e57418dba598", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626953806, "uuid": "bfe21817-1893-47bb-b084-52d249abedff", "comment": "Malware payload (RaccoonStealer)", "value": "2886078c7b66597ef4e40b6eccd973f424d228a686448ed13feca05bbbd87189cd286af6eaf051e6a0b27889dd1b93d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626953806, "uuid": "393e8d73-b750-429c-9508-c98832454fde", "value": "T1FCB4F1217BB1C737D5A74A705874C6A1263BBC632A30708F235B7A1E6E312D1BA79353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626953806, "uuid": "f8858cd1-05ca-4e52-b6d1-f5d9c5ea7eb5", "value": "6c734257ddf94eda6ae0d5d1c88d7157", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626953806, "uuid": "8b0fe0f1-e231-44ee-a422-49064cde1e32", "value": "12288:NjIY59D85YlQcYdGurk6GF6zWGYJhU/9:VI69AWrEGPF6zcJG9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626953806, "uuid": "d50443b5-3cc3-4670-a35a-835d3af139c3", "value": 498176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626953806, "uuid": "12a60abe-463a-4124-a6a6-0a118ab03405", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626953806, "uuid": "bea8fadd-91e6-4751-8923-94c6f0ce8a1b", "value": "C2D56BD6BC9BDA917C75D0C8B9AB6B42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb34ea01-eb46-11eb-875b-42010a9c0053", "comment": "Malware payload (DiamondFox)", "timestamp": 1626997539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626997539, "uuid": "66eaa59f-6e60-432b-b57a-b9ed7b731b65", "comment": "Malware payload (DiamondFox)", "value": "ca192feaaf9b7136cda5339f42501198", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626997539, "uuid": "622c4974-bf49-47b1-8381-09f9b2a202c6", "comment": "Malware payload (DiamondFox)", "value": "36ae4637dfb47d17615a49a16a8eadeb29eb5ad5357ae86bad683402a4b0993d", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626997539, "uuid": "ea82ca57-cedf-4337-be78-e743bbede9b8", "comment": "Malware payload (DiamondFox)", "value": "4cc846f1dd2ea89c15d5ecccf2db3b394268d9f4", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626997539, "uuid": "dba80c1d-0e0a-467c-8e7a-b65d2b37bbd6", "comment": "Malware payload (DiamondFox)", "value": "7061bbb9101210b7fc9d40c144dac0783ba4ea48b90ca32248567a6c3b32b556467b378aa2913c166b1345314ca32489", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626997539, "uuid": "e686ceed-176f-43f0-8e09-be1960b03142", "value": "T155E5330D9570FEE9CCE387355097BB085CDFE65AA42C7A8C5324210DFE5AAA0BE4F560", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626997539, "uuid": "6e1d8a6e-c94e-44d2-bc18-3f65601d3bfd", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626997539, "uuid": "d17f9093-b271-47eb-bb23-d712e34b19b6", "value": "49152:EgzMlPaaPY8XQLMI8xWqnsuACNBIWan/INyZCUB40emAObjvktnCip88mlOBWu+G:JOQ8XQizCQFa/0ykUb97zlOBWXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626997539, "uuid": "a6b64534-48cd-48c2-8cd1-b6a634fcb488", "value": 3123918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626997539, "uuid": "cb0c58e8-c36e-479f-aa74-57771729fbe4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626997539, "uuid": "43209d9c-ec72-4156-b6f7-b38df2fe753d", "value": "CA192FEAAF9B7136CDA5339F42501198.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41031ff2-eaf7-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626963323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626963323, "uuid": "35df5ced-704d-4637-8580-a6482f141096", "comment": "Malware payload (Loki)", "value": "f3d18776fefa9b0cffa6914cdf306cc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626963323, "uuid": "b50fa99c-a4e5-4a19-b5e3-068d0f49ce2b", "comment": "Malware payload (Loki)", "value": "37b0d05530bb2018cf665aa2305e0700b7342ea5e5dcf69ccf1dc981ef3fe229", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626963323, "uuid": "7d279d25-e9fc-4f99-9cbb-2d60d48abab5", "comment": "Malware payload (Loki)", "value": "2539dc80ac3e61bcb125f56ed43a0cac0d16f0d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626963323, "uuid": "80b94034-aa16-4d71-9369-31662a242f7c", "comment": "Malware payload (Loki)", "value": "aab9b6089549924133b2b27e424c59aaddaf5e81b33134aeff67a0e38aceef010a98a5e159641a04e1b580340dc7c4ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626963323, "uuid": "cfeaf9f0-84c1-41d1-a591-842be5ed1a18", "value": "T10AE46A84F940659DCD1A9F759972CC3056227DBE6939E50E28CE3EEB3BBF7824012253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626963323, "uuid": "3cfad388-16f6-4b71-8fa5-c70ead8bdda6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626963323, "uuid": "0f9c83e8-90d2-45cd-ae24-da0a4261f18f", "value": "12288:wZ4RDzxlQNuN9uBn+Br7oqRj4VAPnD0x7fZEWUtcGCsJP7r9r/+ppppppppppppu:OgDdluuN5rJRIAPnD0hfZEWU11qg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626963323, "uuid": "9583f623-9163-4b12-a8c1-c239b37a7bc8", "value": 674816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626963323, "uuid": "bd285f07-3d02-454b-b528-d553cf40b251", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626963323, "uuid": "073756b1-8103-4905-a505-47544d439760", "value": "DHL INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f86b8f03-eb3f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626994554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994554, "uuid": "6d2cd85f-7fc1-41e9-a061-d03cdadde6ae", "comment": "Malware payload", "value": "0ce6fe55930dbfc59702c9d991540383", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994554, "uuid": "2e1604c8-feed-4429-bd0c-7b5e3319bcf4", "comment": "Malware payload", "value": "38041abde47f862264eade200e3e0b99b7b88a816e011af774132aac5252a58f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994554, "uuid": "de120bb6-915f-4dcc-b206-9199b92ee9e0", "comment": "Malware payload", "value": "6c21622a2a48c1d3773a7977e9b1937ae91b82b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994554, "uuid": "908caacf-71d8-42dd-9554-1ea848658753", "comment": "Malware payload", "value": "09e389806ea6c32fa806265099205a98f1ee9a0f99de664d0d2c6b46cc6c28cb31a536bc9e2ef8679624df8b19cf701e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626994554, "uuid": "e8f4c735-47a5-4e15-950a-cfd29e72658f", "value": "T11BA31A5AFB808F07C0D22775BADF42513323DB55E7DB23065628ABF43F867AA4E22505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626994554, "uuid": "fa094893-4207-463a-b329-eb7887e5dc8d", "value": "1536:jAnA8J5A0E/UdhO0kWs4alfEiVTWfBGeiST3AJCwPwzzw/9bK0vmsifgs:QJ+0E/UdhO0kWkbTUKST3jwoM/9yIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626994554, "uuid": "998d6999-4f33-42ad-899f-49243c18e862", "value": 98353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626994554, "uuid": "4ffb11de-0a5c-41b9-87ef-f7c37e0d28a5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626994554, "uuid": "cf9846f1-59f5-46e4-a895-89d455106ef1", "value": "0ce6fe55930dbfc59702c9d991540383", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6ee9365-eb03-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626968755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968755, "uuid": "b71a0ccb-e476-4d78-903a-4f2db64db820", "comment": "Malware payload (Formbook)", "value": "de630bb125976ff343544b5645ea3ea1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968755, "uuid": "6c04d684-e6b0-443c-9fb2-0b78f916aade", "comment": "Malware payload (Formbook)", "value": "39c27e2a7ec3b5603e184f041bbb07196f6feb885813500fec5ac5fdefca8e1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968755, "uuid": "f37d11eb-e870-4a60-99a3-69167db1aa14", "comment": "Malware payload (Formbook)", "value": "76077f19d2230b7bf89d0bad23eb5e64db307069", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968755, "uuid": "dc82a61c-08f8-446a-941f-55306bee2380", "comment": "Malware payload (Formbook)", "value": "8d101afa7fdd11d835269767429234ae2cee64fa096f9bc385a0ef50c82ae5aaa32981f16b2cf54f351b381e1072f9ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968755, "uuid": "59e8493d-0acf-403f-aab2-7046b4b77757", "value": "T1C4C2E80BB3412BADD505C4F4919D633394F2F4373B5A27AEA7E082633D395E86935670", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968755, "uuid": "c24500bc-b91b-41fd-8069-e1749d0a5dcf", "value": "eb4027891a3c2b24db6240a4f60e56ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968755, "uuid": "ef97a010-3032-45ab-af83-0acb09ae7eed", "value": "768:zo9xN+bR7+twwttnNdymEnWSD+yR7t6lKj:MPwbRMrJEnWzyR7AYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626968755, "uuid": "f6bce4d2-086f-4fcb-835b-aaf0f7a42bec", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626968755, "uuid": "93b31a68-0622-4274-820d-c97da4aa2807", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968755, "uuid": "3fcbe123-5b9d-4691-92ec-a82a0e6b8338", "value": "de630bb125976ff343544b5645ea3ea1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff41664-eab1-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626933552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626933552, "uuid": "5116f70f-a49c-45d4-8ec5-16ca35d42fab", "comment": "Malware payload (AgentTesla)", "value": "481c22b5e46aee29787378d65d00fc92", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626933552, "uuid": "310dd24b-fc16-4383-a4ce-b154ad7d3e92", "comment": "Malware payload (AgentTesla)", "value": "39fcf7c07a057d9770dd0e5315e47fc23767f00ce3d31cb2e6d91d235415d9d2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626933552, "uuid": "58ae2dca-1cb6-4c40-8b2f-66a5c2caf9d3", "comment": "Malware payload (AgentTesla)", "value": "c661b85631510dbb9010d5c6d0e4ad71bf0d2bae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626933552, "uuid": "db6a12dc-290d-4de6-bde8-5f89a8f7297d", "comment": "Malware payload (AgentTesla)", "value": "227ee15cedb677104ca05ba5dfa9c8440463dde2f44a87a2444701beead7f45ec9909a22d2860e01f455ea6487ea981c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626933552, "uuid": "b8a107e3-9279-452a-8e4b-5109d36bf01c", "value": "T125A194222B7C0893DF13E5F2D4B9FF5206D2F26299DB1A40779DF8A00F1A32115A6D52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626933552, "uuid": "0b3c78f3-bb26-40a2-acc3-c2a63a9bb3cd", "value": "96:coAG42oh637T5+MKwx/4A7ByVDLxyknPvro:c52oaNx5wxLwkPvc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626933552, "uuid": "a7310ce6-4683-42fd-83a8-099aa3e0b997", "value": 4691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626933552, "uuid": "f3fd8aae-48d8-4cf6-ada4-7128581f4dd2", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626933552, "uuid": "b112f9de-9434-4a89-80fa-05275b350f2e", "value": "ORDER . 4500028602 .doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "055bd2b6-eaf6-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626962793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626962793, "uuid": "8418f30a-f326-483c-9d1f-83836eb4a5c8", "comment": "Malware payload", "value": "279d8247a06e95a98261369a5033948c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626962793, "uuid": "9d76f6d6-d7a7-4b51-b1f4-21aef3e45051", "comment": "Malware payload", "value": "3a7dc03def2cfd81e66e41990c67dc1fa28c8757bd1f3ffd2b4ec61924c9bdf6", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626962793, "uuid": "ebbccfba-94ff-401a-a472-27ac96d3c008", "comment": "Malware payload", "value": "56701ebec03d63daae8dd492976ff242154dd58b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626962793, "uuid": "1259b356-368f-49a1-b58c-a63097ca04a3", "comment": "Malware payload", "value": "07c00ba72e605039506cd4eeb05f058ee282096506bbe99b70d3430369f2d4af36baaa566cb07a06ff7e245ca1457eae", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626962793, "uuid": "1c040f96-97e4-4846-b5c0-98708357357a", "value": "T159252360EECC0A1BC85AB5F2E1D01C5F6EF4C1E5DC90D4C60A46C55856A6AE83EADCFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626962793, "uuid": "c1c3d26b-afc4-4cc3-b1f2-b238bb57e673", "value": "24576:/tyHPcHjaWoSCdL9lOh36GitMhFuz3ewKY9vZV3:/tqkH+WoPdL9l86Gifz3eCFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626962793, "uuid": "06918c5e-8fac-4156-87c8-fb5b277409f4", "value": 975954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626962793, "uuid": "cd9f74ca-0332-4042-8dca-529da440f13a", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626962793, "uuid": "a4ba169d-1464-4733-aafc-33285bafd57e", "value": "monitor.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f21d814f-eb0d-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626973069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973069, "uuid": "c20db8bf-13b5-40ef-b73f-85d648325916", "comment": "Malware payload (Loki)", "value": "da9cf561507270974903757dbb41c695", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973069, "uuid": "4be1f9d4-1203-40aa-915a-65a46d1f2aed", "comment": "Malware payload (Loki)", "value": "3a8db98f16c628ec26149993484f4863ddff9034ca6ac8984bc0d3cd7740465b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973069, "uuid": "7e835ad7-39a2-4c14-b407-726db62b433f", "comment": "Malware payload (Loki)", "value": "c3bac600fa90634b89ac327ed5d17a6db13ace60", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973069, "uuid": "00358884-4fb4-4cfe-bc49-eacbffc8eb08", "comment": "Malware payload (Loki)", "value": "fdea5dc4d6aee54971becb55297f3c64ac9c2ba46500aca8b14ab8544a6edb6772e3a41fcb11cae4d44acd06935fc0e4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973069, "uuid": "a9d57cb6-fb64-4c02-9afb-f494a816f3d8", "value": "T1DD7350ACD45701988F89ABB85B0B1F41519C7A6EF789583232BCA77827E1C7E901353C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973069, "uuid": "a2638fea-fa11-4801-92f9-b416dd6b3959", "value": "384:f94IWlLzTewVAtNf9/ESU1yN332tSoaKl9ytRgO3tkErxRX:f5WtnezJ9Q103oSNKl9CRX3Xv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626973069, "uuid": "31232281-b1fd-49fb-9758-45e61d491de1", "value": 78608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626973069, "uuid": "a2ae747c-a743-4fac-a842-524559260c92", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973069, "uuid": "8a9e264a-c936-49e6-8b81-347eee3a45c8", "value": "PO AR483-159043 PO AR483-1590436.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cde90d74-eb0d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626973008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973008, "uuid": "f03bcfef-a1d7-44ac-aeaf-4158724d89f6", "comment": "Malware payload (AgentTesla)", "value": "facf53403056e3d7529fc8a5ce8be77f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973008, "uuid": "2a157768-8f14-4dfe-86c2-6ec3a1f4d148", "comment": "Malware payload (AgentTesla)", "value": "3bd0c04ee4c4ba078c54f4e7f5f956894204b2ccfbe84cdf934c40b28e30165e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973008, "uuid": "3317f334-7c9d-4d47-b06b-ce659870cad7", "comment": "Malware payload (AgentTesla)", "value": "384a0565e553ac374dd6d197b51a94bace517f36", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973008, "uuid": "fc53bbc9-479d-40ec-823d-2d22786648d1", "comment": "Malware payload (AgentTesla)", "value": "c7476b77adcb5273e08018a4f2952130b206384150d5dd8ce3a0ca1697d5e72ff895607d58d015924c5d591e4382bc4c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973008, "uuid": "7a10824a-59fa-48b2-9477-4290138b54f3", "value": "T1F4259DE0AE0BBA0DDC3963B5784881FC83A77C1351CDD3E22AD7F9EAA76366414915C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973008, "uuid": "fdb51481-fe0a-4cfd-aabd-c49b0f870b4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973008, "uuid": "994500f5-b0fa-4366-a09e-3c4b666c7175", "value": "24576:m+K48+PqKfwtB3ZklaTV1S3wqNqzahprNeLc:Xq6wvZGaTVWwNOiLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626973008, "uuid": "e42350cf-e506-45a3-a3e4-89904dda8442", "value": 1018368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626973008, "uuid": "c0467930-3d72-4c1c-8077-aa44c15b9e97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973008, "uuid": "63277c1a-c552-48ed-aac7-00b17ebd1fb7", "value": "Pedido_73580523.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a29575f-ea8c-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626917516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626917516, "uuid": "7c75d3b2-2aaf-49c2-8c7f-3a069ffe1af0", "comment": "Malware payload (Mirai)", "value": "c8a5ceb8690704332da9220e0721af47", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626917516, "uuid": "16fb2abd-33c5-49b6-803e-ee9926541de2", "comment": "Malware payload (Mirai)", "value": "40eceb322f1b0a1832fe4bc1426df7de9e753d0903babbb4f8061e29838fd008", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626917516, "uuid": "833e3a81-e54d-45bd-8bc0-0052c9301f5a", "comment": "Malware payload (Mirai)", "value": "8c8f03ea14202db02e36b356a7e6acc7f4086ad7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626917516, "uuid": "f7dad68e-baab-4b27-a07b-9541ba9b6d07", "comment": "Malware payload (Mirai)", "value": "67b1639d3ddb6924f0cf150072c78cfe6dabb255e20dbacb907f514a60067b0f7a09d127eec618a68246557655c1af15", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626917516, "uuid": "fc81a385-f687-4e09-a4d1-3474cad6dff4", "value": "T19EE2C743A581DAB7D4832BF94AEB8A211232FC2E1F125F05E32DBCF85B565C8711B319", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626917516, "uuid": "b609c7ca-701a-4755-a7cb-81a044e978aa", "value": "768:FrcgS9UkSiVL71v2L4WEH4JZOM+S6jsOzgWKepf8u1:FrcV99vVf1v8YZwOz7xpf8u1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626917516, "uuid": "c208ff71-c549-4ad7-be95-946527e7adf9", "value": 31723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626917516, "uuid": "e79805ab-4d1e-4a82-8af3-b701cb397532", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626917516, "uuid": "5d34a6cb-c675-4aa1-b185-79dca2a87959", "value": "c8a5ceb8690704332da9220e0721af47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ccc0fb6-eae4-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626955075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955075, "uuid": "dba42bbc-8d3f-4aea-8392-32abde048eb3", "comment": "Malware payload (Loki)", "value": "9454a3ea2dac9225f4abc69f756846cd", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955075, "uuid": "80c696bc-9886-4f03-906f-76cd080c89b9", "comment": "Malware payload (Loki)", "value": "4113fcec8ddd5fa1e0a65985e3ca3082de37bc602add7ce11dc98ce4daf012b1", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955075, "uuid": "f0a9a91f-a882-4c3e-8355-6a36d51acc87", "comment": "Malware payload (Loki)", "value": "8324929668e11b31004bc4a8202a32c116ab4072", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955075, "uuid": "6f2b6fac-a58d-4d52-a87d-fc81e428a4bd", "comment": "Malware payload (Loki)", "value": "c4df2dd8bb622a5a53d590c629c8344fe324bc09b38884ea9f22e0ba10577bc9fb26e916b120e7ff8f9289e1b75245a1", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955075, "uuid": "2d05efbe-9abe-422a-b0e3-7ef87c45324d", "value": "T15345129A7E754B73D14781B09909DE107F21AF31F31178E6A7C2B66E38B71B33264918", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955075, "uuid": "90a8ead8-08e5-4dd9-bb50-e1365c48ae6c", "value": "24576:xDiU0MDmx6pisgeIC+0+gC/KvEFQq5xTp79mIYaXvIUyXpFDo:Q9x4isgDF0+2siqrlxmIYaX+pFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626955075, "uuid": "8e1df6b5-51b4-42ce-a768-5dd3f4a204c2", "value": 1212928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626955075, "uuid": "6536249a-ec20-45da-b099-0a7e2c22e730", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955075, "uuid": "5172f501-659d-4e5c-a10d-bfd6b7a5e0b8", "value": "SPARE PARTS Provision List.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5bbc703-eb3f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626994550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994550, "uuid": "c440f30f-a618-4f39-b457-6275f3dce60f", "comment": "Malware payload", "value": "97d64653f34b01e25c50a743dc6c3165", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994550, "uuid": "5f920895-959c-4a7e-ac72-8ba377572f45", "comment": "Malware payload", "value": "412568bb0606f08b4c06dad7ea767a6ee414da1bc4d79e5b2b417c1b0c9e97b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994550, "uuid": "7c6d5c6a-6158-42f0-8428-16e41ddef030", "comment": "Malware payload", "value": "2c75185994ff9d514f356fb7d6c1ae336230c95a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994550, "uuid": "3ebd5246-730d-423e-8c3e-68f226a17b7d", "comment": "Malware payload", "value": "81016160cb1de6162d0c17656d3b124fe2aef1e162e5b853b3ca4b27d591908718238f33a259386b90ff88029a187124", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626994550, "uuid": "5083a6f4-2070-4bbf-96ff-c00181b19e3b", "value": "T1BAF2B416EF644FA7DC6FDE7389A80B4630CD954B22A437363670C538F66A14B49D3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626994550, "uuid": "e0a92ef7-e2b1-4e5b-8d91-f46ba1258349", "value": "768:+khD/LGRhleujjQBHfxESeR1drec0e4ejQZTXgoXik+nQOk3LSDiv:TDt5cR1dh0De0ZTQW+QOzDiv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626994550, "uuid": "2576ed6a-0966-4220-ab53-d6bf49492cb9", "value": 34660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626994550, "uuid": "8bc3fba5-693d-49b1-ba3f-bbb5cb8fed97", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626994550, "uuid": "a9a75bf7-8406-4de1-9897-5fefb4b75796", "value": "97d64653f34b01e25c50a743dc6c3165", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "382e2d58-eade-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626952571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626952571, "uuid": "eb36b570-5357-4bc7-b362-364fdf220d86", "comment": "Malware payload (Formbook)", "value": "c13f1850e9d955f826620bd1ae322368", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626952571, "uuid": "ad3fc452-f221-4c29-a8cc-dfb4fb4dda83", "comment": "Malware payload (Formbook)", "value": "419d8b92dc042882bb3261de70dfe4a158bc9ca436c71f9bf330bb8a6917d04c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626952571, "uuid": "fb7e8b0b-78a2-4554-8d05-45366a1913e9", "comment": "Malware payload (Formbook)", "value": "1329de0499fabc6fcffd4fa02864968acaac253e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626952571, "uuid": "708d3b8a-1eb4-447e-b2ba-301aadaaef0e", "comment": "Malware payload (Formbook)", "value": "2de13f94d583a249bbbcbf3eb44d12e703086a83b3e95ceeee10eb9bf3fe74d9a96639e347de202b362e1376d9e7d06e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626952571, "uuid": "06b43db3-eb24-4cea-85c1-df4e0cf084cf", "value": "T181159D125ECF865EC2684DBA9731AC5682314CAA2549F3132EC174FDD93F2EDC99F602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626952571, "uuid": "82e9475b-803d-407d-a261-4055e81049f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626952571, "uuid": "1a088e93-56d7-4b58-a148-89f5e133bb60", "value": "12288:a+pvoEou45e3hi0CnMBUajS9VF/yEWmym5sD+cSMPQipP5q:a+pvZGe3encUNjFaEWmfipQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626952571, "uuid": "90e5e8a3-a9bf-44cc-aa8c-f3b422b90f6b", "value": 938496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626952571, "uuid": "f655706d-76cb-45e4-b422-c94d3f5d5353", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626952571, "uuid": "fe123300-ba55-4d83-b976-6decd766a811", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff857d5-eb3f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626994540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994540, "uuid": "7bcd1082-ffdf-4776-a724-eb5023ec9b47", "comment": "Malware payload", "value": "3f21b73e19107d2e5e101b643e012844", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994540, "uuid": "190a62a3-5487-47e6-846e-8f147f092743", "comment": "Malware payload", "value": "429baf4d5fc55afda1de6e2afcf20fff6c5f4b35f5d3acd4919979ba8a744148", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994540, "uuid": "ed7fb8b5-8cab-4ebb-b068-bd93e2fb73d2", "comment": "Malware payload", "value": "df045fbbe010277eb73152218e2df5f8fdf9b076", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994540, "uuid": "20c3c1fb-7c72-44a5-bfdb-2a19db3d618a", "comment": "Malware payload", "value": "29205ecaf23183eca2fcdc31a402b9df55a6a0f168b9e155efd28bbf25ff32279a7bdc53e1c1eb8809f7499019241781", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626994540, "uuid": "4b42c576-f2aa-41d0-8074-335243a7f048", "value": "T1E9D2F9A2F902FD7DF41DF77FC5060416B0B1B2A642820B3267B3786BDD761A60972E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626994540, "uuid": "71fb0464-b69f-446f-93e3-2dbb4262685e", "value": "768:HZbOaoROIzGJb/JNFhsIV6S5i8bdAzsBT1:HZ6RShOIUS5i82zsBT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626994540, "uuid": "3080a362-34c2-41dc-af1b-c1a5e8d7203c", "value": 30304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626994540, "uuid": "ce0e6b8a-aa7c-44ea-9d70-c8bff8b98403", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626994540, "uuid": "d3e3ca72-cf06-4e78-ac70-4a849ebd152d", "value": "3f21b73e19107d2e5e101b643e012844", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f830e2a-ea8a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626916505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626916505, "uuid": "b90322ed-5ae8-4288-9449-735894eabcdc", "comment": "Malware payload", "value": "751c29dd6236f59e6c5ef5c9e8fcf400", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626916505, "uuid": "87ab85af-e68f-4272-bdd9-52c454bc145d", "comment": "Malware payload", "value": "447efeea50e94d4a553ebde53f55b312cabe43f9a2733a08e61a58cd1d8b5706", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626916505, "uuid": "42311b69-551a-4f06-a61f-e5e8aea58ba8", "comment": "Malware payload", "value": "b47b97aba773d7d386b458e5491054d546a025f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626916505, "uuid": "46e273ec-576b-40a8-af5f-6729f7ddcff9", "comment": "Malware payload", "value": "7290f568970a451485cd1be55d4fcf90e6c2c447a567dd6dcad8069eb1296a469ee22b93bfe826ffc6d6a9d3f7e3770d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626916505, "uuid": "be6444f0-100c-4e9a-8930-97a41ee8c96e", "value": "T1BE667B17F8A614E6C6BEE13086619261BA717C6443313BD31F94B67A2A76FD0BB3D301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626916505, "uuid": "a7d4aae3-aa4e-4b94-a16c-d122baa204fd", "value": "4035d2883e01d64f3e7a9dccb1d63af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626916505, "uuid": "0a52c7d3-3439-407c-ad09-3db68593a4bc", "value": "98304:Eo5qLpyUeobjmE2HChsSBZ1sTrLTHPWpxn5UeO6BGjPznO:EocLpy/objmjiOSBZ1sPXvWNUeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626916505, "uuid": "410785a7-02ab-4186-b083-98c75bc0028c", "value": 7047168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626916505, "uuid": "ad73b567-6568-4f7a-8333-d2fba4a892a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626916505, "uuid": "97802135-d72a-43d5-b01d-18ebb5679704", "value": "WPS Office.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e13da70-eacc-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1626944796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944796, "uuid": "bf8f4424-fd5c-47ab-bce0-20cd23c8ac59", "comment": "Malware payload (NanoCore)", "value": "4d48e3cbfc19b5729b6c7a968a957805", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944796, "uuid": "de607d4d-31c2-4788-b934-1dcee91e5cee", "comment": "Malware payload (NanoCore)", "value": "45cf5d850ca6806fd9b55ef35a2ebe8aa2d9b724b67f96eac270c44d1a85e810", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944796, "uuid": "d648b6e4-be96-47e0-93c7-e4308c21bf61", "comment": "Malware payload (NanoCore)", "value": "4863e913b2e5709d9ed8c5937ae046e2edeee152", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944796, "uuid": "2cf76c5b-4082-4473-9f89-8ef8c08d5124", "comment": "Malware payload (NanoCore)", "value": "3d41ab7018bc8ee8404f187eb2280ce9b8ea3d87d6bd1cdb2a183561e5ac38d690295717e90439ba67e144f7a68585f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626944796, "uuid": "522907ce-f90f-4e72-a1c9-56b79649c868", "value": "T14244028136C3CC63DE5E47F1BDBAD7983239886A1F306787911BA21914F23C49D5D3AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626944796, "uuid": "6ef9c293-96b0-43a7-9092-aacff08f722e", "value": "c867555e9ce64a5295f7912fa630230c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626944796, "uuid": "8378242f-8bd3-49e3-ba84-b202cccb4e23", "value": "6144:ql3N9PSj4kLkfPYD/z+gw/MyxSGsjB3ERuGDKI0nDzvQbBxSxg9eDxjXTWOA/uu:SN9PSjvLEwDLfKR9I3EzeIEqBxSxg9e0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626944796, "uuid": "ec0196a4-0b1d-4bd5-b224-3d2a6dd055f2", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626944796, "uuid": "2af891bf-0477-46c2-ac37-5084f395bb24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626944796, "uuid": "1ac61ed9-5f1a-4b35-91c4-f54691c79e6f", "value": "Document.1-xml.eml.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a90c55-eacb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626944673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944673, "uuid": "6625a802-abb3-46b3-a422-cb48d6ee39a1", "comment": "Malware payload (Mirai)", "value": "7694cfd641f968883d3bf665edb563db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944673, "uuid": "22e0d01e-f988-434f-8095-8586a9cc3976", "comment": "Malware payload (Mirai)", "value": "4609b5c0e2d1442f05c576bb0097e55344de9357643019d74bce4d3d9ed49a4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944673, "uuid": "9483d060-e638-4731-8925-59b74deeb619", "comment": "Malware payload (Mirai)", "value": "799787af8312d8ab137f796ce37f209bdb5797bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944673, "uuid": "7b02e9c1-f895-4a5c-835f-9c7ddb4e326a", "comment": "Malware payload (Mirai)", "value": "9aa2491394c4cebdc472b49a1b4558099938114caeacdafda9ada5d40717d14ad14be0bf2124701d92c1d43965dde00b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626944673, "uuid": "9bf7587f-36c9-4366-9791-ad24ef43b670", "value": "T12D338CB5C579EDE8D1144A78BE248E749723E100C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626944673, "uuid": "0c356e5f-6993-4f5a-90f6-8bf77f80fcc9", "value": "768:jaixFwtLSYAagMo0ebH4/ZvQX3hyWfs3INgCJUU/qMCqKomQRCvs:jaQFwtOGBvQXxfs3kgCJt/qMF/RCvs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626944673, "uuid": "a360d128-3de2-4c49-8aee-73ea5500cb33", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626944673, "uuid": "9a09bca3-964d-4bfc-a943-d4e53cbbe5d5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626944673, "uuid": "79d3050c-f1ff-4c67-99fe-e4eb214be6c5", "value": "7694cfd641f968883d3bf665edb563db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ccd38f-eafb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626965017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965017, "uuid": "4eaf5187-b4c6-408b-bdd0-aeb90fac7b8e", "comment": "Malware payload (Mirai)", "value": "0ce7fca628800bb2ddc01fa0209599a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965017, "uuid": "8b413167-d9a9-4bfb-b828-a412440bdc02", "comment": "Malware payload (Mirai)", "value": "47e1e354ee2fe5ab7dd0e7bca3e4c0853d490cc471f610719dc60e3194ac9e65", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965017, "uuid": "c49ef47e-023c-438a-9b0e-c2d707550c02", "comment": "Malware payload (Mirai)", "value": "fc2f934df8fa5004427cce70543af78ffaddfa20", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965017, "uuid": "7d78a31a-f1d5-4d4d-b3a0-0c83179daa90", "comment": "Malware payload (Mirai)", "value": "8140ea8a6393588cb983d26ff819f8b3271832fdaf45b37790ea42bdeb8cf1a7d40bf3d629c7361e4faa7030c91f2f88", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965017, "uuid": "0ee6722d-9737-4e80-b56f-af7d1690c7c8", "value": "T17D338DA6C5BDEDA8C1544AB87D258F389B73E00086933EFAD644C65A8047EECF1593F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965017, "uuid": "47f187a6-6b74-4728-a736-8e1ec13eaf4f", "value": "1536:5aR5ewtQZut8GdcPs3q/aKlMLEm0DOFCn:5k5eDM2P+qiK60CF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626965017, "uuid": "b8088a95-3a3d-4d3c-8fa9-aaba3e24d2e1", "value": 51336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626965017, "uuid": "a6ca9448-0bd1-4db7-91da-6510d47a6e8c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965017, "uuid": "d3848895-6d9c-45be-a0d4-15a901eda62c", "value": "0ce7fca628800bb2ddc01fa0209599a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcfe3369-eb0d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626973087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973087, "uuid": "b497bfbe-3149-4ab5-8d0c-7ee299a35b51", "comment": "Malware payload", "value": "1dca3d4c9b3e914e5f58b24b5f46e3ac", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973087, "uuid": "cf5bdef1-4c5e-4ae0-b6de-5b4f8b46e516", "comment": "Malware payload", "value": "48e5c7bdb837211ed2cd2913fa64cc5f821101903c10c28d13c8b83509079e14", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973087, "uuid": "1728a7a2-d73c-43c3-aa63-2570904ac5d8", "comment": "Malware payload", "value": "67f948d700b2c148ff94c262da294f0e86aa472d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973087, "uuid": "6e0788c5-b536-48fb-b3af-4811cf25175f", "comment": "Malware payload", "value": "b9c3556ca6d7820b0cd80e7a940e7d6d8c5d1cf7e9d42d6dec1c74f534eee60a50471817e58edda38f102627bad590fa", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973087, "uuid": "a9ff1120-1abe-4a99-9855-eb8737c39c53", "value": "T13671F9AF1A1848C2EF0649F3D275F9A801B9F19246C742CD329FF9B20B6B1652C26547", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973087, "uuid": "a8a6f37f-0849-4b2a-960a-6ee24dc6e024", "value": "96:6d95vTHn04bnG/SLzXRd6NE/Nv/Sr2iPrSpwaDtapZl:6d957H0f/oXRdPNHU2++ZD8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626973087, "uuid": "86b85a1f-f257-4c9e-b85f-733ef341afc4", "value": 3767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626973087, "uuid": "cbaeb371-7ed3-4ab3-a32f-80af8e9c4168", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973087, "uuid": "c970dc11-0b2b-478b-84fd-d8cfd12d809c", "value": "Data Sheet.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed7398f4-eb0f-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1626973920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973920, "uuid": "9059be57-c042-426a-8ff6-15eac9649386", "comment": "Malware payload (CryptBot)", "value": "dc2faa416f839bf688d9ff10efacbb30", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973920, "uuid": "436c056a-4591-4ef7-b049-1b7e7996d645", "comment": "Malware payload (CryptBot)", "value": "4a7279e1bb036c150488d9c828fc82921e798a2f1516baf7f032b1fb398f062a", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973920, "uuid": "17a0c21c-331d-418b-9bfa-31adeeb2a02a", "comment": "Malware payload (CryptBot)", "value": "bf2fc09c4eb49b83219ca9943541c7f8004c6927", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973920, "uuid": "e2d07ff4-21b2-4d9a-aae3-ece3aa0f9a12", "comment": "Malware payload (CryptBot)", "value": "b528bd798559114f6ccf924b298d0dec63e0e2f6a15e08c194fee3f68a7e25f312683ab1c5b490e144e7042d42fdc8d7", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973920, "uuid": "b19c1f8e-a4f4-47fb-88ec-993c2020e828", "value": "T19EE412057AD18833D2AA41725CE7C7907B2FB8616E38991F3B9837EE4E301D09E2E355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973920, "uuid": "3ea92555-97cb-4484-b514-f4be9bdf74a9", "value": "61ef104eaca526f41b548a0ec177afb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973920, "uuid": "8e8bb9b6-8611-479f-9745-4ad396a414b2", "value": "12288:/Qn9sQlbzlcuT4QZoMEs+/RXo2WshEkIViMC0MRmOXi4IufK+yXO:/Q9sQl9ZT4QZinZYbshxMC0MLHIKyXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626973920, "uuid": "2acc546c-3b65-469f-9916-b6ea629d8e80", "value": 659456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626973920, "uuid": "c48fd488-6f09-4622-8466-028c6394df98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973920, "uuid": "efa6db9f-4ebe-4ff0-9a14-175cb6da0e78", "value": "dc2faa416f839bf688d9ff10efacbb30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ad833d-eaad-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626931835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931835, "uuid": "2f1f9cd3-7b1a-447a-a739-9a179339e88b", "comment": "Malware payload (AgentTesla)", "value": "0aa67c12db0e3ea16a183f2625b0b31d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931835, "uuid": "2cb66b95-0a6e-4629-b0a1-54e09ffb3d1c", "comment": "Malware payload (AgentTesla)", "value": "4a919c78e17213d98f10f49a921bf41164e6206e63bc3cbe487092b078189a0a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931835, "uuid": "63592c50-1334-465e-826d-4b7e2193e0b2", "comment": "Malware payload (AgentTesla)", "value": "622ccf647f0d83a47de603fa584181736797ee54", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931835, "uuid": "a76b1aee-67a4-4d30-b96f-794d3cf4c30f", "comment": "Malware payload (AgentTesla)", "value": "d1c6ab8c0115bf69bb3b55fc674e9ecf9371bd8ac3d840bd0c8c759668dab028a8fb10e558354a0fc4692d3d419e2201", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931835, "uuid": "2aa99f2f-38d4-4927-a3b5-74c46a0ae921", "value": "T1E5B42338C1793969B34123F34C3918D1122CAF49894F6D96D31FC5353AAAA7F04AEDA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931835, "uuid": "8213d5f1-bca3-4b2d-8006-d867a81b3f49", "value": "12288:ePck+A5nFfzJSCdjpm2g7TlLSricCzgrW4NfMlFA+Q67:et+ATtSYjpgJXcCNTTZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626931835, "uuid": "a5a21532-f919-451f-999b-5c71c976e1bc", "value": 518544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626931835, "uuid": "895e684a-3517-4d30-974f-b26e6f3f69d1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931835, "uuid": "8259a0dd-1cbb-49db-a6bb-5099d449349c", "value": "P44898408970-1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f281010-eb1b-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626978916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978916, "uuid": "3d7cedc6-219d-4c1d-a289-a7fa8a78884e", "comment": "Malware payload (RaccoonStealer)", "value": "b7ee751e1006cce4ec7798cf2223b801", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978916, "uuid": "724008f8-c511-4c5e-9cc1-deb1af845487", "comment": "Malware payload (RaccoonStealer)", "value": "4c13f894dc3fedf1f1a0388cbdd003803e6addf8e1a666bea37fbb03aac865f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978916, "uuid": "e5609510-a9d8-44cf-aed9-b532186edd4b", "comment": "Malware payload (RaccoonStealer)", "value": "481dca75beb3bbb5064c0f826ec5a01560e628ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978916, "uuid": "0c8faa3e-22a3-4036-bf97-fb7097d92714", "comment": "Malware payload (RaccoonStealer)", "value": "4612713770490464e4b35353afdef752bc940ef6f43f1e55a3ae0f4f23586fd98a5b114b2062cf98fefc495d8dd1c7c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626978916, "uuid": "53b6bdb6-3122-4524-bf38-38a1e0d526bc", "value": "T178A41221B680C472D1971A301CD7CA666B6DB9366EB8963B73C622DF1F303D15A3E217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626978916, "uuid": "34850fe4-fd72-4f4c-8b09-44db74bc8d09", "value": "1cd2cdaf0d3244745bbba0ea35647dc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626978916, "uuid": "0c9f326b-2c50-41db-8155-2bcc203ad8fa", "value": "12288:w01ANMvkz1cepABj2NGgoF8SH+hjkJt//CRyj:beMv+cepAhdF8S2jkv/yyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626978916, "uuid": "08ada4f8-a24f-45e9-bf1e-89641fd1d423", "value": 477696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626978916, "uuid": "415b00be-7fee-401d-b58b-cdd66ae4dd58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626978916, "uuid": "cb28a8d1-95a0-4656-83dd-861fc2b31c33", "value": "b7ee751e1006cce4ec7798cf2223b801.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "096e55c9-eafe-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626966236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626966236, "uuid": "30ccf667-c05f-40c6-bd44-3bd4a8d39cef", "comment": "Malware payload (Formbook)", "value": "67a1fadce73f871b43fcb1f4f587e800", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626966236, "uuid": "16677bd0-c640-483c-80a2-f7eba73cd7c5", "comment": "Malware payload (Formbook)", "value": "4ce9b6af73b53e943f97c68254a1562e4a944403a353146cc8e99a62a8d74314", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626966236, "uuid": "9af07359-9929-45ac-8892-2a33d43239e9", "comment": "Malware payload (Formbook)", "value": "65ba350a884b5c06c17d232c244de610e2305091", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626966236, "uuid": "f184028c-7c2e-41af-b358-936fd917b9ae", "comment": "Malware payload (Formbook)", "value": "7237764df8f4c8ee72d39939a9a719d54043c45455c0eae11255786d00392eed9665663267cbdb0417b0b3b4277f9a59", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626966236, "uuid": "203fa24b-f9b6-4cdd-8e54-e4838c57b91f", "value": "T1AA5512999B9FE3A3D6C9343D16D7481682136C837F54D9AFAB5A732430B7126038DF28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626966236, "uuid": "aa988b3b-7b6c-45c2-a4a1-e7412197e6f6", "value": "24576:Xg7E7dCIpI9hNIdpXcq621HOBg1KamJrERWkvqU6szeX04Jdy9koY5g:iTmmhEcg179P9cLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626966236, "uuid": "ebd4e2b0-d938-4e2e-bcb8-d51aeda14d93", "value": 1296896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626966236, "uuid": "9bf406dd-8769-4a30-ad92-c6980bc34464", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626966236, "uuid": "9ee198ec-c69a-41df-bbbf-32cd593864a3", "value": "PO20210722.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6beb7fd0-eaa1-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626926458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626926458, "uuid": "f2a3d87f-2d97-4744-bb60-b8a3067c4ee4", "comment": "Malware payload (Mirai)", "value": "d1ec35c020baf968ca3d4131ea2fe119", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626926458, "uuid": "45eaa964-e36b-478b-97ec-27a29e25e275", "comment": "Malware payload (Mirai)", "value": "4d4c66bf5a39ccee4b1727d0a2e0ef5b6107d5c986b32841cdd31a81e3a2a048", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626926458, "uuid": "d3dc0635-d6d1-488b-a7de-9382c728ff49", "comment": "Malware payload (Mirai)", "value": "236bbb79578c78d63e3dcb21ddbc8f7615e117a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626926458, "uuid": "ff3deb89-bc42-4fff-b20c-4c56bf47351c", "comment": "Malware payload (Mirai)", "value": "c88dbc61c16d51543d4883a9da9143e90a2d1ba40ccbff123a577c76331412d4d0caac04ae5dc5631947c9baabe2c85d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626926458, "uuid": "b78d9f4c-000e-4dea-b973-2728c12dae6a", "value": "T16BB23C86A783F9F5F82487B1D43BAB727372E43F2459FD96DB5B1834E802001925369D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626926458, "uuid": "33c6f045-afcd-4009-93c3-5a952036e257", "value": "384:fIDU0VIjNfptLNaKAztUPL9489HdTwLvPV5l01yXA1/J3:wDU0qjftLnq0bdELvNr0EQ1/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626926458, "uuid": "700e3f6c-34ad-480b-80f3-94ac97bd34ba", "value": 23592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626926458, "uuid": "2b424679-35b5-4279-8ae9-d11d06376f0d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626926458, "uuid": "f20de2f1-9ced-4616-acf5-50c5af27c17c", "value": "d1ec35c020baf968ca3d4131ea2fe119", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bbf8521-eae4-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626955234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955234, "uuid": "6a777f1c-ca7b-464d-9c17-45be95029af1", "comment": "Malware payload (Formbook)", "value": "0e715db2198ff670f4bf0e88e0e9b547", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955234, "uuid": "d4562e7e-c297-4fff-b7fc-971fe4cb7ba0", "comment": "Malware payload (Formbook)", "value": "4dc8cb12314311a3bf1b1afa5cc5483284fda573f18c15ab0fef18b7b9ef9f98", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955234, "uuid": "538560ed-1ab0-446d-8ed8-bf2529e79cbf", "comment": "Malware payload (Formbook)", "value": "2de5030a9261655e5879e4faba7b5e79d1dd483e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955234, "uuid": "f87e81ff-a383-4fff-bc7b-2b6f9e70e7d7", "comment": "Malware payload (Formbook)", "value": "54eebb3a04cd333fa318a66fa6adc485827769596ca9f5f8cf19b456d46c81fd5478e7c7bd333b495fc6bdd258411935", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955234, "uuid": "7f0dc43e-6772-44da-9b31-84b2778f6180", "value": "T133D40231792622B6CD2C4C74B0538A411F722D276D2AF3D9129516DF276BA044BAFCFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955234, "uuid": "9507c467-3604-497f-ab25-88a30aab876e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955234, "uuid": "4ebe1216-36cd-429d-a168-193086c67ff3", "value": "12288:6j5EWCz96Q2vEq5GzUf5qvrcL1DCiTal1VPVhIHHZ25x:61EWMkzGUkrcJafVPUHZ2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626955234, "uuid": "4f758829-a294-475a-b16a-776ba5fe9a80", "value": 648912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626955234, "uuid": "86557d41-f99c-4a39-881d-d414bd36f5ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955234, "uuid": "8576a275-8039-45c8-b7db-4b4fb7122f24", "value": "0e715db2198ff670f4bf0e88e0e9b547", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7159587b-eaad-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626931621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931621, "uuid": "ca5ceee2-0ed3-4b19-a9ed-848eafcb2cbd", "comment": "Malware payload (AgentTesla)", "value": "8cc223e6cc55de1d025e392e7010cc67", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931621, "uuid": "4f61da47-fa12-49b5-893f-48a1611e6f41", "comment": "Malware payload (AgentTesla)", "value": "4f35c50ec3a7099c8058d999c4c8756f0230dc9c68760b61156586031fe52db3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931621, "uuid": "b0ac5079-52ae-4afe-8802-744546b351f5", "comment": "Malware payload (AgentTesla)", "value": "4780ecdd57953baf942bd02e074f64afd64cd103", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931621, "uuid": "426a0cd4-ceef-43f9-a8cd-08f19c767c03", "comment": "Malware payload (AgentTesla)", "value": "371f3dcb56818e8956d09cd9082833f860342d7d5f341d74fa611d88aa957b60a2b03267e1a4d0870086628c35fa20a9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931621, "uuid": "7c5c336d-cc2b-4058-88c3-fedbeb3e6693", "value": "T1BE52BFAD7CB958BAD92E0DE2D21671C0434F096D96BBB851A433928C784052F366F74D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931621, "uuid": "74b44c3f-b7f1-4165-b3a7-054aef92673c", "value": "384:Vs7wnzPEpaGU8bdsmGPwVQZ7R7tH0B11Rg2qveU:SA1G13GdoJ6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626931621, "uuid": "fc57a177-2dc6-46e1-9db7-8a2c4c10baf1", "value": 14362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626931621, "uuid": "4e968a81-ad05-4d97-8ac9-ed5909de20b3", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931621, "uuid": "cae50ab2-39b5-4f42-9d59-75c6d457299e", "value": "MPU702734-pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a45e9c8-eb27-11eb-875b-42010a9c0053", "comment": "Malware payload (BlackNET)", "timestamp": 1626984035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626984035, "uuid": "fa06b17b-7e06-4a3d-8539-05db13674549", "comment": "Malware payload (BlackNET)", "value": "af711c6269728cc41a4b6cab99dc00d2", "object_relation": "md5", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626984035, "uuid": "43de767f-3460-4b8a-8fb1-9c75a55ad6b8", "comment": "Malware payload (BlackNET)", "value": "4ff431768417c7103657b6554962998af3b2f90180e6f19e66e671b4f706061c", "object_relation": "sha256", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626984035, "uuid": "3e253c1c-a034-404c-9837-33b626e6f474", "comment": "Malware payload (BlackNET)", "value": "02a1cff69f43552c5aa6fea7547e5f68018dbc84", "object_relation": "sha1", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626984035, "uuid": "e0d24a77-b6bb-4ddb-9804-b27ef1c096c6", "comment": "Malware payload (BlackNET)", "value": "4e5006b6c2efcd933526f7c29c29b42fe6f7865c9862837734a6b938cbf26b5c6853827cf7cfaef9bc772c2ae73a8b32", "object_relation": "sha3-384", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626984035, "uuid": "136de9e9-693e-44b8-b512-753912f302a8", "value": "T170F5126C764079CFC4278E334994ED71F6A06C6A9307EA0358D37DAFB9BC6478E111A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626984035, "uuid": "370677dc-9eef-4737-9b75-823ea8b4271f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626984035, "uuid": "e0fabcf0-d84e-4023-9411-bd9e17ea8dc6", "value": "49152:BNe2ChzmVqX9nVGow7smPofq+4sdvz9rnZ4WqplL+7AF79acVE:BNihoqX9ncoY04CvzBniWq3h7ocV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626984035, "uuid": "0d20749d-330a-451e-a765-ba26a9c77950", "value": 3340800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626984035, "uuid": "3a197009-43d2-46ac-a297-b1d892fc8681", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626984035, "uuid": "c31148a4-d6b5-4731-ad7d-2d34ffd4fb42", "value": "af711c6269728cc41a4b6cab99dc00d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79ed6629-eaed-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626959123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626959123, "uuid": "954713c6-8e5b-43e3-90da-6bc05f6f21a7", "comment": "Malware payload (SnakeKeylogger)", "value": "9b43421aed19f006408299b9b8b64ccc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626959123, "uuid": "4e533ea7-2722-49a9-a390-1206e3628cf6", "comment": "Malware payload (SnakeKeylogger)", "value": "51d5a88a4ba4a668db92c2aabfae2e394bff27bd40f9693615dda48eab999d47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626959123, "uuid": "4f4072f0-0858-4444-99eb-dbb497c2d3a6", "comment": "Malware payload (SnakeKeylogger)", "value": "62947dc2562a14d4d52025ea180c971fc931882b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626959123, "uuid": "12616926-afee-4000-a400-b24a784af319", "comment": "Malware payload (SnakeKeylogger)", "value": "a336d6e2dfbcb6a29d5fb8df407214cef191c20b6a4f613ce9d97ba331cfd6db378e8333ad40f20990a83311b3d2d60d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626959123, "uuid": "cab64dca-1d0d-4eca-80d7-3def21e6694c", "value": "T17EE4C0357217A600ED3583BA8C9ED13067FDAC16A52ECA383DE47DBF78627745AE1084", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626959123, "uuid": "328126e9-7278-4002-80a0-204fd5f47253", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626959123, "uuid": "f16fe529-3fe6-4822-90e9-befe8cf2221a", "value": "12288:Ku0GpiD+6QAMnoJIvxyT6HBsd9PqJjxuZGMHQsyaUVKnp:hzAOyDThdMFZMHQzahp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626959123, "uuid": "b2abc074-d953-4ca1-b2e8-a622052c2170", "value": 701440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626959123, "uuid": "5c917283-b89a-420a-98e2-9bc90acf6222", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626959123, "uuid": "7830495d-119d-40a1-8728-d535e3a82f47", "value": "DHL JULY STATEMENT OF ACCOUNT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a27e4cb-eae4-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626955070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955070, "uuid": "04077b6a-98f7-4ed2-85f0-1cde1c2ee951", "comment": "Malware payload (SnakeKeylogger)", "value": "e79a3eff7afad1baf05d316eabe8bf90", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955070, "uuid": "1af6175e-9bfa-4d05-970e-7809c40e60c3", "comment": "Malware payload (SnakeKeylogger)", "value": "5287078230313c9bc74e5f6230b3c017c085eb389ed674547eabfb32d90ee018", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955070, "uuid": "c1695147-5a89-404d-8326-fc33fc80fdc0", "comment": "Malware payload (SnakeKeylogger)", "value": "420291ec39d86c8442aac0d447a107cdcac9a4ef", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955070, "uuid": "6d448eba-fccd-4ac2-ba4d-79910cf9f985", "comment": "Malware payload (SnakeKeylogger)", "value": "639b25fcfeeb0c3fc97df0c2f283a299a2da814d0b99d8d4f7157c961c25009413ec495d51ef7805befae21a2c48f184", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955070, "uuid": "5b83de59-f66c-4881-9cb8-46c769dd5372", "value": "T1BE3394ACD5A701A88F85ABB85B379F41058C76ADF38894337278977577C2E3A5062C3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955070, "uuid": "6d828fa7-5257-46cb-84f9-37e409a771d1", "value": "384:D3t4uVn1Su+qJ/rbN4Jcqb4USR8C0P04Bcq+RUexp:DiuKXGpONSh0s4B8KE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626955070, "uuid": "58e3d9ba-b5f9-4318-a6ff-a16b68a9a1e4", "value": 51193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626955070, "uuid": "54cd632f-db62-4428-a8a9-bc52fe1ce36c", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955070, "uuid": "b9b585be-054b-4b01-820a-05907b0ff1c8", "value": "Order _ 08201450.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f53c8e0-eae4-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626955240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955240, "uuid": "93beb1d6-ef8f-4b92-8ca8-6c78e8ac2228", "comment": "Malware payload (AgentTesla)", "value": "2a325a8d5588a4a0f59bedc75142082a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955240, "uuid": "1712a44d-5e8a-4424-aaef-7e299f8003b6", "comment": "Malware payload (AgentTesla)", "value": "53189c032edd0ef379751c569b7dcff388fa59a66b4e3094728a431d80ef3b3e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955240, "uuid": "7e4f7b30-2c5b-440b-a98c-0a4c83296b6b", "comment": "Malware payload (AgentTesla)", "value": "d35a452b03cc3ee3a250d1c94638c371b6831af0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955240, "uuid": "258a872f-afd0-475c-8f7d-bd38cd185d93", "comment": "Malware payload (AgentTesla)", "value": "d6e419f774d0930192c5f32982d8667bbe485d921bc094abb06205b6673dc8894eaa481ecc9a8721ec917242f2847c36", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955240, "uuid": "90d40385-5738-43d7-8643-90b35e345254", "value": "T1D3E2E8E8B5C945E3C6BDF632C2A76800A7B261FB2732851F568D73931E177822DC524E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955240, "uuid": "fd0eb776-3a43-43b5-ab0c-79b5ec136025", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955240, "uuid": "e0319ef6-e225-4e75-a50e-43a7372c35e6", "value": "768:/5eNQQCgHWht9Q/wvCc11s93q9yVpOnPoGflKiGoE:/cNOekt9UwlqaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626955240, "uuid": "2f09fa27-9071-4c0d-b6f6-0a2e68764b94", "value": 31232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626955240, "uuid": "67490ddb-bdac-438e-9abe-e2b1af7694ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955240, "uuid": "0f3e0780-8331-4487-8980-c1de98cd3de6", "value": "2a325a8d5588a4a0f59bedc75142082a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c100273-ea8d-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626917761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626917761, "uuid": "d6ee3f90-0d73-4175-aa03-cdba5d38d220", "comment": "Malware payload (Mirai)", "value": "d78d70874a091024d0ce011a265bf326", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626917761, "uuid": "8edf676a-dc35-4494-b52e-c86f1cb56d14", "comment": "Malware payload (Mirai)", "value": "5482291680c2eab5e03bfb4428df37bf3c35dd7f0be4da4c0a6f328bbab2b6af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626917761, "uuid": "0503c11c-1cdf-4265-ab26-af3eb3b64df4", "comment": "Malware payload (Mirai)", "value": "b78d4fdb4cc9fcd203c593566a1ce341318aa6c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626917761, "uuid": "455f49ac-b22e-4f29-9bee-157baded8748", "comment": "Malware payload (Mirai)", "value": "b273f7a4873024522d1a69546999a0de39b7d08ee7f929926ea15de29e468a86f720375f73d5926646f131631a629085", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626917761, "uuid": "c056860b-f5e0-4de1-b64a-6e687ccceb33", "value": "T1ECF2D746A942DEB3C8931BF906F79A245731BC2A4E128F06E36DBCF86B075C87127754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626917761, "uuid": "14c2187a-4a74-448e-9e1f-32503e87216d", "value": "768:RtiJL+7q7sFqJuOecdBajCFI0juehSFjsOzgWKepf8u1:yJLuYsFsuORZThawOz7xpf8u1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626917761, "uuid": "14897c02-0116-45b6-81b5-bec98d479a43", "value": 34283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626917761, "uuid": "2aca48c4-b526-4e88-b1bf-f3cf7390ce68", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626917761, "uuid": "11fdc4a9-f6a7-4001-b456-7c322b4ab4da", "value": "d78d70874a091024d0ce011a265bf326", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a101540b-eac2-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1626940721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940721, "uuid": "14b314ef-265e-4b4e-aa84-ccec7933216b", "comment": "Malware payload (AveMariaRAT)", "value": "f8b12b37061c62984a170f834535842b", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940721, "uuid": "78a7c2d0-6f6f-4712-bc21-d0c9d19de1c5", "comment": "Malware payload (AveMariaRAT)", "value": "548f6a3cc2e79d94f8735680af5a91b4d8dc1a003e578d9027dca782939c9755", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940721, "uuid": "43eb349b-d50e-484b-b349-70ed933a7d7c", "comment": "Malware payload (AveMariaRAT)", "value": "f178dbcaafb30841c1a6a1c78be84ecbaf37b3f7", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940721, "uuid": "3e0073a9-bb5b-4f3c-bb7a-da06bd2bc64a", "comment": "Malware payload (AveMariaRAT)", "value": "46a97671049f4ec90d8fa622e7280dae0df38c2a36d5c99f502fc798c0a98a582be8c2979b2aa95d4276c59d99b5d477", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940721, "uuid": "228112b6-7372-4373-8adb-047ae2f4dbdb", "value": "T10FB422313D27E5E6D7FA4B32D2A61E14AFB17BDB8523E90C94DC225D075B381CB05A28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940721, "uuid": "c7f651e5-41f2-4b98-a8e8-1ea676770a24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940721, "uuid": "8412471f-4dbe-4064-8a7d-1172c77a5091", "value": "12288:PT0I5eEx25ExY97iMflqW4SeLA/mIXK48W:DT294MfUFpA/nK43", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626940721, "uuid": "f0b0b65c-b8e5-480f-8b3a-4b7a31e12084", "value": 528384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626940721, "uuid": "63d00f46-7bbc-4689-bc29-0ac0c89bcce0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940721, "uuid": "d95e3deb-ef84-442a-85c6-e1f17e64000f", "value": "f8b12b37061c62984a170f834535842b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd1ac69b-eb0f-11eb-875b-42010a9c0053", "comment": "Malware payload (Vjw0rm)", "timestamp": 1626973893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973893, "uuid": "3b23b17c-bd91-430f-a5e4-986a7fe8c947", "comment": "Malware payload (Vjw0rm)", "value": "0d75df466a9ab3ec0decd6d186423903", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973893, "uuid": "f44692a5-23a5-47f3-bf38-6fd533d7dba6", "comment": "Malware payload (Vjw0rm)", "value": "555b5c53b23a062843fdcafa1296709d36176b22249aef65f207460d4bdbf490", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973893, "uuid": "9330f954-7495-4b52-84e5-3ed78e14ad9b", "comment": "Malware payload (Vjw0rm)", "value": "af6f88ff79b19b885650160eb11971d94ce81e10", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973893, "uuid": "2120aed0-876f-4ab9-a12d-0081513fe30e", "comment": "Malware payload (Vjw0rm)", "value": "2e09ee72a6f86ef81575796ff816ca7568aeaca814d0e5a132c813fe1ee4677a6198d6e9e1a42762e586de4002924504", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973893, "uuid": "8cf87f30-5c34-4be4-8127-47953bf99892", "value": "T198129F89A590E1B651C6D31C912D0CDB837BAA70959AF31A4AF1FC2064E8B66BE55220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973893, "uuid": "9867866c-3cab-452c-9413-4b13cbbdfcf6", "value": "192:Qo3sQBm08Lc6ABgdx41/oR5I8iAO1E5RTOQ6Ndx6ziuCNVwPVSd6K:QGsQBm0gXKFmR5bsE5RaHMiNqdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626973893, "uuid": "cd59d35d-45f3-427f-b4df-8c776bee1d18", "value": 9078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626973893, "uuid": "08687370-f059-457b-b018-4b46565ab6ac", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973893, "uuid": "536b902f-84fa-44ed-8cdd-f32adb6e80fb", "value": "ER8NSOWUNA.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4e57168-eb20-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626981153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626981153, "uuid": "4ac361d9-75f1-4337-a1d1-349e6a9cf4f4", "comment": "Malware payload", "value": "6d03789dc6e7a80cf274bdcce34faf7d", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626981153, "uuid": "3872d6e6-08d1-4d2c-b6a6-f74a1298c40c", "comment": "Malware payload", "value": "55fd7bf4246338d1c8c8146ab23d51c7ae7025a33c281779baa3e0c6f934139d", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626981153, "uuid": "d2cb15de-8b44-467b-9207-941e4a9f2164", "comment": "Malware payload", "value": "2d310960a80eec96d9131a01703c0b53d7513cb5", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626981153, "uuid": "d68bfc38-076a-4fe7-8639-357e5a5aa87b", "comment": "Malware payload", "value": "98122773e05e8486037aaf1e8a54ab9f91259d4cf7717edde87a6adbe0d4e92be689a5de6434ce59cc389db4c75babbc", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626981153, "uuid": "e403ab02-4130-4a97-8e41-d55b8c257d34", "value": "T10C03AFBAD7476D54DAA1B0BDC0951BD0A66C2C110503F9227DDE937F59E011A03DBECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626981153, "uuid": "1564fc12-80bb-4f01-95d4-4e0846652a64", "value": "384:miEFHjU+UlM9zdUjSpUwU7eIIoNJYTymthKwM3+WP87vOUn7pMLIcGTPlWjXXU8N:mlZJxujSpXWjJYl3KBMOOqIcWSXdhj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626981153, "uuid": "02a7df76-32d2-4f85-b5c5-f0ac07d63ff8", "value": 38295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626981153, "uuid": "93215a37-56e7-4f4f-8c4f-25a3defc0bc1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626981153, "uuid": "e789b75d-4963-4581-b87f-609b83838960", "value": "55fd7bf4246338d1c8c8146ab23d51c7ae7025a33c281779baa3e0c6f934139d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9ae507-eb11-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1626974487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626974487, "uuid": "fc1915f9-9b72-4fba-987f-f4188e84e6e9", "comment": "Malware payload (NanoCore)", "value": "05d30e7a1900f128faea1e511ff2b1ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626974487, "uuid": "320bca06-92c9-4329-b0e4-ffb04a744e29", "comment": "Malware payload (NanoCore)", "value": "589c4364d9ac38d6d0af687ebcc1f98f29a2dc9ae7cdcf4a0c24c7ed73f4e6cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626974487, "uuid": "7e2c9c11-ac7a-4c10-8f85-8b09565b98d0", "comment": "Malware payload (NanoCore)", "value": "c12ed4afbe7e458a37c4d5d9bf1282a8412bbc17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626974487, "uuid": "5fb6d0cb-11ba-415c-b4d2-1091c79e9121", "comment": "Malware payload (NanoCore)", "value": "c20890f89ed208b7525c04230bb1a9f1745ad73b15368df963be1bc0498e9268fb77a5826ad6ef70c32727fd1c440db2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626974487, "uuid": "6f213324-eb41-48d3-9617-e8fa5b4f06b9", "value": "T17C522A13A7D846ACF2FA073B08B399040775F368B902EB4D96C814157D1366CDBE37AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626974487, "uuid": "f9b2ada2-2231-473e-bac6-acf88a341015", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626974487, "uuid": "e790095e-4d91-4566-9cae-c0e71ad2293d", "value": "384:gp7uJ7XpgIzoDad0vj21+uO/EEpppJIgoh9XsG6J:H7Rz5SHpJIgoh98G6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626974487, "uuid": "2f91b4c7-bbe2-43c8-90b7-9982ec22a6c8", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626974487, "uuid": "7d306823-76ff-45a0-896d-69f9e49d6077", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626974487, "uuid": "11ccd8a9-34b1-4a2e-aa9b-1fa2c51fd4e6", "value": "ER8NSOWUNA01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0154b951-eae4-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626955056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955056, "uuid": "135c9c90-7ce4-4bc1-97dc-1a70c34ece69", "comment": "Malware payload (AgentTesla)", "value": "08bfe97addcfdc8ea68d56a80a16621a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955056, "uuid": "e9744a5c-fab2-4d74-96e4-b312729d8829", "comment": "Malware payload (AgentTesla)", "value": "594b6fc5ffe9608371a2853db4a54d89d5bef4294680bfd835fa05b20f575b17", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955056, "uuid": "0438ce2f-f70e-437d-9f15-9cbbeb23c204", "comment": "Malware payload (AgentTesla)", "value": "2111b3ffb8b32bad9d341848bdab6688e280a222", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955056, "uuid": "af317f25-8e1d-45ed-b6bf-8321b4767096", "comment": "Malware payload (AgentTesla)", "value": "167bcf5df53edf61580560fe26a25e126b6f67cae34237a8c6c54fa758cb99956165d4aeed1e8c54e6d861f92978a0ec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955056, "uuid": "41136221-b09a-48cb-a9ce-7afca3808aa0", "value": "T10C5512933FFBCF0BCFAB5A38A5C418589111DD133B92CA0577C17AD269B61A84B6205F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955056, "uuid": "5b64b1e4-22de-455b-9e09-a19b21b0275c", "value": "24576:jFpbNi1UOo+xpuaxikZMTvkIG1+9jWPi07W01yRxsiCNfppHkfdvSYCZO9:jFRmEsZMjNGYXaUa3ppHk1aXO9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626955056, "uuid": "b1d7f772-8553-4f00-9d29-85393bc154ad", "value": 1328128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626955056, "uuid": "4aea8def-369b-4669-8111-811e4e5ec46a", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955056, "uuid": "71cb50d4-53fd-48e4-a3fd-2f1a0ff1b16e", "value": "PO VASE.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43683197-eb46-11eb-875b-42010a9c0053", "comment": "Malware payload (NetWire)", "timestamp": 1626997257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626997257, "uuid": "1a660fc5-8fb9-448c-aefa-9f1a7c7f0de7", "comment": "Malware payload (NetWire)", "value": "51e38c5c7a3a24dd8092f94d915de981", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626997257, "uuid": "e85a162d-4ea6-45fa-be11-bdb52d501f05", "comment": "Malware payload (NetWire)", "value": "5b4962b939b67929dcb5b0c5a90b75e617f9af630271d710a21ccbe0d7738e05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626997257, "uuid": "5f47ab15-5c97-432d-a79c-71b5b3be50b4", "comment": "Malware payload (NetWire)", "value": "a8dd1348c866219ea5357bc3919c9885184949ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626997257, "uuid": "2c9c62b8-62d2-48c8-b5e0-6ff016705881", "comment": "Malware payload (NetWire)", "value": "b9dee76b79f5356561eded94cead66e1957d14125b94c405c047d9b58d5a1a8c3e78be5cd0c385e37c9e5080e7d1d5d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626997257, "uuid": "c57e69a8-14db-45d9-9c5c-483b458fa622", "value": "T15DD17736A7E847B5FDF60B31ADB62241077AFA04DD23EB6E9884620E5D222144B61B35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626997257, "uuid": "92777218-7fa2-484d-a6fa-c75109049ccf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626997257, "uuid": "0fda2590-fbf6-46dc-90d3-bf68b93bdc5f", "value": "96:7qCecXKXi8xkHjhPp2TI6ySSVmrDDnpJCwJvwWzWVG1Oe:7q8Ky8xYBpcIbuJNv7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626997257, "uuid": "74c73378-8f0a-4e11-8918-9985d401d103", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626997257, "uuid": "cd8eb885-83ff-45f3-9cbd-f475973553a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626997257, "uuid": "88ddd55b-7bd8-4ab9-8ae9-56f4cff7598c", "value": "51E38C5C7A3A24DD8092F94D915DE981.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16fe954a-eaff-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1626966688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626966688, "uuid": "bedcac0d-0c2f-40cb-a90c-867763e34906", "comment": "Malware payload (NanoCore)", "value": "cd0645cb78b55f0babbdbc4d51f23bd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626966688, "uuid": "3515f100-1a4c-4be4-a11b-6b45a568584f", "comment": "Malware payload (NanoCore)", "value": "5b618273e08f4e9633ec359cff551345d0dabf0c64da9d3b5437d1c88c4bd226", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626966688, "uuid": "345292e4-7463-49c3-b43c-841e8eea1359", "comment": "Malware payload (NanoCore)", "value": "f5221832b2b4b7338bc21e42f7e2c983d82dbdf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626966688, "uuid": "2c28107f-8b57-4716-bac4-40157c5f8e6b", "comment": "Malware payload (NanoCore)", "value": "a4ee67f4d4122c1f0eaccaca0ab7c066f8f0e275515f411d37f50c84ab6edd37ae35518854d98e969796a3ea923ed1f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626966688, "uuid": "0c6678a2-cf3e-48b9-853b-22f5440a6508", "value": "T13B15AE875E8E865EC15C4DF69B759C4686314DBB290AF3032EC130ECDA3F6DA889F512", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626966688, "uuid": "31c222b2-9adf-4bde-b07b-1a3ece3d6ef9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626966688, "uuid": "51cda70d-f077-43b9-a4dc-1a14d3bdebb1", "value": "12288:uhdsjoEa0P0ug8+KpRJIwOauaExsH+XViPUN9AuTcxNzVD7+xQipP5r:2dsjT/zga3Ju7a+S+XViPUNiuY7Ripp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626966688, "uuid": "44e189bd-e66c-493c-983b-b0ad6dc9612b", "value": 896000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626966688, "uuid": "c7f35789-8f75-4e9c-a41b-a85d3236d869", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626966688, "uuid": "27397b1b-42d3-4c79-b11b-0163309e5520", "value": "R6093846s-Invoice-Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4be3f59-eae5-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626955759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955759, "uuid": "8b75591d-9f44-4c50-9b0e-768daf4d2d0e", "comment": "Malware payload (AgentTesla)", "value": "af9bb5934be920668eb417cdb72f7148", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955759, "uuid": "d4239440-5d81-4119-807b-09c967a1259e", "comment": "Malware payload (AgentTesla)", "value": "5c12f69c9907c35269bc9893b25c5440583167d7384d838c285bd97b8726337b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955759, "uuid": "9363ef41-b83b-4490-8cc5-f5ab6a1aafab", "comment": "Malware payload (AgentTesla)", "value": "78c42598f90e2cb2625a130bb715ba1da024b474", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955759, "uuid": "b43d5183-c4c1-4d85-93f6-87e78f33bddc", "comment": "Malware payload (AgentTesla)", "value": "c2315e9e32b5b48bd089eb3b1d3e7c3d569b8e6b3aa1f186274c7efc2403f42e808d247916a8cea2e848dd8f79538a4d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955759, "uuid": "fa1c5c06-7114-4a95-8a2e-5177884d422f", "value": "T1FCE19E31E072353871CC797D2D9B9C3413AFA55FB1F861312A5D766489AC02BDD0A4D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955759, "uuid": "be76cf25-4fb5-4154-b7ea-8404d38ab066", "value": "192:Wvz/dQjso70apaEwyQ9PmkrpMpUT6VAjMONK:Wvz/O4wD1Q9PkUT6K1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626955759, "uuid": "eab8afe5-62c8-4695-9a96-a76b85de04b5", "value": 6808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626955759, "uuid": "00cac816-138c-40ad-afb0-59dd882b3559", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955759, "uuid": "0af1831f-ea53-4729-9e11-9d0c6be4e760", "value": "Swift-pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac4ca40-eb3f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626994531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994531, "uuid": "67abb509-4e3c-4f50-b5fd-c34a5871dfb2", "comment": "Malware payload", "value": "4c80a391e5c3339171b8e8cf65f022f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994531, "uuid": "4490c5fe-1665-4307-9638-adf9559b73c2", "comment": "Malware payload", "value": "5cc2e5330a8b6ffcfd4d84fdb6112faec22fd8b41d67a507c111511103f65dc3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994531, "uuid": "ccd77d0b-970e-4cb5-b215-c0297d2fdb5f", "comment": "Malware payload", "value": "70bdaed677fa2878f0b01bbaefc25c94ad091c8c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994531, "uuid": "472cd7c5-84ec-4f6e-a113-c14e894803e0", "comment": "Malware payload", "value": "d1ddb401cf36e508722f59e10c5a5b83c7655564f0b0411b9e29e4bcb192b902dca61d1531f878506dbd928fef01a8f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626994531, "uuid": "f17a4e91-87db-4942-8c66-cbf759aa0991", "value": "T149B20901B20D0947E1672EF1393F1FD0D76EEE9121E5E584395FEE898172E328282E4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626994531, "uuid": "dff8c5c9-41ee-4b8b-9247-f2a176fcc1c3", "value": "384:DSDVA8LD539uBkLyYIRiZEqoTWJJGxvsSpq5AvFP/hChVTcZ9QtUhK+6RfZ8c06G:Y1kWLAiSqDg0SgMDZ+OhK9q1q+Xpau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626994531, "uuid": "c8ef84ae-92b6-43f8-9379-18abffe151e6", "value": 25676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626994531, "uuid": "b99980f7-46de-4079-b37e-c5eed42da91f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626994531, "uuid": "f3076627-3993-407b-a81d-cd4e16786a66", "value": "4c80a391e5c3339171b8e8cf65f022f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55fc21c6-eafd-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626965935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965935, "uuid": "0d5ae6eb-c85c-4728-8745-4ee47f565a9a", "comment": "Malware payload (SnakeKeylogger)", "value": "90fc1c7c37257d828778bca2c7addbfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965935, "uuid": "4fef1aa2-4c9e-40df-87e3-376d68c506bb", "comment": "Malware payload (SnakeKeylogger)", "value": "5dfc39e30905e2a653f0c346f6a6e0a76c0837d47fccc71317d7d01a3eb2b00b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965935, "uuid": "0af152e2-7973-4522-a61d-00fc91eebec4", "comment": "Malware payload (SnakeKeylogger)", "value": "eed7abd19a3ae14e2bf914c22dea3390970818ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965935, "uuid": "2aadb7bb-d40f-4009-8b8a-c005bd91d597", "comment": "Malware payload (SnakeKeylogger)", "value": "876b984f36bb891a00b148a209ca1b2c88fba37860e835baf97bbf26ebd784fbb2d897889849a5ec0344013853770d99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965935, "uuid": "2a850446-2429-4b20-bffd-8cfc78b5d58b", "value": "T109847A3805A41A63C67AA673D268E301FFF05AA37211DE2957D7D9C70E1360329CEE5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965935, "uuid": "8beb8573-5418-4f8e-ba13-5cf97725164a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965935, "uuid": "3d8e508e-0102-48f8-b380-1672e6e3ecdf", "value": "6144:nVDPOm7ImKFsw8mG4zt3kHh/GDxqKxLr7zYuFteQJ+t0rlh:55xsswXGoQdG1qK9Thv/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626965935, "uuid": "22dd47b6-ed0e-4d77-a494-28e7989d0a08", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626965935, "uuid": "fe7f22d8-fe99-4661-8c24-c59313219ed1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965935, "uuid": "1ceae577-8d33-42e1-98f6-f2b9ff8c50b3", "value": "New order 11244332.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec40a7b-eb1a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626978405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978405, "uuid": "40ca81e6-9267-461e-8857-60d981a3418a", "comment": "Malware payload", "value": "7da9dd7978dfdde836358060769349a4", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978405, "uuid": "37116d97-ef37-4068-9aaa-77a0ea5b97ba", "comment": "Malware payload", "value": "5e11b34ddd6ffc2504f31b653bf037522d8cf7e5ac946edbbb0799e683e32f1b", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978405, "uuid": "f307ba6d-1084-4684-b2b4-fc2fc0a1b4c6", "comment": "Malware payload", "value": "ee52351d65db136f6d93ac8faff8da224c955ead", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978405, "uuid": "ce21a91e-acf4-4e00-97d1-f4b2a3b86b9d", "comment": "Malware payload", "value": "59c538cb2b7a108e4f7d25343605f0d6c50200de2cba8a9d1d0b83e6a0812cbe8869cf4e5a04d23cc162b22c862478d9", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626978405, "uuid": "7092ba5b-08cf-417f-b01e-ea8ef1c3fe78", "value": "T103258D2076DAC536E57E05B02A2CD75E406D7EB00BB998EB63C85E6F09F09C24635F27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626978405, "uuid": "236f782e-37bf-40ab-950e-67d816542d9f", "value": "24576:iQaBqnGIQ5M6DLrVVdWG859GCHrSoUzLyaVtFUl:iQ8lrXVVdWX59GUrSLzeaVtFU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626978405, "uuid": "0f257522-7035-469a-832f-d046e3660bc0", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626978405, "uuid": "7a223334-786a-429f-b434-e399ebaafb4c", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626978405, "uuid": "97c2a1ee-826b-418a-a1f1-98067c0544d0", "value": "7da9dd7978dfdde836358060769349a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97a70be0-eb45-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626996969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626996969, "uuid": "cf078898-fa74-4ed5-a69a-08c23825bf40", "comment": "Malware payload", "value": "d0aa862e7e3d80ed48ab0bfe0eb3dec8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626996969, "uuid": "51d347ad-b5a3-4815-a1fe-7d0b7ec6e5fa", "comment": "Malware payload", "value": "5f11ea728680baf5bdd4840a88d04d52f248ae2e31f02c21057fef6803ef0420", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626996969, "uuid": "1273d40f-5077-45be-884e-6299e51df9d4", "comment": "Malware payload", "value": "74334e5d4054cd967d1df0f769ff1f406c9a949e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626996969, "uuid": "6b128435-077d-421a-b226-0ecc5a2696b0", "comment": "Malware payload", "value": "7cbcb2d1186e3e82e6b22120b3ca3708fc5010bbd13c91e6d14e8d12c1ceb76e275d82bf31faa2b65b6c37d032651ee0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626996969, "uuid": "36dfb02d-53f7-419d-92c3-c6ad56174c00", "value": "T11DD37BCB2E148AB3CB5DF53404A3733C072B993EABD38E0EE99B3D0A673625C5544569", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626996969, "uuid": "4d986da0-2d1b-4ef8-b5d3-1c40ca9284c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626996969, "uuid": "9de322fb-ea71-4cd5-81ea-f34194c9b287", "value": "768:PGcQHo9fH9IRuNcWMN7ec2fNaUtVW9Xu7W/Zq7YzUM3+XC1GdehtCRGYw3YgoE3o:+cKo9KYmNycEaCNTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626996969, "uuid": "4b3ec322-d62e-4b78-8189-77bb6e222934", "value": 139776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626996969, "uuid": "d8eee103-fb37-4729-886e-70097e1712be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626996969, "uuid": "4107810e-accc-4d1b-8eb3-bd9d377620a1", "value": "d0aa862e7e3d80ed48ab0bfe0eb3dec8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53472e29-eae9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626957341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626957341, "uuid": "2becbcf9-782a-4980-9e78-dfff58c5b194", "comment": "Malware payload", "value": "5636b827940a35459b1da7d2134d2eda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626957341, "uuid": "4f07cac7-43ed-4e1d-a5be-d2d0e9413f37", "comment": "Malware payload", "value": "5f15219a3137edce6d551f39a939d0d31fefb8b87d82f38be81c5ff6c7f60ce7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626957341, "uuid": "486a6de6-cbc5-4e5d-a42a-f8ad14ab791a", "comment": "Malware payload", "value": "440239dfd292d496f1b1e76541168768e9d9abd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626957341, "uuid": "97e6c0f9-e613-4a38-b195-19757d53546e", "comment": "Malware payload", "value": "e9973d009b087aced036329ed504b4bff1be549062fbe20b32c793db5d6ba657eae1c26f7da69f2652224443170619f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626957341, "uuid": "2c7c28c6-3297-4106-b285-d07587729788", "value": "T15F1512913B802944E579863FE4A2D051937FB103CD4F9BCCF58C952CA65E84B1A37BBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626957341, "uuid": "cb26326b-ec4d-47ac-8af7-df3dc2493f99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626957341, "uuid": "ab3d5115-43c7-4259-8dc9-50f4f7b15798", "value": "24576:Hv5taAfw+Jwz/S/6N+tHv0PTVbUkITUcUVLfEjggk0q:Hvvauw+W7SCwtH8PveUcmfEE0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626957341, "uuid": "a547354a-b591-472d-a43d-4c54c90f10bb", "value": 951808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626957341, "uuid": "9b518a69-b851-4fb8-91ea-5f6911f2b1ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626957341, "uuid": "525590ea-afac-4ab6-9642-6a31f3b88df0", "value": "TLL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec452c45-eac2-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626940847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940847, "uuid": "efa695bf-c0a5-4917-b977-6e3b5048964e", "comment": "Malware payload (RaccoonStealer)", "value": "47f0522a0cfd75f08b67728220bf438f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940847, "uuid": "e36e28e7-999c-4c0c-9fa3-448f939d973e", "comment": "Malware payload (RaccoonStealer)", "value": "5f961bb251b5cced26c85957ba0c0b2f74a1f7c0a1edd2095c5b8c4bfb344b44", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940847, "uuid": "36f53ef4-6622-4a07-ad32-9bf580c11164", "comment": "Malware payload (RaccoonStealer)", "value": "dbbf6f4c477c84a500eb63fb47a9617bcf51b2ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940847, "uuid": "e215986d-5f64-4b08-9af9-e26a80c0fc9c", "comment": "Malware payload (RaccoonStealer)", "value": "3683f54800a39967a4605022b2d95e751c2688755d9e933b18beec2b1adb1a6112a27a2af20479aa55087bbe51100627", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940847, "uuid": "bf99859b-125b-49b7-a03b-cc81d86cbeab", "value": "T15FA41290F991D832C092593158F6C6B069BEFCA70E294A473BC43BDF6E326C1657E316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940847, "uuid": "eaaaaa4c-b3a6-435a-a37d-34643006eb94", "value": "4d4fdfb7fcb2254a31ad850df30aced5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940847, "uuid": "bf537208-c7a0-43ea-b4ff-81a443827d6b", "value": "12288:ym3ZPTt9YX2E9cymK7NN6Q4k3cRneuyYoE:ym3ZnYX2/ymK7ck3c1y6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626940847, "uuid": "90f2f760-f9bb-41f8-9e82-821727dc57fa", "value": 468480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626940847, "uuid": "df97eb28-e023-45b4-ba62-d5afc48a3a01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940847, "uuid": "9ba59729-56e2-4df0-823e-306de06bb505", "value": "47f0522a0cfd75f08b67728220bf438f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc0ae2a3-eb46-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626997513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626997513, "uuid": "f58f5542-2ac9-4bba-8dc2-0998dfd5e99e", "comment": "Malware payload", "value": "f4777ed999fd8352227e750ac0e1b85d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626997513, "uuid": "4efab15b-f66e-4917-a55e-4b0768c22254", "comment": "Malware payload", "value": "608a0047a24db367a88e482bef92fd3b9a33db19ad3635b404132202e432eacc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626997513, "uuid": "4875d64a-3bc0-42d1-971d-254eb9551459", "comment": "Malware payload", "value": "fb8c3aa14e4a3bd678bb2ac5fb9d8eaa10f55cd3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626997513, "uuid": "8445098d-91f0-407d-beb1-b3d6d296e11a", "comment": "Malware payload", "value": "ee36a26dc94bf8a5fced5b5f8aa1967a8883cfb70b1e267e233eb4eae2dd5adff2db7ee2a75f0e66e79c3c7eccc67080", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626997513, "uuid": "e1b1ae2d-0502-41b7-9a3c-4a0e4dfeb96c", "value": "T137B21A4E3FA98866C5BC1B7486B5965003B491470413EE2FCDC560CBAFB3AD92D4CAF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626997513, "uuid": "900c1db7-ae71-40c0-8376-20541da85561", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626997513, "uuid": "045660c0-dd98-418d-88a8-e015b5c82293", "value": "384:j/MKyO5BkRahobh31yuKeMntw6zgV4AiQ5pzlmRvR6JZlbw8hqIusZzZ81:jUaYaCb1KqiVRpcnuL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626997513, "uuid": "53b8a6b9-3e0a-488f-96b4-b53a73d88985", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626997513, "uuid": "493c4fb7-3bb6-4eab-be6c-a683949878f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626997513, "uuid": "9b517e51-2c52-4c3a-933c-286acdcdd567", "value": "f4777ed999fd8352227e750ac0e1b85d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f9ccee-eaec-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626958523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958523, "uuid": "1beaf849-e6c0-4b93-bee9-ef30a04854cb", "comment": "Malware payload (AgentTesla)", "value": "dc6a5d1b3accb015fe2b6f91176c57c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958523, "uuid": "fbeb6fa0-c116-4251-88b1-edc258f9c22d", "comment": "Malware payload (AgentTesla)", "value": "60f621808e2a3de0ba3b655874bf321da0505b147dea66aa340c8a2a126f9e23", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958523, "uuid": "e754795a-a462-4bf8-9cd4-efe38a3e9623", "comment": "Malware payload (AgentTesla)", "value": "4abcf45cb20f5f228ca0e93a375bfc1d6638ede1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958523, "uuid": "d011dee1-d32b-4c44-a85f-1c6e51a9109e", "comment": "Malware payload (AgentTesla)", "value": "4b64579ab84c02318c038f79d10564457986b891b3f0084c56c47cc21efee7db4f6e39fe4152f4c3c94dfbd3a81e5fc5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958523, "uuid": "daeeea06-c8fb-4307-839d-2eb9e761ca86", "value": "T1D605DF35F2279B48DCB4C3FB1858926157B9BCE97219CB396E54B0FC68336786AE0740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958523, "uuid": "d425f1a0-a212-4875-b547-f913109004fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958523, "uuid": "08d2f3c8-c05a-42dd-ba4f-361c28ea4fd5", "value": "12288:hDcF7S5M/+4qvZvPqePa+MMVesh3X8ERFM43i3YOm2jk2oxtSyaUVKnp:Kc5U+lwetM+esZX8E/7eYOljBoxrahp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626958523, "uuid": "1b4e1a07-c422-41bc-8768-717a7c26a0db", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626958523, "uuid": "2c374b00-95eb-40fd-8b30-3a2a2b6b445a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958523, "uuid": "ce8fd097-dc08-4982-a156-e54319ec1219", "value": "dc6a5d1b3accb015fe2b6f91176c57c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57016f6d-eb03-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626968514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968514, "uuid": "7bb3dd7c-9a0f-44cb-83f6-fd24c3188664", "comment": "Malware payload (Formbook)", "value": "04ea3fcf816b22f98adf5267204615f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968514, "uuid": "39030e8b-5f32-4487-9451-68958a38098e", "comment": "Malware payload (Formbook)", "value": "62269dc86f9f29aeeeb4966505408fccefef782f08334def058cdca5884b9c4b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968514, "uuid": "b0ce1911-6463-4ae2-b0b6-3b8cb054ad56", "comment": "Malware payload (Formbook)", "value": "06a21e2a043f00a4f1f364975b3de139f8f508f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968514, "uuid": "40841fb8-fbbb-42d7-bdd5-f71866453d9d", "comment": "Malware payload (Formbook)", "value": "9ce4d91053cf51bcbeda9441fbf20f58ad4c789a29bb91fa9ad7124128a07b355354632765fef6fffdbeb6a04349be74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968514, "uuid": "4b39d684-f4a5-477f-a357-198a4b5111bf", "value": "T1A915BF2123EBA284EC3E67BC8834C04597BB7416C67BD76D2D4840ED2E73721AB97356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968514, "uuid": "38dcd4b9-30a4-4607-b752-6b4e73b739ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968514, "uuid": "875af8af-3c89-415d-a4d3-b7c201967f4e", "value": "12288:pots2HgpLzKjH6/9oyvUIZbVEjNiHMZDj61xUqp/6LUV8Tj6L5niPE0dEysGU:WgpLOovDBK4sDmjUqNk6C2Ld6E0VsGU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626968514, "uuid": "6145b83c-176f-4f8e-a4c6-661602c994d1", "value": 926720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626968514, "uuid": "da85b849-970f-4494-b69f-d19f2f2bbb7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968514, "uuid": "1befa1eb-50ba-4248-a013-a4ddd257430a", "value": "04ea3fcf816b22f98adf5267204615f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b32d7675-eb0f-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626973822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973822, "uuid": "f90a0dd2-b3ae-46eb-adb6-fd1451efc720", "comment": "Malware payload (SnakeKeylogger)", "value": "6028b7a2039764f73be6edcde47b4d02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973822, "uuid": "9ff20317-9912-4f9c-b835-b397262c8b42", "comment": "Malware payload (SnakeKeylogger)", "value": "637673935540e423bc1e782b7e00c2037d55ff0ff1fb34e157e7ab8fa63dfffc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973822, "uuid": "30e03d96-1517-41c3-860b-037734cdb22b", "comment": "Malware payload (SnakeKeylogger)", "value": "684d7aade8cb6a9c0954eeeff41bb77fc8c180d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973822, "uuid": "0680a041-51f2-4fb5-912a-f25e3fdec018", "comment": "Malware payload (SnakeKeylogger)", "value": "728fe8da648b82671a9672fdb2101c0e918c02496bcc1c6d6739293e4aa592c89159d8b49289022dee62bcbbdf7fe79d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973822, "uuid": "1a3af980-2897-4850-b57a-4e3732e9164d", "value": "T1AF551239A25B661FCD7882FA1C64D152A7FAA016361ED3702D94D1BDB8E17FC2BF0184", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973822, "uuid": "d9217f48-82a9-4d2f-9e7a-539743668e7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973822, "uuid": "d4d3b07a-00a1-46c2-ae15-dc322e216c2a", "value": "24576:Si4i8oUGYRoJ3T1nEdSadDBm1+IFNpyRhRCq2k2yzahpJn:18oU92F1eSoCpU7Cq2kNOXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626973822, "uuid": "32d30fe4-1ba7-4329-ae31-24c43d152efb", "value": 1405952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626973822, "uuid": "95bb95c4-d144-4da4-b835-b588bb6bf502", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973822, "uuid": "d3dc1f27-eca3-48d4-958f-46d841a438b4", "value": "IWky5C8Dhwcnso8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b32c09a-ead7-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1626949703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626949703, "uuid": "189d171a-18e2-4b6c-9a2b-df4cc1c7de0f", "comment": "Malware payload (Dridex)", "value": "2c13b06a4c6d4d880060037edf641ad5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626949703, "uuid": "c649169a-a5c6-4f89-8784-68d52e3c5b7f", "comment": "Malware payload (Dridex)", "value": "6566f7a379e744ca6e006241bdc600bdcd09c17dc48f61f13f9d9b11b86f9483", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626949703, "uuid": "77bd074a-09bb-4e81-9600-308219de3491", "comment": "Malware payload (Dridex)", "value": "835dbe95edd096c6800d75054f7e8d62999248fc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626949703, "uuid": "62d1e7d0-f222-4ca2-b36b-b9805071cd9c", "comment": "Malware payload (Dridex)", "value": "71c40d9be88945e5cf635fd8b3e2d52cabb4d4fba9d9b0a635471fdce2a9d8e962c33116c848a0b2133fd8359cb83a63", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626949703, "uuid": "92b6253f-60fd-40e3-a74b-cf8b9fa3ace6", "value": "T130E449C5EBE1C92FEBD1D57A0C564630227CCC4055804B973256F33AB72BA7C8E9A2D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626949703, "uuid": "6c110045-e02c-4e0a-822c-4135867d7ef1", "value": "12288:3GDH3roxGMC/mc4bl3q5uaFsvCgdz2l5MjavMmIf+DfuUi:3GDXEUH/4EnsvJZ2lKjavMm/Df", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626949703, "uuid": "3d0b2176-372f-4c23-8dda-edb25305ce85", "value": 674816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626949703, "uuid": "4a3d5645-7458-4f01-836a-84e1c162466c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626949703, "uuid": "02091086-8b14-4dc2-8c9b-17cca2c06d59", "value": "2c13b06a4c6d4d880060037edf641ad5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fa0935e-eacc-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626944960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944960, "uuid": "b3c5de17-d2d1-4a20-b8be-c7b437274996", "comment": "Malware payload (Mirai)", "value": "96468aa8293a504d9431860381691baf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944960, "uuid": "f6a59557-2946-4d67-9c8b-55955c56cb1b", "comment": "Malware payload (Mirai)", "value": "6596ffeba4d8ea7bc59db3f41d511c1241263f9dd3c01a5657c89279bc8c4fd5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944960, "uuid": "0587dd6e-1222-462e-88c6-f86a11b400e1", "comment": "Malware payload (Mirai)", "value": "a2e7baff712d4a1a41b2b83f60e0afcbaa774190", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944960, "uuid": "9f2c2a5a-7535-47cd-aa1d-8525bf783fd1", "comment": "Malware payload (Mirai)", "value": "affba599c2a7001e610b77508b2ad51152a9d551770d666f9ac070022315e7c7059570da75947c7bb32ad3df4885bb58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626944960, "uuid": "c353f2ad-88ea-4b21-9e48-3a94e49e2062", "value": "T120C2E0981B8A19E9C2F9C17943BC0B6C1DA40F66F809DC8678F8F7629D8E4743017ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626944960, "uuid": "bb4c1f38-fb96-4404-8a29-0dc5c8e0ed6a", "value": "768:12G214DFyosXqgvV9o1ndB08F+JgGlzDpbuR1J9:12GdDgosaaO1ndmVJuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626944960, "uuid": "2610de73-98bf-4ab9-92e3-991dc38eedd2", "value": 26184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626944960, "uuid": "b3dfd3b7-b07a-4c65-85e4-f223eddab737", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626944960, "uuid": "72b28fd1-f5ab-40d6-ba57-24c96e28d6dc", "value": "96468aa8293a504d9431860381691baf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19115000-eaec-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626958531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958531, "uuid": "2e1b57e8-9281-4dce-8397-7b9c2339b9e0", "comment": "Malware payload (AgentTesla)", "value": "679e61e35641582d91f79ec97752b2a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958531, "uuid": "7481803f-2025-442c-9e2c-c233cebcbbfb", "comment": "Malware payload (AgentTesla)", "value": "676f6881fe4c71bf5f97091fa411d7ec1689f8c40383a2ffae9f84aaae442330", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958531, "uuid": "3deecd7a-fae7-4d75-adaa-d04d38d3d066", "comment": "Malware payload (AgentTesla)", "value": "14a6ff96de2f98b6898dd9597aee672207144da6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958531, "uuid": "86a9915e-74bf-4519-a60d-ebd6b9aee488", "comment": "Malware payload (AgentTesla)", "value": "c78cd44300dfc23b27d6d7900b00c6f7d25dd7f2fa568ba63318e87f91f2bfa2dbdb7f4ee4005cebc561a9c644f212dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958531, "uuid": "58907dc5-caae-4396-8573-ddeca33c0695", "value": "T19305CF35F22B9B48DCB4C3FB181891616BB9BCE9721ACB382E44B1FC687367865D1354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958531, "uuid": "aaa6f106-3393-41d8-9680-905208db2862", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958531, "uuid": "00676f7c-ca96-4640-975a-6ea918549509", "value": "12288:NlEm/r3DPwSkYRyumZTCM28cn3MoYMpMPsNjLyaUVKnp:NZrzPwSnyJt6F37YMisJ+ahp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626958531, "uuid": "453a5ec9-18fa-4217-afee-39c374b36845", "value": 855040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626958531, "uuid": "922daf53-3222-4b8d-aa70-2c831d570d8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958531, "uuid": "57dd26d0-ccb8-4f51-a14f-115ff9961c18", "value": "679e61e35641582d91f79ec97752b2a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50495fb-eafb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626965289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965289, "uuid": "e092138d-4a5d-4e57-b8cb-c01ec9823576", "comment": "Malware payload (Mirai)", "value": "3e8cf804416e4627ca6ae63d82b292ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965289, "uuid": "cd9b91bc-a294-494a-94b6-099fbb7fea55", "comment": "Malware payload (Mirai)", "value": "678d2387c449051e7ea87dd27cf8528106298c6f262cb7a1e5c6ffee8326a4dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965289, "uuid": "eda4853c-f45b-4491-9c4a-b9757797ea72", "comment": "Malware payload (Mirai)", "value": "b023507b332c68d32b735a72a50e0e0922fae324", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965289, "uuid": "d744878d-8a12-4400-9b3d-6fe9a008de0a", "comment": "Malware payload (Mirai)", "value": "5799bd3c9f66efc307b2f7022cf2a66189aedcd9b4da7073ed343737e0e91cbe9eac9ca51e305f349df00ac9b08184bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965289, "uuid": "73aa85af-adf7-47eb-9874-d2021c90ffe5", "value": "T1DD23E9C27891AE29C7D057BBEE6F018E3354A798D1EA7353C8240B947ACA90F0D57F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965289, "uuid": "821ce664-c9ff-4d15-9d44-322a91932e41", "value": "768:PqPo2Ap9tDjGuqPDkj9o1uDuTA3nRqM+7ojxed1VCFEn/OXwCVy/zmJHUhG1jewU:CPDC7jnqwj9KTAYrd+Gn/FzVLS1S2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626965289, "uuid": "7ba5fbd0-0363-493e-b4bf-bc7878349846", "value": 46416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626965289, "uuid": "59de700e-ee7c-4da5-8d6b-64db30c7c0c2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965289, "uuid": "3147df79-d3d5-4246-a3ed-ef8ee40957fa", "value": "3e8cf804416e4627ca6ae63d82b292ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af80ea53-eaf5-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626962649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626962649, "uuid": "65fbe5da-455e-4c74-b115-403a778e1871", "comment": "Malware payload (Mirai)", "value": "c78fb50b87baa2bd1066f4f06808ed91", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626962649, "uuid": "0aec64d9-07e2-4b29-a892-af7e9a4d17dd", "comment": "Malware payload (Mirai)", "value": "67e9c75d1775027586e60a5a5b44a697ed0b36fbc46d76290c05bff947b581d4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626962649, "uuid": "c9487d27-a5e8-4e35-ba43-307cac6e5d8d", "comment": "Malware payload (Mirai)", "value": "d63ac13af718a3b7a97a753b3a70b3dbd6c039d2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626962649, "uuid": "0153a70f-5782-4e89-a092-57147a993975", "comment": "Malware payload (Mirai)", "value": "14ad014bc88fb0700b6954eaf120e108002ed0798146736fca57ce304b10ced5329de3703929cca8067bc60941c4f53a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626962649, "uuid": "547556d5-32d9-409c-a99f-820ae76c5897", "value": "T19F6401C7EB21AC2FC9400BB115DB0B5DB7B8DA8A82C7E181F3D4C55E3C6A285B7A11D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626962649, "uuid": "70ebaf2c-d3c3-4ea7-800f-58e9a3b045c5", "value": "3072:phNlHuBafLeBtfCzpta8xlBIOdVo3/4sxLJ10xio1a5POdOQ33Q:p3lOYoaja8xzx/0wsxzSiFPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626962649, "uuid": "0395df32-8bc5-4998-ad53-bf82b62ee374", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626962649, "uuid": "ffc5ebf0-aa7c-4490-9a68-0a2ab9000277", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626962649, "uuid": "8bc8d0c1-d77d-4fef-91d1-6bb89d815f24", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b21bcf-eadd-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626952301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626952301, "uuid": "6bde60a8-2caa-4064-9053-f316352a532b", "comment": "Malware payload (RaccoonStealer)", "value": "a4c9935a00e3723066e6873fde662695", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626952301, "uuid": "55da3c05-0a2f-4ea9-87b9-e7c5ed6e8eb8", "comment": "Malware payload (RaccoonStealer)", "value": "68489600843ed51432423415a39db0e296d8fcc35286a7510dc6eee062ce6763", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626952301, "uuid": "4d69c7fb-ca72-4029-ac97-801fcd284cfe", "comment": "Malware payload (RaccoonStealer)", "value": "a402b0cc45607f66b92389319ecee42592234109", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626952301, "uuid": "c197db6b-0c3f-4a4a-b493-5fa3b52c735b", "comment": "Malware payload (RaccoonStealer)", "value": "9ad68c985b15621b2072ec52bffebeb6679f2c4664e8a73c5cd5198a17fca6f8a85c57f91b7aca2fba7298fbdce77b31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626952301, "uuid": "d9ed4bac-1750-4bee-a53d-f273756cf498", "value": "T1CDB40140B6B0C437E1E24A705425C7A416FA7C32AB3075CF36577E2E5E326C1BA7A786", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626952301, "uuid": "699f3aa2-614f-4c78-82b2-ab2bb9b663c6", "value": "c4091a010a717ca7ee4824b5dba50590", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626952301, "uuid": "d171a266-c6d9-40c6-96a5-d14b974543ad", "value": "12288:xwLwCqDpKw/qabccBGmP+9aaj/hAShhfY:xPCqDpiwp4meaaj/6Ah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626952301, "uuid": "9e72a890-2a20-4474-bca9-48fdc831c6d1", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626952301, "uuid": "6e65b9e3-f397-4a0f-af58-2ffe39a58321", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626952301, "uuid": "0a9e9cb3-9862-410e-b5f3-3446cd0447e9", "value": "a4c9935a00e3723066e6873fde662695.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be99d6f1-eaf2-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1626961386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961386, "uuid": "a097d501-a8ab-480b-a292-f584dd082add", "comment": "Malware payload (Gafgyt)", "value": "92691480763a2b48b7d8ac5e3faba972", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961386, "uuid": "a6502bb8-c7a4-4608-b970-0cd8619c2620", "comment": "Malware payload (Gafgyt)", "value": "6a53ae94eac29e2bbc73663f4e4c234c18a55c9d9b932fbe13eefb28333eeebf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961386, "uuid": "eab885f8-dba8-4f5d-bfb0-7081809b45d7", "comment": "Malware payload (Gafgyt)", "value": "a78a6ef4b2169f9afd1038f37691b7ed80d9ff40", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961386, "uuid": "11b1d453-1ab4-400a-ac86-ecd9e8641a2f", "comment": "Malware payload (Gafgyt)", "value": "bb704d4881425aae061186925dcb7187bbcb3cf29042d1927a6a1b040c945a040af2bbe694fb83aa30f55741d4fbb3af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626961386, "uuid": "5abd5373-cee2-408f-b325-e14818de620c", "value": "T107C39417BB618FB7D81FDE33059A8902108DE58A12D96F6BB2B4C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626961386, "uuid": "bc17299b-cf93-4328-81ba-f08e29f08687", "value": "1536:/UHeTxCAms/Y8Zm3lKYA43gMJwSkJ8EpA+DzUh8rmW+IFB1Df11hR/:/UyLqAmgMJM8Eu+Dw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626961386, "uuid": "50f47f2a-8942-4779-ac48-c8b4f865afe9", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626961386, "uuid": "d0eaf1d5-9122-4f5f-83cf-53575504de92", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626961386, "uuid": "7da44e7d-081e-4600-96f2-6d2269dbc6f9", "value": "92691480763a2b48b7d8ac5e3faba972", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "695bbc0c-eb03-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1626968544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968544, "uuid": "ae5fbcb4-a3a6-440b-b793-353f94324f17", "comment": "Malware payload (DanaBot)", "value": "043633501a5f0b27142047a055ebbbbd", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968544, "uuid": "98c82528-d8d2-4295-9cb0-248e660f8db3", "comment": "Malware payload (DanaBot)", "value": "6af445508c18363e0031247cff75ed2a98c7565b22fce9621fba2c32e501fea9", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968544, "uuid": "f7c69977-ecdb-4652-882f-b354a148b735", "comment": "Malware payload (DanaBot)", "value": "3f90769914529d3cd466d5520893a86f40cea08d", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968544, "uuid": "884ac4df-37fe-4616-baf6-3874cc3b566b", "comment": "Malware payload (DanaBot)", "value": "2b0656ffd11b831a8a5c8413b89aee427e90663e427de3b668682083a3e4ffd639cb0234722c8f0dbfccfb8cf98546fa", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968544, "uuid": "ff25930c-1fea-47f0-a713-d6f77bdda980", "value": "T13635238072C1D537D19509B644D3D2A52F6FBC5AAE9C8903AE44B3CF6E312C291EEF46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968544, "uuid": "94602b89-7940-4a9e-b5d3-7330c4df53b4", "value": "d1928a342020b866506f1f9f22fa697b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968544, "uuid": "c5ea3b37-eb65-4371-a495-9896d289ce30", "value": "24576:jb1oQCC/KB/ns4KdNYeN8N1w3jVfFHnxRsNqaNOyTn+Lz:k8KodNk1mjVfNnxR5uOgn+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626968544, "uuid": "25ff4d75-82b8-4c9d-9c68-cdcf0345a2fe", "value": 1146368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626968544, "uuid": "d15215c2-018a-4ac5-8fce-9a746c114597", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968544, "uuid": "c229d67d-5d80-4471-9952-d4a0e93cf43b", "value": "043633501a5f0b27142047a055ebbbbd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4a81c1e-eaad-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626931761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931761, "uuid": "0c2a29b8-1602-4532-9643-625bc82e25ed", "comment": "Malware payload (AgentTesla)", "value": "04a77f3faec48eef1fab1f90d0c13ce9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931761, "uuid": "6d618c9a-4584-42d7-bdbf-1be817b536a3", "comment": "Malware payload (AgentTesla)", "value": "6bdd8c9323dfe3f3ce5d5c438f5062b22038e4642b6990125e06f9189d382e00", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931761, "uuid": "0853c896-96a8-49ab-a1d1-163d79c90ed1", "comment": "Malware payload (AgentTesla)", "value": "5a499a5cf1adf7ef3e82bb8e1138ead86671ad10", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931761, "uuid": "d45743a3-29a8-4860-a707-ce788b64c027", "comment": "Malware payload (AgentTesla)", "value": "6aa7950bcc136dde5c53fd9053292fec854e0df45d388382315c77ea59c9b36822adc3720a6120d45bd2eeebd9bc6a35", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931761, "uuid": "36dec557-78f9-43c7-a50e-de9e3fe047ba", "value": "T14F55F13853176B2ADD3482FA1855D28297FA8056215ED7753E88C0BCF9E27FC67E029C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931761, "uuid": "a7030657-c6c5-4ca6-b724-b49105607566", "value": "12288:KybArMZ8CvNWzNs8CL7MfzN8AhuUitj+O6IyOoN1QwKqxgdiG9HP4SHx08syaUVw:eCvH887WpeUiIO5w/adi6lRTzahp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626931761, "uuid": "c6410821-5ee7-4b05-b7ba-1a3d6cae332a", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626931761, "uuid": "a74991e5-fab6-4569-a1ff-c4a1090d0022", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931761, "uuid": "3b434434-0389-42d1-9225-f3e39c124230", "value": "Order_Sample.png.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9437b6bd-ea8c-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626917506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626917506, "uuid": "0cf21e17-7a02-4392-9286-d458026174a6", "comment": "Malware payload (Mirai)", "value": "d65e65e7484ab340ba5b50b346b41cd3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626917506, "uuid": "0e3cc551-e2e1-42a7-a450-78f55aef6d6c", "comment": "Malware payload (Mirai)", "value": "6c3803f6dc0fd0246ec95e40609f5219c157deff23cb2fbe398c2c0c3a20061c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626917506, "uuid": "df91d063-10ca-4569-8af2-641691b5f32d", "comment": "Malware payload (Mirai)", "value": "712380b988becab065faffadac2ab94647c48fdb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626917506, "uuid": "e3d7b016-9af7-4b99-8207-f95eae423c94", "comment": "Malware payload (Mirai)", "value": "8e5b26ddd8f40e186cd827b13b0febc38380a433d4c59dc0c489712501d9651ba94b909fef59835e737a70ab7a2f7b49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626917506, "uuid": "800084f4-1d9e-477c-96d7-3d96f2755def", "value": "T193E20943BE669F77C1829AB926A74A340713FC125F4B0A89722DFDF4070B9CD7919326", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626917506, "uuid": "cb004553-14b1-4e8e-974b-4ab844dbe5c1", "value": "768:z2mxbD5oor38UCvkwHdGv0F5cgOxepq88Q:FaogUCv3HdLTcx0pq88Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626917506, "uuid": "dbf389c2-fc9c-4c3b-a87b-00d9be15c0b3", "value": 32108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626917506, "uuid": "dc8ac73f-7621-4df2-9dc8-9c01745435e6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626917506, "uuid": "3b56acb2-5584-4cf6-8065-28dfd67353f2", "value": "d65e65e7484ab340ba5b50b346b41cd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3d1a1cf-eaca-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1626944188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944188, "uuid": "86259610-1f99-4328-9961-641fd51717a4", "comment": "Malware payload (Dridex)", "value": "0e5fe8af64b1c5ead75e629b8afd34c0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944188, "uuid": "a63c5947-545d-4dd6-84f8-ab9e4b883573", "comment": "Malware payload (Dridex)", "value": "6ca95953e88828830e9cdecb6f56a1139d7678b3d2bf2c2e32c27ee01cece84e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944188, "uuid": "08276d11-8bc5-498d-9e62-8442ebd964b2", "comment": "Malware payload (Dridex)", "value": "3f37deb279e3ad45dd7c5c6a8656bbc07cd8157c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944188, "uuid": "2d421996-13fb-47e3-ad9f-97b70510050e", "comment": "Malware payload (Dridex)", "value": "1ab9cb5f85dd5b714b4d377c3858219b8be2054260636c2f860d550ec8cc7ef8e68190334ae65ca6b06f30165773a66a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626944188, "uuid": "442f9ffa-5de2-490a-b821-f32fc138d158", "value": "T15AE449C4EBE1C92FEBD1D57A0C564630127CCC4456804B97325AF33AB72B97C8E9A2D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626944188, "uuid": "d1b14b73-a414-4897-a031-82127de8e33b", "value": "12288:+nGDH3roxGMC/mc4bl3q5uaFsvCgdz2l5MjavMmIf+lTI:2GDXEUH/4EnsvJZ2lKjavMm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626944188, "uuid": "bab5c342-b900-48e0-858b-52c1970a196f", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626944188, "uuid": "489ad8f6-e281-4318-a1a0-640efe72b532", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626944188, "uuid": "e37808ed-fc3c-47b3-ad3d-0065f40e9f83", "value": "0e5fe8af64b1c5ead75e629b8afd34c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb9ad476-eae3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626955046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955046, "uuid": "a7b0feee-2d77-4528-abe6-9048cdf12e04", "comment": "Malware payload (AgentTesla)", "value": "6c8eba98915a064fcad85ae98528877e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955046, "uuid": "15cd2c97-281b-495b-ac74-0de88cedc3a8", "comment": "Malware payload (AgentTesla)", "value": "6dab315ebf0f7fee41c9a2377512f4d2a98b0e1c27cc6980324c0820fcf163df", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955046, "uuid": "3dd0404e-79fb-47ba-b3a4-2da99837dcf5", "comment": "Malware payload (AgentTesla)", "value": "73b029cc5e191856c1ac019041bca71bf9481bd6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955046, "uuid": "6f9cd20f-b282-4955-93bd-0cadc39460be", "comment": "Malware payload (AgentTesla)", "value": "97d692c41604b4a5973f6cf152642be67da143c8a47b1bbc81599b5a3b7c381702db26bc74f84f749efd0c3b83aadaf2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955046, "uuid": "3688ab4a-cb46-4990-88c7-3e34aad174cc", "value": "T110B423F5DDC53CDA384BC2762B62963E5FBC4FF5A8F48861570B4964C48F8C25B2A1A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955046, "uuid": "b8da23c8-176c-4ce3-8e6a-26414535bf51", "value": "12288:V3kyeuucP5ILiEtUfG2w9PoMSkbKxrktf2Ce5c+AKHVSbq78l:VUduuG5IG0UW9wiGkEt6zSSbq78l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626955046, "uuid": "5a35960f-6f1f-422f-b002-65711695714c", "value": 497539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626955046, "uuid": "9cefb4e7-3330-4314-8965-175dcdff8aa5", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955046, "uuid": "a510cfbd-2b9f-445d-a0c9-65ced41a2b08", "value": "Released Order.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caf4176b-eb1a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626978587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978587, "uuid": "a3be2844-3209-436e-a50d-a464678bfa83", "comment": "Malware payload", "value": "d4fe00d6e9975dd31e96b9d786503069", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978587, "uuid": "0f1d8c24-cd4a-4e54-82a9-7c4bafe118f9", "comment": "Malware payload", "value": "6f5fdf14d35bfe303b9f1b4f3698df919755cb0f76c841f5a9a852939f9c9962", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978587, "uuid": "d4ccb56e-c066-427e-bde8-51ba28b7bae7", "comment": "Malware payload", "value": "28b875f8547a4bcb0bdc539d784769e7ab8815e8", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978587, "uuid": "221b3214-397b-4793-a3d6-ba4f4fa4d164", "comment": "Malware payload", "value": "1ebe2d3831a49a5861e2f460a1118bdb59b6dc91f42cb46a8bfbac7b7eca3fd2ac6bc188ebb888e88b62094bab9c3c39", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626978587, "uuid": "9c30cdd8-0785-4ace-9a53-049b9d903587", "value": "T18DE38D479112A7A3D03893F93F074E986B15AB18E5C1BCDB14521CEB3BE13221DAE75E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626978587, "uuid": "8796c1ce-1f06-443c-bbd0-1131c37db89b", "value": "1536:wJxNkzIXUJksB977w3mv8fdwLmG9s80okHwjzjoki9cIyhGfaZWDClt105:ow8kCS7k3XOmT/QzXIWGfaZW+ljC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626978587, "uuid": "8c107078-93fa-410a-9b32-73f09317bb68", "value": 143943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626978587, "uuid": "d34350bb-c5be-4821-b4a5-5d1616da489b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626978587, "uuid": "4e0c719c-da86-40b2-b639-a10aeca35a13", "value": "350763-394867-221021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71ddf12b-eab6-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1626935488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626935488, "uuid": "33de148e-54d6-4fc0-b306-fa66271fa875", "comment": "Malware payload (DanaBot)", "value": "434c4d6383148ec2d1e98e455ff2629b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626935488, "uuid": "31e5c039-ae73-4b1c-98a1-323907fd1fec", "comment": "Malware payload (DanaBot)", "value": "6fa6caea53a25606c7e2991d370927d98bf3df093e77a0cea8816c30194afda0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626935488, "uuid": "fa347f27-cb70-48ba-956f-4d5d044a7530", "comment": "Malware payload (DanaBot)", "value": "4fe3f1549a9ef0d6c1ff611a1a4f88cf17c8d8cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626935488, "uuid": "3bbe0f2c-3fc8-40fd-ba6f-a1911f9d3f60", "comment": "Malware payload (DanaBot)", "value": "7c3c4ede659a1114cd5ffd37f75ef344d2ef9802d489d71b74b81412a408a571fb5f2b7a63351ad9dff65f3ac6f8b25c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626935488, "uuid": "2aebbc4f-a0e2-4dd7-a633-7519aae21d9a", "value": "T1F335231ABFF5DD25F5E85EB2093E536590A9FCA16870D70F26207E0EBC361067C1C62A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626935488, "uuid": "493991b9-a2df-4b61-95a2-e38a673b0a0f", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626935488, "uuid": "b2f63bf9-7ca8-4aaf-a1fa-928002779e1f", "value": "24576:zR1Z3zKENzaOdXoQLTTONI4l272uRwbcFgC7Bd+JlnYe:t1ZOea2XoQfSNI4s72uRQ6u/nYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626935488, "uuid": "db8d10f7-c8c1-4323-aef3-26e457a72d68", "value": 1151549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626935488, "uuid": "fe212a34-28b4-40a3-8e45-eb15d9baa687", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626935488, "uuid": "dd195071-f663-42a3-a261-c61ca6e79e2d", "value": "434c4d6383148ec2d1e98e455ff2629b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "503c08c6-eb0d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626972797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626972797, "uuid": "5e9f9846-426c-461a-a38e-25c382c4e2a9", "comment": "Malware payload", "value": "c032dbaf3459e6f3825188cfcd4e24d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626972797, "uuid": "f30fbc11-9413-4ab8-bcfb-d99626081995", "comment": "Malware payload", "value": "708507274d4b2710dd37a539c10df1f00cb5f8e4c19c79fb4e45a1c44c98c412", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626972797, "uuid": "b218629d-4b35-4852-abfe-6fd081b6d626", "comment": "Malware payload", "value": "4d564c98d4d3b355b2a9e4ff8ba476a6e3dfaf6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626972797, "uuid": "f42652d3-8790-43f8-b634-c46f81538001", "comment": "Malware payload", "value": "907b3c189df3ce5ba7ac4bf99cd696f66896d1fc3b7b67b928426f4adc713adce9ff8f418fbe5499370666cf07d51dd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626972797, "uuid": "27dcb495-bb20-4bc1-8d56-bf8e50c41cfd", "value": "T112E4F175633B9608DC3887F91C68D5B12B7AAC29661EC3381A94F1BC7CB3A7C5DD0291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626972797, "uuid": "4716a36c-4ca1-43fa-b449-a1b4d692138d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626972797, "uuid": "5ae4ec22-85a0-4f49-8a3e-ab7fa6afc04c", "value": "12288:KeMVe0b97kZkCP8s2EZ7oS4cl5nDdcI9FcyaUVKnp:KeMVeKYT0sFganhcADahp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626972797, "uuid": "46c32713-af48-42cc-a493-0c36d772fa2a", "value": 683520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626972797, "uuid": "e72b4071-5df0-413b-b23a-e61f306653f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626972797, "uuid": "78cc7a97-6e16-4808-af23-69f9f11b3ce7", "value": "Nueva orden de compra.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94dcf04f-eb0f-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626973771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973771, "uuid": "a63cd325-b777-43a2-a590-f9122e64d642", "comment": "Malware payload (Formbook)", "value": "6eb0b98b71b47226880cf66454012b21", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973771, "uuid": "a1bde810-6867-40aa-bf7e-5ee7167caa67", "comment": "Malware payload (Formbook)", "value": "712a54a86587b69b9520604ddc0f1257298b086cc96b526b5ee9e18a4daddb6d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973771, "uuid": "4553548e-0ceb-4bf2-a613-1b4df4431b08", "comment": "Malware payload (Formbook)", "value": "775fa55b338f7409f5f505e1e453177f02a5014c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973771, "uuid": "503cfc03-d345-4198-85fd-85b93e7af2cf", "comment": "Malware payload (Formbook)", "value": "c9a175e101d61019a15f36712301d98fa66465a9ae74368d5107064cc22addc6652970869e55eb050abb2848c7da9bdc", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973771, "uuid": "99f0f870-447c-47c3-aacc-3ca19d2c880c", "value": "T183552268B716B117C8B660F49262870E8EC6BE94528291E8F19E367F91F5C51DCCCB32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973771, "uuid": "d528afea-8df2-46b0-8b7f-928898df87a2", "value": "24576:c96VCFus/j11r+ScKudpifqPgmKiuIFxQIA2LPMTd9bW:c9eps/jXrwKqtgoUIA6KTW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626973771, "uuid": "279ce6dc-31ef-4e1e-a498-ccd5bae9796d", "value": 1345536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626973771, "uuid": "3f60e763-e2f1-4381-a672-92239520bcae", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973771, "uuid": "4776dcb4-634d-4b0b-9baa-1c933a8ca211", "value": "payment detail.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47af66c9-eb3f-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1626994258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994258, "uuid": "a36f99eb-808a-4e60-8b94-434c48819912", "comment": "Malware payload (BitRAT)", "value": "006adb31e9a6c5582b3760cfad78b41c", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994258, "uuid": "1243adfc-5c92-425e-9d8a-b922a97c5228", "comment": "Malware payload (BitRAT)", "value": "717d40408d8c3a45706ea14235cc579e21a112db9d0cb491ee300c7d9192f66b", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994258, "uuid": "b6e057b2-78b5-4fe0-9b98-d6dff25467d8", "comment": "Malware payload (BitRAT)", "value": "52ccba34f9b1a14005bb7573974a229bf160e9ba", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994258, "uuid": "f9614307-2087-4737-b755-432561f723e7", "comment": "Malware payload (BitRAT)", "value": "918d32b38527311e5f7520e43619c62d86608520a84b2f8629ffbea4b7c97ddaf98f371f32fbe54dd1517b30f7e2e50a", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626994258, "uuid": "86dd148e-8df3-4cc9-b257-41aec212991c", "value": "T171F50170A5F8DAD4C6987A38EC17B5F48A21ED52CE11AE1F3C807E053576B80FA7509E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626994258, "uuid": "bc0abcfc-7277-4d23-b1da-e221448c66b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626994258, "uuid": "8ed39775-990a-42f9-9985-7b356f29f4d3", "value": "49152:bDVm3D9SmGlHTb7H8h7UVg0wLEwDefn+9RRVfaqf:Pou2B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626994258, "uuid": "94d0b8b3-e9ed-4e64-a017-563c584aea4d", "value": 3448824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626994258, "uuid": "843944bc-6ac8-4990-8dbf-e110525a6670", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626994258, "uuid": "cf68f40f-c1da-497e-9a50-0cf47f3e11f0", "value": "OrderConfirmation23072021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d6bd504-eb44-11eb-875b-42010a9c0053", "comment": "Malware payload (Vjw0rm)", "timestamp": 1626996361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626996361, "uuid": "226dc3bb-dd55-4556-a9a5-bd37d1c028a1", "comment": "Malware payload (Vjw0rm)", "value": "1cbd83f1bf2a1b9644a771224fee3f6d", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626996361, "uuid": "5bf4bb67-6495-44ab-9027-58f6cd986573", "comment": "Malware payload (Vjw0rm)", "value": "71f139d6eb543057497ad49270cac90d1edbc0d6f0201e85e21ca0f05efb30bc", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626996361, "uuid": "ec93750e-ed45-4dbf-80b9-e160c020853a", "comment": "Malware payload (Vjw0rm)", "value": "1530b6e0a924738a8786065c55bf8f3089177bef", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626996361, "uuid": "381817b4-4bb1-49f0-bfa9-066f31b2b1a4", "comment": "Malware payload (Vjw0rm)", "value": "729acbd40cde445f84e310cbef0de526583711c97848741210d568b892c48727251ff3032a4bf62dc6534756ed1f9bde", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626996361, "uuid": "6cf45355-3a9c-41f3-b648-399b783e0f4f", "value": "T183D0A73989014C465A506DF51AEEE606F27251F600E0A834E647D89C135A85D8C39092", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626996361, "uuid": "9c092bc9-7bad-44d7-8b5f-f970a3a49b68", "value": "6:wSxWPNeFHTHHa6XX++tpP4rDJAbVhB8pQC:wqHTa6n++tkITTC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626996361, "uuid": "ca1aaed4-0dbb-4134-b4b0-0fef33634ee1", "value": 222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626996361, "uuid": "597542cf-19dc-406b-b3e6-da7d5bbfed1b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626996361, "uuid": "e7e5e64d-313d-4aee-8c1e-1ca9623e6a5b", "value": "N504152014.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed208627-eb3f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626994535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994535, "uuid": "85913d06-9650-4835-b802-2ff39dd62d0f", "comment": "Malware payload", "value": "95ec79022148ce78e8b8ccdc31630c70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994535, "uuid": "9c262b72-5f17-4fb9-a4cd-1755e01bab77", "comment": "Malware payload", "value": "728db54c974bc449df7a8e9b03d497fd18cc9c189006ac273c49272fb1f88033", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994535, "uuid": "a1a1ee47-8498-4237-b665-e51f3ffbd02c", "comment": "Malware payload", "value": "b2b3cd067758aacb38337a764ad4caacf8db44a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994535, "uuid": "f69b3f75-fd28-4760-ae75-f8aac6dbf71d", "comment": "Malware payload", "value": "0ec2c5d801b8e360fc6241befe2695006f6ebe4956d8be7b0985d79c949c00683b8aa2e9538a816756580533d87c6d54", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626994535, "uuid": "b1441674-604e-44b3-86ec-2307747aea28", "value": "T160B2F699B9D6CA06C9C15177FB0F829A3F255398F1EF33036F122F21668796A0F66144", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626994535, "uuid": "b6456194-70b7-4d02-88ac-ced9850a8752", "value": "384:m/BsO0RR3cpd2/PTpfAkL5w9x+B5Xhml9AhFx4eNw7Vs62SE:mplYcpk/PGKGwnmliSWw7QSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626994535, "uuid": "284b017d-125e-4e68-add9-3b11eff31c02", "value": 25576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626994535, "uuid": "f251fc96-f68e-4b60-84d9-ead7f4fb0cd0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626994535, "uuid": "a1ce747c-08e9-4138-846f-ce7987f7ced6", "value": "95ec79022148ce78e8b8ccdc31630c70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "248b994a-eaad-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626931492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931492, "uuid": "7eb12b44-e122-4f88-8833-5835c8eeb04d", "comment": "Malware payload (AgentTesla)", "value": "7d3a9e753d73e64f6593babb4a50f749", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931492, "uuid": "ab1bd721-e0c1-463a-8714-ac08377eb5fc", "comment": "Malware payload (AgentTesla)", "value": "72ae99647b3d5a4ea568cf9091544ca96bbab701e5e275e88b37eef3b98f51ce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931492, "uuid": "9ddc33d6-6f84-4f63-ba06-8d2142bbe2d3", "comment": "Malware payload (AgentTesla)", "value": "e9c69ad8c1441f149af0f2271b15c9589eef02bf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931492, "uuid": "b7c167f0-4b7d-460b-843b-3b2478771537", "comment": "Malware payload (AgentTesla)", "value": "f80974c4032bb518bb8bea5da51cfd2149b1c5d500c081aa07732d26998b28843361b94f24a517934b62b5f91ebfecaf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931492, "uuid": "4a5c9cd3-10bb-4b00-96a5-bb869b500fdd", "value": "T162C42318F7B6ACDEC03A9112261174F508E2D64B554BCC2C6CD2EAE5DBF86F5071B0BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931492, "uuid": "d0fcb2e5-8b65-4787-bfdd-02095ae48c91", "value": "12288:3VH1AcXs45yFLIUzJCenjnQEVM+ziEfcBlX4XDx80hT4c2yn19gTl:3VHvcWyRCejnxzrf2lIXN04Ul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626931492, "uuid": "aa0849b8-4478-4791-a692-40ab0df05044", "value": 587717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626931492, "uuid": "e03a119a-5047-415c-b430-ca27cbca708f", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931492, "uuid": "20e0d4f5-5fef-4840-a58a-994d518bcf91", "value": "PURCHASE ORDER-890003.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fe401af-eabf-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626939350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626939350, "uuid": "5538a010-2f19-493e-8641-bf09efeb4d65", "comment": "Malware payload", "value": "fb68f8be8c75736c63464b924ff7c33b", "object_relation": "md5", "Tag": [ { "name": "103.153.76.164", "colour": "#84DB86", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626939350, "uuid": "1db45bbb-fef4-42b6-a3ca-076a22e66b21", "comment": "Malware payload", "value": "730791498e622e20755f6b0100dd78dc66fd2e99f85aecf1d55626960c1260de", "object_relation": "sha256", "Tag": [ { "name": "103.153.76.164", "colour": "#84DB86", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626939350, "uuid": "2e996d48-0409-44dd-af2c-f76a95a6b6e6", "comment": "Malware payload", "value": "6546c3af939be5e2a2bce5c03a8d89ec562665f6", "object_relation": "sha1", "Tag": [ { "name": "103.153.76.164", "colour": "#84DB86", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626939350, "uuid": "fc6b9e0c-a796-4fc6-baff-7580e2b2b90b", "comment": "Malware payload", "value": "4f8de925bca3a2c684faee4da59c912302be1e13e37fc0f0c03b17d540b4cc82c23d4b6d85e95e9a979167d1189ce3d5", "object_relation": "sha3-384", "Tag": [ { "name": "103.153.76.164", "colour": "#84DB86", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626939350, "uuid": "1fb4deb4-4233-4b39-abf3-276202ed9f7d", "value": "T125839444B281E5AAD07A0E358DEAD2FE7734FD409D51832B3294732F2C7A6958F12AD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626939350, "uuid": "3e07004e-336f-4e55-84c5-49d12a1718f0", "value": "768:ZlUAnb0UJRy/BCrdWOyhypPVIt3AdgmHQm63e+qxuZcjo:Dty+8ypP3nHQrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626939350, "uuid": "e40fd865-8192-49bf-bf96-ae32dfeb7604", "value": 82944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626939350, "uuid": "04d9ba33-5d92-46af-af4d-ddd00a960aca", "value": "application/vnd.ms-powerpoint", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626939350, "uuid": "920aded0-4fc7-463d-8609-68ee8ef0a074", "value": "ORD.ppt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc392bc-eacb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626944713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944713, "uuid": "00d1ef47-d9c5-4efa-867b-ab966da8ef0d", "comment": "Malware payload (Mirai)", "value": "ec4637f5d716f29fd464b15e1c499a5a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944713, "uuid": "3f12ad62-da35-4ede-b668-0827d7c461bd", "comment": "Malware payload (Mirai)", "value": "737429af897437fc5315d8861d92502477a801bcd59526f10f30d78b96d88b0a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944713, "uuid": "ddc35849-deda-4725-a499-952446613bc1", "comment": "Malware payload (Mirai)", "value": "b02af8052352d60b686b3224192f132be747e331", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944713, "uuid": "f3e05b98-33a2-4dde-b547-274186216566", "comment": "Malware payload (Mirai)", "value": "b97e682584f2fbd4c7b0d63385d32a11fc7261547438b598439da8a33b66a30aefbd4a21e78d700cd239debae251b5b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626944713, "uuid": "4b216383-6123-4042-b576-04595a826f6a", "value": "T1E3D2E1016640FEE1D5B00632E9668A9BB2267D79D1D130FB863D0EFCE6E9A0D47F4943", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626944713, "uuid": "61533750-9ef7-4421-929a-4d9344f3f7b3", "value": "768:vusHfRavjynNKnjFcZIhQzhKMXgj9q3UEL7v:HRwynNIOQQ1KMwiL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626944713, "uuid": "8b765640-4f64-4c31-ae99-d7ce5abe442a", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626944713, "uuid": "4d824364-f5de-4a21-9b8c-7c4dc9183203", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626944713, "uuid": "34260f2b-2092-43ce-8fe5-202e3fd0aff3", "value": "ec4637f5d716f29fd464b15e1c499a5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "613ebc85-eafd-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626965954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965954, "uuid": "76324a70-5d6e-48f4-b727-0a492ede3729", "comment": "Malware payload (AgentTesla)", "value": "0353af1ae14e14bf804fb78a04ae8f42", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965954, "uuid": "7958bd24-0a1a-4c42-98f8-d154d969b8f8", "comment": "Malware payload (AgentTesla)", "value": "746073d0f2958ace46267fa4ed5badc249b7e3a55d76c2b230c0a8b457caf6a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965954, "uuid": "a0be059a-a8cf-4b7b-b708-e974e11f95d8", "comment": "Malware payload (AgentTesla)", "value": "250aa0d3f7b16d7ff122f8ad16febb9213074676", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965954, "uuid": "139fa6b7-09d8-4be6-8024-f2a78f92195c", "comment": "Malware payload (AgentTesla)", "value": "7e4489960e8d6e470a31cd5f36d7d64aef605d7de2d6499db79db063fc7fa5bfaf7d9915eeb8d69b6314b72fb3fce662", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965954, "uuid": "fd269b15-3698-4d20-ac7a-d8051f04796e", "value": "T1BF158D525DCF866EC2684DB69731AC5682314CBA2A48F3132EC175EDD93F2EDC89F502", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965954, "uuid": "7696dc2c-8b1c-469b-92b6-278b80655032", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965954, "uuid": "e2798e1f-8c12-4008-8a77-7da3e875efa7", "value": "12288:oKFMPOMK2WUP1bisWYHwDsiUwXXQk2Xa2JleDRk/ctY+SMPQipP5K:oK+qdIRtwYUX2K2JYDRuipw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626965954, "uuid": "469d0765-a0bb-41bc-b295-da9e6e0b806e", "value": 883712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626965954, "uuid": "c880bcc6-79e2-4dcf-80cd-3e0db00c9979", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965954, "uuid": "4058a7b8-35b1-422e-a324-0ff14cf61d62", "value": "payment receipt.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da3a4c6c-eaad-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626931797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931797, "uuid": "40b90269-f837-41f3-b5b0-4911c948eaf9", "comment": "Malware payload (Formbook)", "value": "fc6affa7cd16c60dc547d3417142dbe4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931797, "uuid": "c26f3c2a-fcc3-4be4-8bac-d5cf926e728c", "comment": "Malware payload (Formbook)", "value": "74895afae683396981f97ac9816f39ea4f0c0588355ea6e7696034aa1650d6f8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931797, "uuid": "23c0f4e6-70ff-4b94-a92b-c78e2d95b421", "comment": "Malware payload (Formbook)", "value": "c9b5c27ba5941bfe766400f81283f1f5305bb376", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931797, "uuid": "0bd75c09-a3f3-4b23-b32e-414446301be5", "comment": "Malware payload (Formbook)", "value": "a25001001bdcbf02e0e1204b844e6bb339a47073f5a100f4f004e1d4277752d4b908f7725e2ac437552a5c9ff343a043", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931797, "uuid": "f08426b7-a6d1-4167-8766-91e3d9ff54bf", "value": "T1B29423C764DB5985FFB5002AD8EFA992BC4E8F4FA3530EB1686478A490807B5F8D064D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931797, "uuid": "01a1c758-5e7b-4c87-9a8c-97745e65f14f", "value": "12288:j3lgxv9pe3vVwkclkk9JkDh49qHdDzdhnJCM:jqxG3vSkc99ODy4Hhzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626931797, "uuid": "bd2494e5-9daa-4f48-96c4-ed3a37809cad", "value": 443030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626931797, "uuid": "a5e38906-ec9f-4316-9605-aafc00037679", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931797, "uuid": "713a033c-d4be-4a90-a9e5-d79a2dbb4986", "value": "Inv_7623980.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60c1c61a-eb3c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626993011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626993011, "uuid": "41972267-b236-4556-85f1-78408a752782", "comment": "Malware payload", "value": "bc83231bbcee5eab5b337a7eb2e3ca8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626993011, "uuid": "db05765a-e324-41f5-a009-7dd392dfba3a", "comment": "Malware payload", "value": "74b7528c14d3fce44accbb5d32e5d057673c3832d065db1040db2959b78bfe26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626993011, "uuid": "577d31e0-7be4-428b-9689-05c31dafd8e7", "comment": "Malware payload", "value": "8797f8cfb9ae7b4ec4d0fcda2813af28c48dfa8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626993011, "uuid": "a34261fe-880e-48ae-a314-2930168cba3a", "comment": "Malware payload", "value": "8321613d4723834bcfeff1b2365e452f080052437c0f51bf039b98fa424fdf3247c99dc28367e38f5f0f5ce347882329", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626993011, "uuid": "bf4cf91b-e2ee-4fbe-a620-645d4e0a33de", "value": "T1FF84CA8A9A5CFFCEE3855270AC34F7188226FE591B230196EB3D70D9B734D82B466711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626993011, "uuid": "a740f158-b469-44c3-a503-26ea3b9ae630", "value": "f90b7dc70c9a59ead31f79c8625840b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626993011, "uuid": "7b4ab2c5-66e9-4fa6-8bd5-71d80faa6d2e", "value": "3072:5gr+bmwh1O7h83URpFuOutUVkadIsAU0R/auJ9sxj/J6SmBW94:5grNAqh57VkoIZRSuJ9ej/J6DI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626993011, "uuid": "f2da40f5-feab-4d71-8a52-85c0bd7f4e59", "value": 390656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626993011, "uuid": "7e918381-8007-4c59-a4ec-b3136aee1a86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626993011, "uuid": "512d6acf-4a79-453a-8744-43287ecf84ac", "value": "epochPvP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "732ff8fe-eaa1-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626926470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626926470, "uuid": "3a8ab067-8298-400c-a5ea-a56ad06b0ef7", "comment": "Malware payload (Mirai)", "value": "57822979a80cfad7183705b0e7e9d963", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626926470, "uuid": "ae435cc1-1ea2-41af-86fc-df1ff358df05", "comment": "Malware payload (Mirai)", "value": "768850e0af693264aa3425ae02f7eed977fe4ec42583d5232cc73a1a60c3aed1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626926470, "uuid": "d9c936f8-7f5a-467f-878d-fafa2d4bbcb3", "comment": "Malware payload (Mirai)", "value": "2a3bef800156fabf2b99a270650811ea693efad9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626926470, "uuid": "1c6ad722-9923-401a-86cf-0a0b4f3a348b", "comment": "Malware payload (Mirai)", "value": "700743ca00bc472144b82d7ba48dd51197bf072cf8ce75c80b24d752cff7326874f9447f16971036859847fc7ce9f7d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626926470, "uuid": "143d9e29-bde7-4687-b5de-291fcd667480", "value": "T140B20902B30E0947E1672EF1393F1FD0D76EEE9121D5E584795FEA868176E328282E4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626926470, "uuid": "1bc5f3f2-58f1-4f11-89df-2ff765bb0442", "value": "384:LSDVA8LD5D9u/yY/sXBiZE2hvWVxuxrsypq5AvFP/hyhJTcZ9EtUhK+6RfZ8c06i:gRk/6RiS2oMwygMHZKOhK9q1quXFOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626926470, "uuid": "97d89a94-3a3f-45e8-90bc-6203d3e24cf0", "value": 25676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626926470, "uuid": "fb424177-4ff5-4676-829b-1e317eac68e2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626926470, "uuid": "d13cd960-068f-4b53-9452-19f4ed274c0d", "value": "57822979a80cfad7183705b0e7e9d963", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4f24b6c-eb0d-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626973074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973074, "uuid": "6758341b-44c7-4b1e-9559-a5f9bab2a860", "comment": "Malware payload (Formbook)", "value": "88b8c238ca748c1b5c056364acac3336", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973074, "uuid": "0b7601c7-8f4a-44cb-85b3-79ca302061df", "comment": "Malware payload (Formbook)", "value": "769f5f59dbd758fbad94b0b7fb84afd003f87b00e5991a239ecd562c51ee991f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973074, "uuid": "e7397730-88c2-4af0-91b7-1fc01d69de3f", "comment": "Malware payload (Formbook)", "value": "cf99d9a1d8252b87797124561a08d35a4f254946", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973074, "uuid": "c526d353-7a56-4e25-bba8-55fe1b8efecb", "comment": "Malware payload (Formbook)", "value": "310b4c1cb2e801111bbd3ad56b1dc7bba5f66da01d1a638f61970e2177503c0c3067554b4f2cce6bfd21a6f3217389b2", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973074, "uuid": "9141ed50-8c60-4e05-ab9b-1af5774783b1", "value": "T137436EACC09702898F8A6BB8271B6F44058D366DF785A172767C93725BE2C7F512387C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973074, "uuid": "63915149-3236-4581-a5f8-e80f0f30e557", "value": "384:c6HpK6hz3zDTtEiU054oTWKsZX0kYB3cFB9TJ8PAE:rHpKGPbFksq3TJ8PL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626973074, "uuid": "043b8076-b11e-449a-8e18-5ce66f59621b", "value": 58998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626973074, "uuid": "bfb7ac13-1881-4332-ab11-988891fa8dc1", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973074, "uuid": "c0a56154-b65d-4f5b-940b-fd8a292d8978", "value": "Correct Bank details.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb29abc6-eac2-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626940764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940764, "uuid": "1668abf4-8766-4792-9275-72622ea7a88d", "comment": "Malware payload (RedLineStealer)", "value": "70d34f5f6c1eb08f1dcc534a2c3eea81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940764, "uuid": "4d5d1887-34dd-4332-bfb5-4f69653efad1", "comment": "Malware payload (RedLineStealer)", "value": "76acd8a497e85765a133bdd3c90cb26d257f029c45d73c52b4effc06f94a2555", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940764, "uuid": "606fc3dc-83d5-4b6d-a277-e772626bab08", "comment": "Malware payload (RedLineStealer)", "value": "94bc98926077108bdd80856ff10c31bb159adebe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940764, "uuid": "0d1597d6-3069-4efa-b0d5-2c16dc0681a5", "comment": "Malware payload (RedLineStealer)", "value": "7efeafc57bee61e497ae62fc65388086ba965ef6039d5ae155fbc9a7c0f127caa606fdc3ca43cd44fb3e4b8d04b42d34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940764, "uuid": "a64ec7cc-6286-42fd-9147-fc3c4956ac16", "value": "T15C26125BF22D22A8C988C734616E7DA4B1F11F6B6E5BC47A59E534ED96302D18332F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940764, "uuid": "18c3ed40-8df3-43d4-884f-e47a9338699b", "value": "d0760fbb86d99642aa02fd69bdd04b4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940764, "uuid": "15c7b26a-f04e-46df-b6bf-924e4aa94d9a", "value": "98304:413o5r1n9e41MXiMcM7+n10w6U6YJeD6P6tiC:ia19e41AFlUfJ/RC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626940764, "uuid": "7136f57f-295f-477f-9009-be0e64b3c7cc", "value": 4611240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626940764, "uuid": "d6eb0967-7be1-428b-9afc-ad720ea7e0db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940764, "uuid": "56700bdf-ecc7-46a3-9976-1cab1f6201aa", "value": "70d34f5f6c1eb08f1dcc534a2c3eea81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8ff9142-eaf3-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626961860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961860, "uuid": "33f02507-2f22-4546-b944-7024060604a6", "comment": "Malware payload (RaccoonStealer)", "value": "9fc04fb382f60a70816945197ab1d4c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961860, "uuid": "fcf3fbcb-3c5b-4719-b043-305465a9ea33", "comment": "Malware payload (RaccoonStealer)", "value": "779dfdc196d5a63adb4e8b7ba1b2b65ed8e52eaea518a1dfd735a69c3b109046", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961860, "uuid": "1377ff65-3049-46f9-818f-7c2a5f4ec5d7", "comment": "Malware payload (RaccoonStealer)", "value": "af4c9450b9726ef9b7e9319a3b333cc9ec5472cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961860, "uuid": "df2d21ff-9b93-4f7d-b06b-cc0bf7b19e38", "comment": "Malware payload (RaccoonStealer)", "value": "e18eb217b8fa78ab90c323129393ad71696f5eda3cd87d8eeedd3c077fd12588ef36aec5488769643f5daf0bc790bdc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626961860, "uuid": "5c0f2e3a-f118-4bbc-81d2-86055fbecd8e", "value": "T17BB40150FA80D872D354453658E3C2A826BEBC616E2D45073B587BDF6E703C2A6BE347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626961860, "uuid": "5d104a87-e09f-4764-bf97-6c07b84dbfaf", "value": "7780eb9cc098185992365509d7637fd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626961860, "uuid": "81aa95c6-427c-4541-a38a-89a38bab1a5a", "value": "12288:3iuu8e+0ewXPIMaLR5iJuIlvhTyXLhm2ld:ZuV+paPIMaLR5MdfyXLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626961860, "uuid": "e546967c-fb73-492a-9944-5d9cdf468524", "value": 518144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626961860, "uuid": "35b0aa44-a1d1-4683-813c-4ba89918c464", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626961860, "uuid": "ad59f9e8-89c4-4ffc-9300-f7972e5d373e", "value": "9fc04fb382f60a70816945197ab1d4c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "977fe592-ea8c-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626917512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626917512, "uuid": "3269854a-7039-4581-8669-e38dcecb7521", "comment": "Malware payload (Mirai)", "value": "3da12cbd05a08f721bb1caba11f357b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626917512, "uuid": "138ca5ed-0400-44c3-8166-88996bb9db17", "comment": "Malware payload (Mirai)", "value": "79265ddefffb6857737e8727642a24516e4a77b5fe3b3f46a7c5e9665b45f6f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626917512, "uuid": "f8f7f049-9042-4550-b9f7-7b8799ac5daf", "comment": "Malware payload (Mirai)", "value": "d7c391ddcd2e3b489c26ce946d5ba17dc832978e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626917512, "uuid": "83b9b67c-e2cf-4afb-9095-42505b83ecf6", "comment": "Malware payload (Mirai)", "value": "a0f3e14f755af65f7f220824c8a89572af43bb2bafaa91d011545ed7de524eac0a273c9797fa92a788090b381596c086", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626917512, "uuid": "ca6d30cf-b72e-4a7a-82d9-42ab76f58e7f", "value": "T167E20813371D5B27C46B6EF029F767B093A2BD211AA7A184E11EBDC48336AF03615F64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626917512, "uuid": "5703ada8-46ee-463a-923e-7fe8062ac6aa", "value": "768:0dhvdF9m1tpIuAQu9pB0M2vSsM5ZgWXepG8bQ:0dhlF43pI3QubB0MLs4Z7OpG8bQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626917512, "uuid": "36d23acb-68e6-496d-870f-2ceb3b74aaf4", "value": 34117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626917512, "uuid": "a852fb6e-b827-4af4-8ae9-5f50f485ac1f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626917512, "uuid": "edf653ef-1808-45fa-8eb9-447d37242823", "value": "3da12cbd05a08f721bb1caba11f357b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac31f99-ea97-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626922188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626922188, "uuid": "88ce6d7e-34be-42ca-b1f1-60bf6128d849", "comment": "Malware payload (AgentTesla)", "value": "c8bbdf9e3b59abed712d50939b1aba06", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626922188, "uuid": "94b33aaa-8715-4489-a2f7-34118a6dd09d", "comment": "Malware payload (AgentTesla)", "value": "7a97d4b8f134c45154aedab0230867952cc203fd283dca4700258edc86efb1e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626922188, "uuid": "1c3b405b-b6c8-48a7-b2fe-13c64edceb26", "comment": "Malware payload (AgentTesla)", "value": "d15a034d62161837581791b7fbf696259f0dceeb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626922188, "uuid": "98832e62-1317-45c0-bfd6-65c6098c8b2f", "comment": "Malware payload (AgentTesla)", "value": "03ee12bab203ff093200c1424521b1c28af04c21e77d128a6c1a2689300243ee904a7b1ddead34d3cca67a9902b72cfd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626922188, "uuid": "0884c2e8-cb0a-441d-8286-a465afd70ef8", "value": "T151A402D47AE9EF02E158D1304D34E13ED7200CB8581F8561FBE9ADAF7AB47A62C49742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626922188, "uuid": "79867058-50da-4184-9116-01d83ce13efc", "value": "ad7593902351b94d30c5d42690419916", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626922188, "uuid": "a634e398-c95a-49dd-8891-3a0a1a98f7f3", "value": "12288:DZRGlUQwpaASLWpGpymAypll1JnwgMnAhApgIF/A:1RGaQwpaAsYIlZmAhAG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626922188, "uuid": "28601ea7-3b3c-4439-9b41-fdd44c77c743", "value": 478194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626922188, "uuid": "e3fa0770-3bff-4538-9595-f9c2d58029af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626922188, "uuid": "ce32f1cc-f77e-4fa5-b652-12b90d8c1603", "value": "f026ae3a33ea7c54bcff959e9bdd2e60.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4df5afbd-eab3-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626934139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626934139, "uuid": "d2cf7d8a-d3e9-4ecf-b51c-b94ae536d984", "comment": "Malware payload (Formbook)", "value": "e3e0623e2680c0a2d7d42ae5476eee8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626934139, "uuid": "9e2917b7-e207-45e1-87ec-4c0fb176886b", "comment": "Malware payload (Formbook)", "value": "7b8353f603a3cbc9e87b5845409c451fc624d6757cdb93255e5fa4bec5737b21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626934139, "uuid": "d5b0e30c-b254-470a-ac66-be323a3cb960", "comment": "Malware payload (Formbook)", "value": "55ada3a7fc22ab1fafc47fefac6a8be8a741a7b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626934139, "uuid": "fe4741a1-a244-4dcf-aa22-3788dd576268", "comment": "Malware payload (Formbook)", "value": "b829ae2c7fe4ffb061589981b60d23dfaa27398347997cccb870c7e4adb25a54845e108bd22be64b54fafd63053be4ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626934139, "uuid": "c04166c0-ed42-4006-b89b-2c61482d207c", "value": "T10405CFED67DB4644EF3573FFFCD5E02123F6A41E421ACA24EE45D06CA8B36A805E1512", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626934139, "uuid": "2f687373-a29d-4920-863b-49585eee8dac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626934139, "uuid": "b11c46ba-66d4-41f1-ab2e-e28b720a055f", "value": "24576:/l0XsLXznvDq6I++PG0ORUT4IMTT1HzahpU06J:q0ar4UT4IMT1OJ6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626934139, "uuid": "16b6cf27-7c3b-42d8-812c-662f46db5bca", "value": 840704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626934139, "uuid": "1bdbea65-fe60-4b6f-9910-37718be46c0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626934139, "uuid": "d9c1d95d-c39b-412e-aae3-92d6372baa72", "value": "Order Signed PEARLTECH contract and PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "370a2d13-eb2c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626986069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626986069, "uuid": "71189c59-0fd9-4b6c-98f7-d43376c11f38", "comment": "Malware payload", "value": "045611f23661df79542bbe7bed6f1ba8", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626986069, "uuid": "e814d42e-469e-415a-bd98-9bc14643ab10", "comment": "Malware payload", "value": "7cb3b37d1b4447e9840d8416f0aecaa2124859f914770f2376415787b92434ac", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626986069, "uuid": "4e613269-aa75-450f-88e0-383189bc3ffa", "comment": "Malware payload", "value": "cc9f01e37ca7060c0f1b3db0db25cb67b6beb018", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626986069, "uuid": "be73608f-13fe-4fdc-8a6f-bf3e5c6abe67", "comment": "Malware payload", "value": "e969f21c83984ea760e02f9694abc7d80b81f02b46e85cefacecd3d86f70ba472eb959a74facf0f977fb939afc34937f", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626986069, "uuid": "f6afefb5-27bc-4ad9-9c91-472c0c1afbee", "value": "T1FAB6332EC153CA0FF95D46783D9B07E1D6879526B084B6597A3C4FEE934B8E017822EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626986069, "uuid": "b6fff2d6-942c-4fc4-ba6a-0d1ceedf9849", "value": "196608:j5aXBv5hTrJuGFmgTEZ/Ln6OUis7LTXoILvzZfZ:jgVJZF1uGOUiAHXoILlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626986069, "uuid": "d1e70ed7-08c9-45ef-982e-bd44709f7efc", "value": 10485672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626986069, "uuid": "aba5fe93-5ee0-4195-8fea-cfb7e4a2dc06", "value": "application/pdf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626986069, "uuid": "d269fd8a-31a4-4dab-9fd5-266b871c6119", "value": "7cb3b37d1b4447e9840d8416f0aecaa2124859f914770f2376415787b92434ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1725826-eb44-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626996636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626996636, "uuid": "2bbfe33a-767c-419e-9843-344dceeb7e16", "comment": "Malware payload (RedLineStealer)", "value": "7e03737d683bc19280a5dc25befc85b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626996636, "uuid": "24f88ac3-efad-425d-96da-ea99574d19c2", "comment": "Malware payload (RedLineStealer)", "value": "7d307d58ea8702aa1600cb785125936c0c6643f8e892b789d633105ba246c449", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626996636, "uuid": "44c65ab7-e76f-4c81-933a-29c96b926529", "comment": "Malware payload (RedLineStealer)", "value": "c6718f0a136b082720c7bebfda479ec882033a5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626996636, "uuid": "5903a3b1-6f04-40ad-8acd-39f3cb229a4d", "comment": "Malware payload (RedLineStealer)", "value": "8c638b64081fe912a17f6a004b482032c36eb5da698112b6e98487684fcf1d5da4fa37cf3e8166d9b17ce0231b5376ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626996636, "uuid": "cf17f320-622e-4abb-bd63-7aed317de79d", "value": "T1800633C3F7E084B7E556483498856BFBF0F8E35E2D654C533B40960E8FA84E59025AEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626996636, "uuid": "25fc373b-9276-46c9-bac0-785e6244cde9", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626996636, "uuid": "748c02a2-d5b9-4dbb-b8c9-db381fb51774", "value": "98304:xNri7ixZUvFyPg3i7wcewXFqVZ1PXsgA2CvLUBsKkNFpamK:xNuWx+oPoi7wxwKZ1PzA/LUCKeXamK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626996636, "uuid": "87133513-57e1-490c-ad1a-99ae1ed37af1", "value": 3912781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626996636, "uuid": "b546ffcf-63cc-4179-b25b-c4f326dc7c37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626996636, "uuid": "aa76612f-a084-415b-9db1-7e756889dcf5", "value": "7E03737D683BC19280A5DC25BEFC85B6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94fba8e0-eaee-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626959598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626959598, "uuid": "9baf4b93-5981-4669-89b0-47e50c0a8572", "comment": "Malware payload (Loki)", "value": "422e50c25edd184233d2b19609cb1e05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626959598, "uuid": "0708f070-ea1b-4ee2-a094-8ff5bc52c35f", "comment": "Malware payload (Loki)", "value": "7e0c5eb5f18d5313c39c806aeb2ee42b3ca22661c6c1aa2eb0fbead3948f6e26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626959598, "uuid": "d6ac26cb-c251-4371-b8f1-fec49eafe8a9", "comment": "Malware payload (Loki)", "value": "1473792dc61dffd6db83cc02ead2ce0641acba59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626959598, "uuid": "eab22405-b75c-4901-b887-5461631c10fe", "comment": "Malware payload (Loki)", "value": "b0d38f0527a7412e8850c36db712c5b80ea54abfff394a1ad86541ae12cdfc06bd3871b78dc58d5f7e57586f68f21ebc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626959598, "uuid": "b7e7fee3-99b3-4545-95ec-6175079104ef", "value": "T1C6C3CF3ADA5C9F15E732EEB0484AA037D01515706D2F0692BBDE95B0F16CFE89F40B92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626959598, "uuid": "f71bee1a-4c31-4295-b936-a6d5df6ed123", "value": "ad7593902351b94d30c5d42690419916", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626959598, "uuid": "3f0ff9ef-704a-48dc-8485-774031406313", "value": "3072:lchVVVkt2oxTPENDu7RcCUlHfEjXnrs28eDxn4:lc7VGtJTPENqFcCUfEjXrJ5Dx4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626959598, "uuid": "890b5fcb-73a9-4de3-b5e3-69db39032010", "value": 119344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626959598, "uuid": "6901103c-a857-4de0-bad0-07ef57dc5512", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626959598, "uuid": "310a8de1-33a7-4c11-b9f1-2bc324666d3b", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b7f3b1c-eb42-11eb-875b-42010a9c0053", "comment": "Malware payload (NetWire)", "timestamp": 1626995445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626995445, "uuid": "8e8c8dc2-f831-43f9-abfc-be0ef15f5d33", "comment": "Malware payload (NetWire)", "value": "5413d7925b6e67e27e6ffdab67974dbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626995445, "uuid": "81e53b64-4820-4c6b-b47d-5f0eb11d9fef", "comment": "Malware payload (NetWire)", "value": "7e12867c3e8353fc4175b559bbf654ccce1b253204fd7c5c0e2a72b56026ca32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626995445, "uuid": "da2df326-c67d-47db-8085-24405f0615ac", "comment": "Malware payload (NetWire)", "value": "72250774c05d90f827cd3e9a85a0d5b7b4e3b791", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626995445, "uuid": "905264d8-78ab-4a53-acf5-40182397bd9e", "comment": "Malware payload (NetWire)", "value": "027eb5e939a6b00b8860ae001116b91e126160a8791a4ea2adc6b142c32203389f46394c86921d69e19d768871201199", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626995445, "uuid": "694b7122-81ea-4926-be6e-a86be550b51d", "value": "T1AD049D2075C1C5B3C8B7513044E5CB3A9E7930214B6A95E7B7AC1BBA6F213D1A3362CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626995445, "uuid": "a87dd9ac-f337-4cd9-8e75-a7601060f1fe", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626995445, "uuid": "ec56a59b-4ba2-421f-b8d2-437c6f43a72e", "value": "3072:5DKW1LgppLRHMY0TBfJvjcTp5XmfMtCRTgCohP9Wo/:5DKW1Lgbdl0TBBvjc/mfMtCIV9Wg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626995445, "uuid": "4adc98eb-8ee0-473d-bc89-cd72d61b5a32", "value": 188080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626995445, "uuid": "ac510e3d-70f7-454d-a720-753c3406d08a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626995445, "uuid": "8f5abb4b-61c6-45b8-9a3e-ee3c18ed745a", "value": "5413D7925B6E67E27E6FFDAB67974DBF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d16f8d95-eabe-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1626939084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626939084, "uuid": "a8cb2171-b161-4d58-952a-541f3782c538", "comment": "Malware payload (NanoCore)", "value": "ce32e8605adb6c9bb2dcee69fe887b46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626939084, "uuid": "65afcaa3-bfea-4a8b-a710-e5abc3c5417a", "comment": "Malware payload (NanoCore)", "value": "7e22f7f21e8798805234be7ac26bad65c1edecb55b051343e0933a68041ce073", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626939084, "uuid": "a58db7c5-1553-43d7-b81e-4de6e75a9966", "comment": "Malware payload (NanoCore)", "value": "2ace1fb1e3523768003b61a4a79193214ffafed9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626939084, "uuid": "4277e701-35f8-496d-9492-3b8fb5bd0328", "comment": "Malware payload (NanoCore)", "value": "d68077a1895e350d88a1ad2f0b18cc10a024857e25e317bf3abbf2c90d28226efce7a900085eb7809c95b4643fc3bd1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626939084, "uuid": "2a382bbc-6e75-4a50-9a92-3e583381e64c", "value": "T166C423320F14EF76C77F8131896716546F633E9B9D26F3DEA0893E983AA5710870A217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626939084, "uuid": "0d9465a8-6334-46fc-a941-92c5129ed47e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626939084, "uuid": "07f1bd2e-22a5-48cf-a497-9008e3d94cec", "value": "12288:UyVRMbXAPtBXomNFYmujpihOcn92JRVkxdGOcA1WJIq:UyVRxPtB3Cjpihvn+VkxIE1c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626939084, "uuid": "05ba2cbe-28d5-4e00-a806-84a13d101efd", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626939084, "uuid": "967a3864-c8be-45ea-b119-80fc7b37f48a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626939084, "uuid": "104220d9-d1ac-4199-9b29-feb36e53f168", "value": "Paidcheck.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4132db13-eb1f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626980503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626980503, "uuid": "44ba67a1-f0cd-4a87-b20b-d31a826451e5", "comment": "Malware payload", "value": "d717336a68084bab00e17d251f456624", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626980503, "uuid": "9f075ba0-4426-4966-9779-57775e386504", "comment": "Malware payload", "value": "7ff2489ffd5a0d62c6971afe0c7fb3ee56d2eba1b6d8cb3536f7f12e16287e09", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626980503, "uuid": "ec24bd8c-1d6d-4d23-be03-096229e3ac92", "comment": "Malware payload", "value": "ddd8c6f140df106d01cb13b8fe31f210f4ca5366", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626980503, "uuid": "f0bb2ee2-6ac0-4367-abc2-f17297d7f7f3", "comment": "Malware payload", "value": "15030d1299de0dd0e7a000af5d8a48b1776d1049f6054fe1e965491749985480097b365489e90e8caa94b70b705f85fc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626980503, "uuid": "cf902a7c-c90c-4ad8-b1de-fce33016ebe3", "value": "T1836402ABD9777C8FEE0B4FF021A70E4E1AF9D6C6D2C658907255048439FD346A2607C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626980503, "uuid": "6b460eae-ef27-4c7c-be4c-e55492f6a068", "value": "3072:/TNVO/QJHZcfFj4rwLQGTNO5VZLwHm7vuQTpZUyY6co:7O/QJHZweEL/NOjCHm7FZZnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626980503, "uuid": "1174d1e5-fbd6-45b8-aa14-f2fd6f554623", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626980503, "uuid": "fc071927-de03-4851-b96a-56d4e3b73077", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626980503, "uuid": "be8820f5-e633-4046-b1f5-d9805cc6f4f2", "value": "Mozi.a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd3126f-eb17-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626977273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626977273, "uuid": "6a57395b-4dbf-42d0-ad2f-07d9e04f70cb", "comment": "Malware payload", "value": "f961d6f3eb82bc072a1c85287efb2ed4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626977273, "uuid": "b74cb949-22b0-41f9-89d3-ef87af793306", "comment": "Malware payload", "value": "7ff8da221f76a27a09d3cf6be17e7f40cf74c98fc8513ec8dc5d72ee34e75a5e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626977273, "uuid": "62e71bb2-b609-400d-9dfe-469e361c936a", "comment": "Malware payload", "value": "9596e4f1c443ea4ea028f3f377dccad8e8132fe9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626977273, "uuid": "f5c4c799-f474-4925-8e0b-39d2f801ad69", "comment": "Malware payload", "value": "958b15051cdaaf40571f5cc4ccd2e37991ac81659418b789ca5a1c3b4cceff31cdcdfd81721dbcbe0e403cded3fc85f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626977273, "uuid": "4ceb4af7-ca39-4393-b665-0f5f207463d4", "value": "T12CE4E074631FA704DC3887FD1C58D05167FAA02E925DDA383F9890BC7CB2BB896E0656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626977273, "uuid": "c1590ba4-7787-4c19-9fe7-6e7a2c39ed8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626977273, "uuid": "41b48d02-5020-4e45-86ec-75cbe52331a8", "value": "12288:ksFjetET2Py0fgOHoLKixS2jzkT8XNSaPZPXkqVGqO87kiWR5m6nZW9syaUVKnp:ksFXi604pLKiNjzkTsNScpkqcq7HWRLx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626977273, "uuid": "200a829c-96ef-4a88-bdf4-2a3176a78e79", "value": 718336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626977273, "uuid": "c6bc6469-3399-4726-ad0d-991603a14c28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626977273, "uuid": "cd3aebba-3c78-43a7-9fe1-4d7a8d796549", "value": "f961d6f3eb82bc072a1c85287efb2ed4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "541011d4-eb03-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1626968509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968509, "uuid": "97e36c77-77c9-464e-a680-cdb7df480655", "comment": "Malware payload (AZORult)", "value": "5d751931eb3477f5e7d340606b381db2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968509, "uuid": "3bedd664-1eb2-4eb8-92e6-2b999627cda7", "comment": "Malware payload (AZORult)", "value": "8085b13eb5097f9107ef826115461f4ff755b81c5ec97b3378f2325d06651d2c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968509, "uuid": "bd1d0408-502a-4b5d-a760-c8a7bb3a5ef1", "comment": "Malware payload (AZORult)", "value": "011c86381eabf328aa69260b0812ae534d950101", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968509, "uuid": "3f69d68f-3145-41a3-8314-a9b433d9ae5a", "comment": "Malware payload (AZORult)", "value": "74232e37e27cdda58821ee3d096e4f9d677a5f516fb58d3fe473ce07d41a1a0b6fbb71f25114a2c45ce9c8c80112b657", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968509, "uuid": "091afec9-18dc-484f-9197-e31e26c6d198", "value": "T13705C0343223EA45DF7883B68CDAD2340BFD7C666A59C72A3DA4B2BC79327781991045", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968509, "uuid": "e0ff7122-f826-40f9-9f48-b68c02b4e050", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968509, "uuid": "70ad11eb-322e-48c5-800a-b48ca3d7f702", "value": "12288:WZK78nDROi0Q0zyYI0ArobtQ/WXDhVgoDpKjbACMevXTAb0RZiLsyaUVKnpgMjva:4KIDA4Yv4GQ/AgI9wM2gzahp7vLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626968509, "uuid": "4f3bb46c-4011-4d4f-81d3-46c655f4b2d0", "value": 859648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626968509, "uuid": "479eb708-5c28-415b-9cb7-42af483b9eda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968509, "uuid": "1c28ca41-02d0-4086-98d2-d7afee9a3656", "value": "5d751931eb3477f5e7d340606b381db2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c745331-eb10-11eb-875b-42010a9c0053", "comment": "Malware payload (TeamBot)", "timestamp": 1626973999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973999, "uuid": "13e4a962-c926-49dd-8c4e-10e2d002bc07", "comment": "Malware payload (TeamBot)", "value": "e481024a7f235afb0aa19d58cb390226", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973999, "uuid": "e8fe29f3-cab5-4fe6-8da2-5f7bd6788732", "comment": "Malware payload (TeamBot)", "value": "8149ba1f710102ff2383263c9f80d5a7c06352ee3a24d1a7beb9d702dd423ec5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973999, "uuid": "d5e3ae66-9fc0-461d-ab55-f9fb1953065b", "comment": "Malware payload (TeamBot)", "value": "72e6253d78f53e123dd3f99a5d2aee225ad470c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973999, "uuid": "b60cc4df-e0b8-4def-8c10-f8c85d12145d", "comment": "Malware payload (TeamBot)", "value": "d36128e028c9a1c1d984f746016a6835e7768093d8e173d8c715c131f6eb0955c2916242d31714335f731a1582de3578", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973999, "uuid": "9835a5e2-17fd-464c-8eea-5cc4effa9c5f", "value": "T1AEF4125176C2ED72D2D14A3184DB83B42BBEFC2666AD498B664037DF7E30291527E312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973999, "uuid": "2aa22243-6d8a-4f67-a000-304f276db3f8", "value": "7780eb9cc098185992365509d7637fd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973999, "uuid": "d0cd499d-5c8e-469d-87f8-8c278da5f5e5", "value": "12288:jUyakPzwWyrEqc9tfIFLcwsKfAzfDqD9YW//g4ME2eORogvr56e62yhULhm2ld:wyjsJ76t6sJtW3F4KgvrDyqLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626973999, "uuid": "53a220e3-8f23-41aa-a5de-b5b9c7561ce8", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626973999, "uuid": "b43edb86-2b19-4bd2-b185-d1877074af2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973999, "uuid": "411271a0-7620-47bf-a95b-33baae1868f5", "value": "e481024a7f235afb0aa19d58cb390226.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a829b0-eab2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626933821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626933821, "uuid": "03c51dca-c08b-4868-b6f6-5fe7151fce5a", "comment": "Malware payload", "value": "446bb242f43d6471fdd62075b1b22c15", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626933821, "uuid": "8a6eb59d-3f06-4871-bbcd-d3d0bfd3c792", "comment": "Malware payload", "value": "8171c443ede092e743b346ef8cb64dd6c2e1d8e7d16b0531ceb94637e523cafa", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626933821, "uuid": "9b9cc9f2-71e5-49a4-8ea5-93de267974c8", "comment": "Malware payload", "value": "dcc3611d6afcdd6b0b5af04e2cb1b7adecb06db2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626933821, "uuid": "e6f6955a-4f8b-456d-ae02-4d596528c5a2", "comment": "Malware payload", "value": "b312dc8320ad5f58e6247fe83f228b8feaed6fdde125ba25c69f51b04929948381ad1b0dbc0b36bad7f89f3b7ae832eb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626933821, "uuid": "3c05fa69-1319-4dd8-ac9d-d8c5e90a548f", "value": "T1CAD31322D3130C4FC02579FA7A2BE62A39873E6A24CE449C45F5D66A2FB7084ED71753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626933821, "uuid": "9145833d-6ed9-4d2e-bb93-40a94dd40f14", "value": "3072:bHMYFJvw6Yh0b1gKobtCGCmCRlrisfrYm:gYFJvwe1gKCYVl2szN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626933821, "uuid": "f2eef5f6-b0bb-4417-9135-d217fc64169e", "value": 137480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626933821, "uuid": "543b7fed-1006-4aa7-a328-04b5c13a9206", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626933821, "uuid": "a588ed28-d756-4811-acaa-64177912875b", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e051a705-eaad-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626931807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931807, "uuid": "74e66bf7-d85f-434e-b82e-8d3d35132c8f", "comment": "Malware payload (Formbook)", "value": "ac0aafad021d642a83f0e0e00f925160", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931807, "uuid": "485cd507-010c-4745-8327-99f72bc89331", "comment": "Malware payload (Formbook)", "value": "81cbdffd1b44ca983180456d058b8eaadf51adbd19600dbbde68be7a4ef09a54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931807, "uuid": "1b8457ec-53a0-46cd-9d26-528cd1de581e", "comment": "Malware payload (Formbook)", "value": "9a225f4936ef458a3371e7681f942b7733d8eb25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931807, "uuid": "2945aff5-298f-4e83-a0bc-efd0fdffdabc", "comment": "Malware payload (Formbook)", "value": "f525015a9928d7c8ec5b657705cf6ad23c7a0a04d20eedcfc98d5979c8650e7818056cd2998a0d8c7012d852e888b9d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931807, "uuid": "36195306-bf1d-4908-b5dd-c2efc7fdde2c", "value": "T15C25383439FA501AB173EFAA8BE475AADA6FB7333B07645D109103864723A41DEC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931807, "uuid": "b671a3ef-ba00-44f9-8833-9bc2e33a96ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931807, "uuid": "2febf573-2069-44fe-8221-dc385c379583", "value": "12288:l6F7UAVmIVSV371+vgUWoJ8TDfPOAYxx4PpK6dXPrKyxmu9bzNr5na8+WXsL2O7G:LS83hLISE/MQylMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626931807, "uuid": "4b5177f5-fdf1-4b3c-b063-38eda55f087d", "value": 980480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626931807, "uuid": "bffa8c40-7879-461f-a317-7eb61865222a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931807, "uuid": "076d5c9e-6275-459e-b153-aebe7e9e7d2c", "value": "Inv_7623980.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd3cb9c1-eb1e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626980282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626980282, "uuid": "8a6987c0-a8dd-4a73-abae-7dae99827063", "comment": "Malware payload", "value": "5465a0e8d59fbea5dec1bec2409da6b4", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626980282, "uuid": "48be5f2d-f736-4fcd-b50d-e05e1d3efaef", "comment": "Malware payload", "value": "825ef88dad5d42b78658ca8587f057f8047004800e5eb7513bc408d9937549b1", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626980282, "uuid": "ef97ff46-c674-487d-a4a9-0d6e928016ec", "comment": "Malware payload", "value": "6415dfe0ee5cdaa5e6319c9a3bc11e56455346dc", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626980282, "uuid": "95fc364a-55d8-498a-a748-5e0a0cfae722", "comment": "Malware payload", "value": "abc260f703c82a7061d16015ee367b413f3843975195a1531229beca774a3f6e09fddb00674a087074ad6e4da667d1ff", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626980282, "uuid": "6f6100ea-fbb7-4387-aeb1-79f6a7f8b59d", "value": "T18E258D2076DAC536E57E05B02A2CD75E406D7EB00BB998EB63C85E6F09F09C24635F27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626980282, "uuid": "47b744c9-d9b4-4aa4-87f4-176a737235c5", "value": "24576:knaBqnGIQ5M6DLrVVdWG859GCHrSoUzLyaVtFUl:kn8lrXVVdWX59GUrSLzeaVtFU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626980282, "uuid": "f8136e5b-042b-45a8-8c44-3b60fc5997a6", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626980282, "uuid": "e5bad4e6-e8ed-4e5b-8e69-d80116c0e8d7", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626980282, "uuid": "e36ae404-cdd9-4d87-9600-c6ef12b6cf01", "value": "5465a0e8d59fbea5dec1bec2409da6b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4cafd3f-eb05-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626969584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626969584, "uuid": "58e7301c-6e81-42fc-af47-2baac8d29026", "comment": "Malware payload (AgentTesla)", "value": "9ae3b1aa2c80f4e12e33569d7b5839df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626969584, "uuid": "1357d69a-e3ac-4f48-8d72-3f0de974d266", "comment": "Malware payload (AgentTesla)", "value": "82737660638921bf4d3e82bf4c059ec3cb0b61bd988365572bd4207b87ceb060", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626969584, "uuid": "d1a996a8-972f-45e2-958c-d93e629a6863", "comment": "Malware payload (AgentTesla)", "value": "8579f018a10f93cedbb73369fb8c7b66416d9846", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626969584, "uuid": "3a9a2f8e-6651-4437-b1a3-eef50a861fca", "comment": "Malware payload (AgentTesla)", "value": "3b3218ae8427f5ab54f3a490b234a81faefcb0fb9572107212f9a87b81d14ade563d67a3f0109fcf9a62aa73c8b6a296", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626969584, "uuid": "0cf95979-9826-4c4e-948e-806571cea48c", "value": "T1F545122CD1F68FAAE43965778321430190664C89D95BE5CFA52CF7E85E36D80BBE183C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626969584, "uuid": "eb783e4c-365d-4442-902a-67e2295aace4", "value": "24576:oi5w8rke62kK0gdD6kAM41j3qU87qnaF9YEof0lm1BTY29zn1nclKd:oCwi62kK0gZ6D1jDA9YIl+NT1Dd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626969584, "uuid": "47fe3721-bf93-4783-afab-f432cef92755", "value": 1227776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626969584, "uuid": "a46c4d21-d53d-4536-8810-81ea49cf3ba6", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626969584, "uuid": "dca6dc4f-cdc8-451d-91e3-976aba13c9eb", "value": "FACTURA 3879843.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09623381-ea98-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626922427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626922427, "uuid": "731e3538-bfee-4535-adc9-c66add0e3e03", "comment": "Malware payload", "value": "94db1e23daf9e5793523befb3159640d", "object_relation": "md5", "Tag": [ { "name": "PythonMalBot", "colour": "#43E2EB", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626922427, "uuid": "29d57b01-1c58-40f1-97cb-be5b7fc51f7d", "comment": "Malware payload", "value": "82c4e7b016ff5dbdc35992f34714073bd931245099c0dde9aa544cda47c117cf", "object_relation": "sha256", "Tag": [ { "name": "PythonMalBot", "colour": "#43E2EB", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626922427, "uuid": "ecde0c11-3e0a-4d14-b253-93e609dfc022", "comment": "Malware payload", "value": "94a710a20d62a494f06c4da5b2076d30776c2cf5", "object_relation": "sha1", "Tag": [ { "name": "PythonMalBot", "colour": "#43E2EB", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626922427, "uuid": "dffd9a1e-432f-40ac-8396-3ce2e948040d", "comment": "Malware payload", "value": "fa3cc1990c615b1967fca2325fa95b68131ee907ac98169309c5e17cf735192b80992b03487189ff7fc0554cd0e75e63", "object_relation": "sha3-384", "Tag": [ { "name": "PythonMalBot", "colour": "#43E2EB", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626922427, "uuid": "dc5437c9-70c2-40ba-9ddd-2085ec92bca8", "value": "T1CB7132A14C26483A0577E54BB472F866F338675769123363FB9C62789F7C006EA20F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626922427, "uuid": "b8b09512-154b-4493-81c5-cdce08d8d3fd", "value": "48:KzRVwQra07q+XLgXmqYAgJY2wi0zjQPCd7WevR0swHkinD0ztspxcWbhM:iRVwQra05X8vg662joCc3z2tecl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626922427, "uuid": "12beb30b-e15c-4ef6-a3df-5115f71462bb", "value": 3581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626922427, "uuid": "067f1fb5-dbc4-4b2c-a91f-700936d12659", "value": "text/x-script.python", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626922427, "uuid": "bfe3e9f6-0b35-4e42-86fa-a7e6d2d4b1c0", "value": "6pL7pZQf.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c917a461-eab4-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626934775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626934775, "uuid": "64f19c7f-ae09-4923-a08f-a02417b43ac6", "comment": "Malware payload (RaccoonStealer)", "value": "b719cba1a8c6e43a6f106a57b04962e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626934775, "uuid": "29dfc618-ddb1-4f36-a05e-3e7973496640", "comment": "Malware payload (RaccoonStealer)", "value": "82d440b0f4ab1630e2e2cfe49a04ea383657ef055b33fb86db7aaa8131e2933b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626934775, "uuid": "0d2c78ba-ec35-4fc1-8fc6-404a25e0fee6", "comment": "Malware payload (RaccoonStealer)", "value": "80363428f99500ca7da13ad4ff5b07a97627507f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626934775, "uuid": "74ff660b-b973-43ea-8ee3-f765e1505b5c", "comment": "Malware payload (RaccoonStealer)", "value": "1219c9bd0c899a2419eecfbec522b414ec6f6654f226fa3c92c4c044257339d5e6394c8764416744234459027082d35e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626934775, "uuid": "dbd0a83b-d45e-424a-8085-19ba4ab45bd2", "value": "T110652346FBD2E9FED0EB26B45D44A9B959B96F380F000D871B851A0FECF62815137A07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626934775, "uuid": "c4354329-bc51-47ec-a2ef-066862567527", "value": "a011f8d93026fd9f5e9442faeeff606d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626934775, "uuid": "c2c4f3d3-1503-4448-96b9-b6d6cdcafa5e", "value": "24576:R7WlojQhPB1wjR2wgkIvSgO6S9ZuGT0fJ3jddMEe8CdULSMmvuPz6Z:JgqF224S75if9xdJevULSnvgc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626934775, "uuid": "618899d3-08d4-408a-b0b7-12f94b2ce8cc", "value": 1445404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626934775, "uuid": "a8ae4c84-2758-4c9e-b74e-2c882a034abe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626934775, "uuid": "d9e4a3b4-d497-40c5-9207-20d65e7bf058", "value": "b719cba1a8c6e43a6f106a57b04962e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca3b2a1b-ea92-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626920174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626920174, "uuid": "757ca581-65f9-4492-b6ae-4692c56fe473", "comment": "Malware payload (RedLineStealer)", "value": "921a229a73147a43676207d9e0dc39dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626920174, "uuid": "3193ab9c-2480-483e-8e7d-40e3bf4ee1d6", "comment": "Malware payload (RedLineStealer)", "value": "82f6a605e4fda71d67a7f5a6a98fc2db5a9243f8521dd40e85acf89239156971", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626920174, "uuid": "4df3eb4b-001d-4d01-b091-74573f231f6d", "comment": "Malware payload (RedLineStealer)", "value": "c216d76ba1d80ddbe4613b10bdef18c968cfabf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626920174, "uuid": "415e52d6-c241-4c3b-97d7-ef2c3e647b21", "comment": "Malware payload (RedLineStealer)", "value": "4e95437dd79c3dbb10dfeb01acce6b4caae4a7fdb151d675961a616392b136dcc4b2dca0e102b5995e5c5e3bb32b1ba4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626920174, "uuid": "224c324c-540b-4e34-8127-020641f8f89b", "value": "T15DF49D332A5A8DCAC3B2B97C0684F37555D88B993C1BA3A201B75523F606C4F2D9ECD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626920174, "uuid": "b00c0d65-6917-468a-89f9-567a446a4ee9", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626920174, "uuid": "14e3d733-d6e0-4627-93b3-2c40c49d75d1", "value": "12288:P0EL2oFuYxOHmiGOn4dTXJmdfO/0csY8S:XL2oFugOGiqLJmdk0csYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626920174, "uuid": "de20df00-6f44-4286-9c01-07ce11b50b4f", "value": 732877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626920174, "uuid": "604f80cf-566a-4f3c-a6e6-83bcafaf705e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626920174, "uuid": "593d8841-707a-4f83-92c6-32d98b45b686", "value": "921A229A73147A43676207D9E0DC39DD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31658f8a-eaf2-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1626961149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961149, "uuid": "5f6763a8-4d60-4d54-9bd4-49d78cb8616e", "comment": "Malware payload (Gafgyt)", "value": "0cd231f2f61705eab123b78aef97321c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961149, "uuid": "b9c4f96f-76f2-4877-95b4-50e248898206", "comment": "Malware payload (Gafgyt)", "value": "83b1383f9c599f6409cde37bad5fcca5a55dad0af652e3c18b37330912d18e05", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961149, "uuid": "0e8cd630-fef2-44da-b751-5548766f3c6d", "comment": "Malware payload (Gafgyt)", "value": "018f521e1fd7430f800e7d04d53ef41aa063dc5e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961149, "uuid": "047ced56-643f-4d46-b793-8589fa60e664", "comment": "Malware payload (Gafgyt)", "value": "3a462e3c529a01c6b888a20ff4d42534be5140943d796e31659277da7fdfd5bf23443539d0a754bade06ff0f8f56b5b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626961149, "uuid": "f21ad0bf-4453-46a4-971e-d94290901710", "value": "T129A3F896F800DFB7F40AE67604D34B24B670BBE14E532622731739A6AE762D53823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626961149, "uuid": "c2679797-f08e-42d8-8e92-ad7580b04bf4", "value": "3072:Vgdr2vIBAxMyAOLRcft7hOemuxVqDr78fz1e:Vgdr2vIRyAYclhOemuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626961149, "uuid": "d4073901-4980-467f-a961-83a01052c548", "value": 98919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626961149, "uuid": "bdc2816e-2165-4036-820d-06cdddf7ccb7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626961149, "uuid": "2abdcc3f-1b72-431d-a93a-25880206f7d2", "value": "0cd231f2f61705eab123b78aef97321c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaf5a231-eadd-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626952441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626952441, "uuid": "7958067e-fd12-4c47-b59e-90dddd002b4e", "comment": "Malware payload (RedLineStealer)", "value": "69dd97850f63fac1927313fb9983ab58", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626952441, "uuid": "ac752d4d-6381-40d8-9f6c-fd8477a4f960", "comment": "Malware payload (RedLineStealer)", "value": "84904a91de28f8aff1863d9831dddea0110e94761287579926e843b1b4046608", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626952441, "uuid": "022e2685-8bd2-4022-94c9-b4c13854670e", "comment": "Malware payload (RedLineStealer)", "value": "6b8bca9b8e5e8b32f198c37c08358533bb73a16e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626952441, "uuid": "1f8edb67-2ef1-4786-9ce0-c5ab9f36b586", "comment": "Malware payload (RedLineStealer)", "value": "72036e6a913d186f06ee06b3df63897d43df8c3555a726a2813ea0f4b6f171358d5be99a5ef88c9a1afd48bfcfba9807", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626952441, "uuid": "d03c6ad9-33c9-42e7-a5fb-612eae205178", "value": "T1C145E5535AC1D652CD693AFB8E77923C92E2C3DD0223E616D92F53F32D127286A1E5C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626952441, "uuid": "7c525d5a-379e-4929-9910-8c3fb8be6bb7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626952441, "uuid": "2c731dec-71ea-42f4-b09c-064294951310", "value": "12288:w3plS2a1uVYW0iWmYt+OSnBwukkmXmg+LvrY24+6CCdtUjmq0/3LOiVo/mRzLk2:w3lTWpjnvm5vYrdSUCmouzA2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626952441, "uuid": "38d12344-a21a-4d1f-9183-da8b00f9182a", "value": 1194808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626952441, "uuid": "22b07083-4974-4b2b-8a7b-4fb2f4e86965", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626952441, "uuid": "98cdb989-add2-4a6d-833d-d3eaf5f280d6", "value": "69dd97850f63fac1927313fb9983ab58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afcb0d65-eb0f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626973817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973817, "uuid": "b6373623-d444-4a9e-aef2-0fdb1ef186fa", "comment": "Malware payload (AgentTesla)", "value": "8df4b43e11c352b502cea6a13e220468", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973817, "uuid": "3fd78035-9fe8-4787-9140-8e6a79911ee8", "comment": "Malware payload (AgentTesla)", "value": "86324507b99eaddd23e1c94340269fc33d8a9cf64c6df71822d4b0cf59078535", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973817, "uuid": "a7207c0f-8fb3-4499-8ac2-718b5c18a01c", "comment": "Malware payload (AgentTesla)", "value": "e8e6745a74fec6d5ea7c0ae5fce8e775689cacef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973817, "uuid": "24f52848-2344-478b-a4bd-552b8409d29b", "comment": "Malware payload (AgentTesla)", "value": "8967c0739faa7478a2589259204c45527b64f6ca1887bb9d9e55041575c079e4176fc3e07051696a426e7935d1b39d5d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973817, "uuid": "b694dfcd-657f-4405-b8b9-76b30ef11970", "value": "T1F405DFD47D91B94EC51E4E7A79A21C3C9A336DBA0A46E3832C87F6DD493E7858903343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973817, "uuid": "ee25585b-f739-4869-a85b-13062db48481", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973817, "uuid": "8268eb1f-9a9f-4b86-9a26-2677eec944a0", "value": "12288:DZCZtWqRwvYwkt+YASFPE3pRPjutfLRIvIIqkPtOlIecN5SvZ+f6q:NCZ2qtrz83nPjYfLRIvIIqkPtoIJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626973817, "uuid": "1196fbcd-3f0b-4e8f-8415-5c665289c825", "value": 874496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626973817, "uuid": "cec7201f-6100-4462-b1e8-f8d92016e7ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973817, "uuid": "6b9246ae-2cb4-4625-99e1-c3e1ee389e55", "value": "FCL ABONOF2201.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bafa9a03-eb0f-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1626973835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973835, "uuid": "ab48dfc7-ff3f-4cc7-a7b4-7277377cb088", "comment": "Malware payload (AveMariaRAT)", "value": "0fcc784f9400be0d78104a0043ee4479", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973835, "uuid": "7f8cbfc4-6f45-4b49-8e2f-63f5887c45eb", "comment": "Malware payload (AveMariaRAT)", "value": "864b531c5f5a397b3fd2a8aa91c83f956d93300db9c986bfa7ae4744d7cb732f", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973835, "uuid": "1c78e959-fdcd-422c-af04-aa9abdc1f20e", "comment": "Malware payload (AveMariaRAT)", "value": "65cac3bdb71487d6e14480ade6397347289e047b", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973835, "uuid": "5e1cc547-6b5f-42de-b97f-9f9077cb03c7", "comment": "Malware payload (AveMariaRAT)", "value": "c9d80c9605ca1758a189cb01444a5c838ac3aa245c9b9e8573dba5ff67af0dbafe8574aa07fa71b5be3899eaddddb72b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973835, "uuid": "8461183f-51a6-4f13-84a3-e02b1d145a73", "value": "T14F25AF23B1814873D65316BC9E9B57B89937FD016EA435467BF83C4C8F7A2A23835287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973835, "uuid": "83b55c79-e3e8-483e-8a89-4ca7d09e3b0d", "value": "2c32ac23e13b112e3e03fd714ff79b1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973835, "uuid": "6449089d-e8f4-4816-819c-4088768eeb92", "value": "12288:a1SrPE0bpFJ1P3JOV4NijdKqyfdIJWV4Ko1Mv/OW5d5QQRSsx7/Ssdpk6dzsSU4:a1AT1VP4Dd2dcuSImW5fVSI764zsSU4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626973835, "uuid": "03ae088e-7fb3-41e4-aa61-c408b5349290", "value": 1005570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626973835, "uuid": "d5333780-7c8b-47c3-a335-3e352b25f6df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973835, "uuid": "2ca28ab1-f6da-4838-876c-1fc34007275d", "value": "Documento de envio.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8a137c8-eaae-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626932197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626932197, "uuid": "43bdd51b-8d8d-48ed-9da8-78078662608f", "comment": "Malware payload (Formbook)", "value": "6633c63dfbe9126b630fab6db6ef845f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626932197, "uuid": "80374529-c7f7-4041-83b9-8f36991ced69", "comment": "Malware payload (Formbook)", "value": "86b93054415c6e4c21fd68ad13fcdbbd9a300c275dfe4f768ffd2fdf42db4694", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626932197, "uuid": "8cb58457-1ddd-461a-9a89-61ab659ec7fa", "comment": "Malware payload (Formbook)", "value": "9649c26901a9d0b28393f979df51203bc90ab861", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626932197, "uuid": "30acf00a-6753-47ee-8fed-d84fc515abda", "comment": "Malware payload (Formbook)", "value": "9dc6c011040d46ed52908e10827808abf4f6c76f0f90f4eb933d6a41c7db35947f292269c25d2351d8d5b1dbe3f7f37e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626932197, "uuid": "b3d5fcba-a71f-4c7d-b68c-8cd3d293b8f2", "value": "T15A159D524DCF865EC2680EB65731AC5682315DAA2A49F3132EC135EDD93F3EDC89F602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626932197, "uuid": "6466d4f1-0c74-4209-9839-b7258a8f6931", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626932197, "uuid": "c0b182f8-445c-4678-9c88-05793cca7c7f", "value": "12288:wiZpwiNX30pvXpFw8Ky3O9C5zDpeSQzuhK2ULIISMPQipP5K:wiZCiNX32PftWGle1yipw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626932197, "uuid": "de1b601e-b577-43b8-b093-c07cfe510f46", "value": 907776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626932197, "uuid": "4b74d653-6794-4eaa-9a4a-c0e5b7c176e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626932197, "uuid": "00ec7519-37b1-457a-9474-8ca2e3b8ac2f", "value": "Payment_invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7bfd14f-eacb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626944705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944705, "uuid": "5cc1335d-548e-481b-a8f2-be0ab44a5a62", "comment": "Malware payload (Mirai)", "value": "1a11fb2e59573ff9c8461a5998496ec4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944705, "uuid": "31a5f785-1d5b-45b3-950e-9214cc273d4a", "comment": "Malware payload (Mirai)", "value": "874f3a399fb4a6a3c99f86f6417c388b254e206f5bef96fb3b33bc38cac020dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944705, "uuid": "4dfdf338-2b15-4f26-8c74-8e4ec7d47f99", "comment": "Malware payload (Mirai)", "value": "0ac1b218948da361997a3dbf43859cedf732bc88", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944705, "uuid": "3f3d537f-cf65-445b-9e70-e901162c3af4", "comment": "Malware payload (Mirai)", "value": "57c9b76e6e82513600d6f3457506e81e16ca205aaab2dd1dc3194d845103d3b6d6360c73412c46c0f6af33b022e96c02", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626944705, "uuid": "de5ee894-abd6-423c-b911-552bd2055199", "value": "T19CC2D0DFB4867585CC1C5CBC25DC5AD116A9A2C7234B8F0837202DCDA57645EF8AC8B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626944705, "uuid": "b9f137f1-8af8-4302-b448-5165804fe0af", "value": "768:w9CUFskb2JgIs/E2+OocrfJiHNjfmQ2q7IoqdB7fPWc:GCrJgHiOJrfwmQrctt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626944705, "uuid": "e95d5a18-0dda-43be-8c8c-203de22b472c", "value": 27236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626944705, "uuid": "981875ef-0afa-4794-836c-ed41f3ecd876", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626944705, "uuid": "d2cd9026-b392-4a0b-94c1-b16c02e13528", "value": "1a11fb2e59573ff9c8461a5998496ec4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31b97561-eae3-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1626954707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626954707, "uuid": "a175f790-db1f-417f-8c9d-a002deee0c73", "comment": "Malware payload (CobaltStrike)", "value": "8d92d0894c3af0058365264f87117f93", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Trade By International ApS", "colour": "#BC5640", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626954707, "uuid": "c9c61a58-1bee-433a-88a4-2e5d1cbd986b", "comment": "Malware payload (CobaltStrike)", "value": "87766b03bd60f023941fc02d8dc5c292136bc5e6e0805cac765929f45e61b90d", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Trade By International ApS", "colour": "#BC5640", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626954707, "uuid": "1cc321ee-9163-44f1-b7ea-3868d259aada", "comment": "Malware payload (CobaltStrike)", "value": "7461ee6f37a82d477fed0b2ccf422b40b931d81f", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Trade By International ApS", "colour": "#BC5640", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626954707, "uuid": "60fd66f5-624f-4ca2-93ee-6a81bdf97830", "comment": "Malware payload (CobaltStrike)", "value": "683eb7dcf59500f4eee99ab0492f6073baada79281748509e33629c885589c907e37828f38b033ecaa7cebf498cb7e4d", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Trade By International ApS", "colour": "#BC5640", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626954707, "uuid": "b9e5e325-fe67-4521-aa3e-0f4b2b0bc5db", "value": "T152A502127AC3C433CB73153188A8D5B14A2CBE750F7059DB33D8793E6EB55D18A36A2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626954707, "uuid": "6b35d9cc-9ded-4de4-a59e-dd1399da332d", "value": "87ba5c765556c15c4fa34fdc382b5665", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626954707, "uuid": "5e8b567f-c170-446c-92f6-74def8fa6e22", "value": "49152:8/m0CdnJyfOvfFIUMNmH46Xt1aasU7Zh9d7yqXA779mwo1:bhJyWDL2MPpXXwm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626954707, "uuid": "1e240156-7427-4bad-9b8e-4974a1eac8b2", "value": 2193880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626954707, "uuid": "d57d7b00-adf5-4027-bbe1-e187eebbb213", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626954707, "uuid": "7ea5d744-cf61-4ef5-9eea-f7ab4b9c8c12", "value": "87766b03bd60f023941fc02d8dc5c292136bc5e6e0805cac765929f45e61b90d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bd58c99-eac3-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1626941034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626941034, "uuid": "23e3f9d0-da3a-4389-9f12-94bdb4c0c201", "comment": "Malware payload (Smoke Loader)", "value": "30e58538e3ddab70cc1edda521bfbba6", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626941034, "uuid": "03eeb5b4-b958-4a2d-8522-56eff9a71fd3", "comment": "Malware payload (Smoke Loader)", "value": "879f63c384febbffc5845be57df9c7ef33234b584f8059a38a3f4aafa2bc37e9", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626941034, "uuid": "3cfec768-8469-412b-9aff-caa0d57252f8", "comment": "Malware payload (Smoke Loader)", "value": "862591b95d16216f74b6b197de4f4740a881ccb8", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626941034, "uuid": "5288361b-6ee5-4654-9ff7-b4cbf8496d50", "comment": "Malware payload (Smoke Loader)", "value": "2f3fa36bf1954ab732bfb48a0bda8849676fc5d61806528804ff5838c64140a20cf02b068f2cd838be16f39ef3f404ac", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626941034, "uuid": "5c1a82a9-8690-4a6a-9a50-7ebbf75a6862", "value": "T1DE34CF107680DCB2D3A5083108E7C7D467BEBC266E6C5A4377847BCF6E712E1A26E346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626941034, "uuid": "c5344e87-7a4c-4ffc-abc2-45a95676adba", "value": "010b99662693ba25ba201961c31754d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626941034, "uuid": "be3f8275-616b-485a-8c95-99be472dd3f8", "value": "3072:rS6AnxjNvYS4k6a79LzQEaKoGV4rLJDwXO3DlRsQj+MFzwbEu4HGszssldPu0bL:+3hpYXa79LzQZLyXSDlrFzBnmytldWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626941034, "uuid": "59e1fa15-69a4-4b7d-9b20-bf0801821aac", "value": 239104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626941034, "uuid": "704852e2-556c-44b7-9741-35dd701a4551", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626941034, "uuid": "d3c15c66-501c-4112-bf99-4767c9c71335", "value": "30e58538e3ddab70cc1edda521bfbba6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c19c18a-eaed-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1626959154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626959154, "uuid": "6b3fba81-44f4-43cf-bf50-2d464ea0dab1", "comment": "Malware payload (AsyncRAT)", "value": "2312324f5776b722b0d2242d6de074da", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626959154, "uuid": "f3324150-ca01-45ce-8deb-04597a504dc3", "comment": "Malware payload (AsyncRAT)", "value": "87b7b68ed10c1e85866fc17772627f0577d6f6e578ee8a36a0fb598e46c78cd0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626959154, "uuid": "5b7205c7-e90f-4dbc-84dc-027b65128bd6", "comment": "Malware payload (AsyncRAT)", "value": "eda8399ccbe8d2fe85c45070c323cc820c3f7f7b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626959154, "uuid": "33f554c2-a90c-487c-aadd-9318c3de6cc1", "comment": "Malware payload (AsyncRAT)", "value": "a018ae7b531f1a979c342e8b59fb8a05ce38a32a71bae883ba6d10e8173f40055ed1dfcb37053cdfd6a18f235768c5ec", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626959154, "uuid": "dfefc3cc-72df-4f73-ad59-0378fdc3fe1b", "value": "T11CC4D074632FA704EC7887FD1C59D05127FEA01EA32DD6782E9890BC7CB2ABC56E0651", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626959154, "uuid": "5801d0a3-1dae-4313-8f39-2b0db88aa477", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626959154, "uuid": "936f2acd-4518-4ec7-a5a9-dbde9c7d0339", "value": "12288:XgKBSp1G61dJQutZBHCy3cobesyaUVKnp:XgK4DGMdJQuDYkxezahp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626959154, "uuid": "5a138fe5-96e9-40a1-8891-f1346067bcd7", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626959154, "uuid": "8cf8d3a5-401a-43a8-8db5-794cd5e95810", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626959154, "uuid": "9497f3ee-ea82-463e-936a-192a2dc0d367", "value": "Bank Copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56915987-eb3f-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626994283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994283, "uuid": "4b1577bc-244b-4e8c-9a06-88269afe2d41", "comment": "Malware payload (Mirai)", "value": "97ccb261ba7241ffa696b5eeb5e44a38", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994283, "uuid": "b41ff83c-4bbb-44ba-996c-69019a6fda63", "comment": "Malware payload (Mirai)", "value": "87c2dd28dd2cc1f3f7a99565063f6ff65e97c131f75719c517ad3495be9744e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994283, "uuid": "30714774-1e8a-4ec3-a7ef-5d271af8d757", "comment": "Malware payload (Mirai)", "value": "e109aa2d5403b560383298a591e60a01ad0c9c74", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994283, "uuid": "73cb3606-fabd-4f76-acd9-829d5033c2d6", "comment": "Malware payload (Mirai)", "value": "ec9896751f436489d8973b8d2c9a5ef24f9c3cce0fdc84957af37061c3df45adb1dd5d19b6a06ac523203e5f47da8a02", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626994283, "uuid": "0be668ed-ba8a-4d53-882e-9055054f106d", "value": "T147636DD5B500DEBCF95BDABA41224E09F92132009F630F2BE677FC972D630958E1AD46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626994283, "uuid": "225a7766-bde5-4f76-bc35-3f374d41f075", "value": "1536:RCtITHBUV0DWWFcS5ND2n2R+nkbrj2efFVmrcRUzWg+o0pxGNC/8cV/J:RKV0yWFH5ND2n2R+c2edxWJiGcp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626994283, "uuid": "837e0acb-72db-4576-adfa-7685bac09401", "value": 73008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626994283, "uuid": "3974dc8f-0daf-47f4-a6da-9db8eb473bb9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626994283, "uuid": "c2e39a23-7dbe-461e-a841-e07209e4510a", "value": "97ccb261ba7241ffa696b5eeb5e44a38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7f315b3-eaa7-11eb-875b-42010a9c0053", "comment": "Malware payload (QuasarRAT)", "timestamp": 1626929189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626929189, "uuid": "1bd029cb-c723-4ac0-b02c-3c4ae7aae5e2", "comment": "Malware payload (QuasarRAT)", "value": "02c664aa0793ffb1d10eca08921bc77f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626929189, "uuid": "58e6a232-05ec-40e6-bbce-6da23ac4db85", "comment": "Malware payload (QuasarRAT)", "value": "885c0ee469749be09f9d9290f84338bf2f637c8c15a7a363240f9d2f09522e93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626929189, "uuid": "fcc236bf-33c7-4d04-81f9-b7be7dc5f164", "comment": "Malware payload (QuasarRAT)", "value": "5c3bed4bed72373b10ead3a492e6a6f2e150e248", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626929189, "uuid": "198592ac-0038-4e90-9af9-a9791e5ce17d", "comment": "Malware payload (QuasarRAT)", "value": "a7768e721a50b8f38a919e37090412ba6003343f8ca1f650e3363369b0986ba27424a7ed695d5efa143039924f00ab21", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626929189, "uuid": "eb597bfd-6fcc-40d0-9da7-82c84e339fe8", "value": "T1A6B47C4027E8852BE2AF177AECB15811ABF5F417B267EB8F4544A0EC2C66706CD41773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626929189, "uuid": "1dbbc328-5e6b-4e10-8bb2-9e94916c7c72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626929189, "uuid": "dcb2371b-8c95-482f-9613-8670077550b0", "value": "6144:pTEgdc0YaXAGbgiIN2RSBzaGbTzycB9C/pCqDTjT2rpYo+GmcELc8b8F9cSy7Fs5:pTEgdfYQbg/aaqc8pJTEYbonG74cde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626929189, "uuid": "f7b7c805-e633-4a9e-a696-e8b73783356d", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626929189, "uuid": "8c238575-61f3-47d4-a44a-15ae574be93e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626929189, "uuid": "1f27641f-4f86-4a47-a7dd-5d13d4fad67e", "value": "02c664aa0793ffb1d10eca08921bc77f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a93e98-eb0c-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1626972407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626972407, "uuid": "8a1fa16e-5820-487a-8c18-aafe0bb4b7a1", "comment": "Malware payload (Smoke Loader)", "value": "73ae94305fb5385273a5abd14eaafbb1", "object_relation": "md5", "Tag": [ { "name": "DESKTOP-group", "colour": "#6DA2CC", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626972407, "uuid": "9e4a90b6-dcf9-4cde-a493-dea7db691860", "comment": "Malware payload (Smoke Loader)", "value": "8a5dd62e6987af211ba50f210c4c2acaaab6582a84fbaa9bb44e8a6230e69c34", "object_relation": "sha256", "Tag": [ { "name": "DESKTOP-group", "colour": "#6DA2CC", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626972407, "uuid": "630bb650-3e3f-4485-915f-d61a6229561e", "comment": "Malware payload (Smoke Loader)", "value": "c3ad08e39cf46e6e66a64f2dd4900c3405510682", "object_relation": "sha1", "Tag": [ { "name": "DESKTOP-group", "colour": "#6DA2CC", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626972407, "uuid": "93ac8c6f-cf36-460b-b717-7b189d419ab3", "comment": "Malware payload (Smoke Loader)", "value": "a293a149422fabd66326457d61f9876ac22a484fff9823d21d4588620f9ed9ff0b268259e0a45161e1311e2e75d737e4", "object_relation": "sha3-384", "Tag": [ { "name": "DESKTOP-group", "colour": "#6DA2CC", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626972407, "uuid": "dc8ce8f2-2730-43d2-9254-2e99985d1e0d", "value": "T1BAE493B404C908A5E3D7C0817EAEFDA011B6F5DBCDE68D6413BCD2720979B66BE43909", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626972407, "uuid": "7684421f-2034-4631-9919-40ab2e5eb947", "value": "6144:6DKcAjaAsLxRtKyw5k0qBOzmmpB6Fe3CtWPOPZOaeWOx1JW:kKKrkfwMFUefP1WN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626972407, "uuid": "c48c04eb-fe17-44f9-b843-3c16fe4d5123", "value": 666521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626972407, "uuid": "b37d524e-71d0-4d9c-a902-ae9da4c45caa", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626972407, "uuid": "3251ee0c-f64f-4f6b-b966-02feb1ead82d", "value": "Postal Financial Services.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37e57efd-eaf7-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626963308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626963308, "uuid": "9f4c270a-f1ad-440a-ba4b-7b95022561d7", "comment": "Malware payload (RedLineStealer)", "value": "ab5eae79062ddedb6715c265dddd9044", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626963308, "uuid": "53e99135-8546-4878-bb41-cb8c23300fcc", "comment": "Malware payload (RedLineStealer)", "value": "8a87cc9fab38ab661ed147f2b39b85582e9ee7671006780f528d6fddb377f75f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626963308, "uuid": "2198f499-c9b8-4e9a-b431-2b3aae3258dc", "comment": "Malware payload (RedLineStealer)", "value": "254a9f7bd992f0e2dd1c33dc03db60050402df84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626963308, "uuid": "cb386ca4-9f48-4ff9-b40c-545398c7f22a", "comment": "Malware payload (RedLineStealer)", "value": "7bb19e226d81f8631e3f7b171edc5b8880bfef5d221a7c4c3a92bb78a366a0ec8c9fedd8e9e5e27812ec98de89077832", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626963308, "uuid": "7bff2020-8b41-4bae-af4b-756e4d3b3c95", "value": "T18AC4014363F84076E4B5A37559F206C34632BD929B7A83CF134B9D4E1D23AE0A635727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626963308, "uuid": "a7f18c6c-c106-43c6-a811-48f2978a4908", "value": "013c74198fc6e42dcf33737d6c40c012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626963308, "uuid": "4274340f-bd27-4f48-a800-125e85139f91", "value": "12288:yy90lrQXkq6cjjzVvCyP1jaytb/LV0+FlqN3m37k:yyZkqbjXVKydjaytTL20ask", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626963308, "uuid": "f22421b1-fa07-48dd-98f8-18e1a7a932ca", "value": 564224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626963308, "uuid": "0fc513ee-078e-4c4b-afe8-b079209c9b64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626963308, "uuid": "3677fbff-a8da-42d0-a27e-ce933528e659", "value": "ab5eae79062ddedb6715c265dddd9044.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7021fd2f-eaa1-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626926465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626926465, "uuid": "0d60b075-5b83-43b0-9ba9-d9ef9e0b1ad5", "comment": "Malware payload (Mirai)", "value": "00db9f988d5127486b5130cc8615cca0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626926465, "uuid": "2ed2903d-9b41-47a0-913d-34885de7a85a", "comment": "Malware payload (Mirai)", "value": "8b17e008a332ecc24d7521027c15106b0eb79bb856e9b6990ef1e18b8f56f598", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626926465, "uuid": "edf3419b-3f2b-4641-9d0f-458a3bfa5a2f", "comment": "Malware payload (Mirai)", "value": "37da9f4f6c6d3db2a02b943fa7880201928b23b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626926465, "uuid": "dbc8f5b0-99c7-4128-9336-9a92ec957fbc", "comment": "Malware payload (Mirai)", "value": "9b53707b253aebbea7fa9da3e0da9b32aae22a5d21daf22c1f904237c02bf6159a262a1379dc436709cd2807ea667e89", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626926465, "uuid": "3060f469-e360-46b3-9349-c41a395d2171", "value": "T17A03074AB9C19B05C5D112BAFE0E124E7313576CE3DFB3225E246B25678797B0F3A805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626926465, "uuid": "15bcdfdd-d531-4b40-8a73-885570157276", "value": "768:sgnWKAAplS39TBKuPgWh7Vw+iifdk+sRoke4YVfm6mhDOe/:sgnWupUKE57DiiFkXRok0eJO+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626926465, "uuid": "af10e227-ff81-4b5b-8ae9-dcaad31c2bc8", "value": 38248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626926465, "uuid": "86f1df49-679c-4973-823b-f2885a72ada4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626926465, "uuid": "ab2dc4d5-1fba-4b89-91d6-6ac30785fa29", "value": "00db9f988d5127486b5130cc8615cca0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee95a142-eb03-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626968768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968768, "uuid": "78b8be6a-d6b3-4f68-96a2-71ccd0ad4ce0", "comment": "Malware payload (AgentTesla)", "value": "29e9ad8d44e49d2a2fa76ab14d6881cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968768, "uuid": "6ee8662d-3d6a-449a-aa93-a26904c0263b", "comment": "Malware payload (AgentTesla)", "value": "8bf2c9097f211f15879c233eacd3c5b6e767d768c5941765d986ab61ba877341", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968768, "uuid": "9775b919-40c1-4925-b645-8aefbe1951ab", "comment": "Malware payload (AgentTesla)", "value": "bdc37994f00f36ce6c20261f395a25cb6f142267", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968768, "uuid": "f0b45e9d-7877-4821-9dd8-b0605a16a809", "comment": "Malware payload (AgentTesla)", "value": "37e687aab067a0dc937dd11a7c58c9b6e2d2b253f29f06c241aaefd7482115768555fbe2e8dddc65040216030e244e7e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968768, "uuid": "b968bada-c65a-4afc-8afa-e13a0a4da95b", "value": "T15684E1291F8DDF95E14500F021F3C82E9879DC3619BF8E0ADA56B53EC6B42E4761F60A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968768, "uuid": "5a60ce40-3a16-415d-9967-3f612a27495b", "value": "63b0867460dd31e465a337a5e3e003e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968768, "uuid": "1239e7ad-a963-40ef-a833-968dcc2c8696", "value": "6144:kUdGmTN22PVgsSvSe5BGdHjhk6tvQBWsx9kVa11v2yAUl64mUulBbcUXZVpB3T:JT742tkoQZTp2yLnulmy7pB3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626968768, "uuid": "c185fed2-5e44-4edf-bb3a-021f830aca66", "value": 396842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626968768, "uuid": "cd4dfc0b-a45c-4087-93da-c81ebf92561c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968768, "uuid": "cb69283c-cbee-44c0-93bb-6d4d710f095e", "value": "29e9ad8d44e49d2a2fa76ab14d6881cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0985c24a-eae4-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626955069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955069, "uuid": "098f558e-b4e5-4135-9a2f-c7d488cf5392", "comment": "Malware payload (Formbook)", "value": "1e7bc879d7960afaa08148c635ae534f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955069, "uuid": "c54721c1-0fd2-4fa7-9041-cb0d0b9e9018", "comment": "Malware payload (Formbook)", "value": "8c4b07ce49252a4ed12ad611a9f8fde65a63fc12368c6726776e86e140d3872e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955069, "uuid": "26120bc0-bdb9-46bb-a6d4-cc49cab53c43", "comment": "Malware payload (Formbook)", "value": "e1a0db056bdc1cba07ef43c27a80e5bfd79b4eac", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955069, "uuid": "9dc9142c-d929-487a-b7da-f14edf2f1e12", "comment": "Malware payload (Formbook)", "value": "0a785cbd5fc92ef1892d67c2a095932480200a871a670c90db9734e6af95dae0b5b4572c582063d546801ee871f7036b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955069, "uuid": "36e42eea-6580-4c6e-935e-72e8d0abb166", "value": "T1123390ACD18742988F86ABB4630B5F09154C7A5EF394E4777A7C5B305BE2CBA402397C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955069, "uuid": "895c5f90-cb49-4d45-9b11-62a82d50f0bf", "value": "384:4X84SHQPomX+n++jLu9qk2kw03n6bL+p5DhnxKxGS:4aR++jLu9Mkw07p5D9xKxGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626955069, "uuid": "f40a2068-2efd-4d87-834e-f5066dea55cf", "value": 50939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626955069, "uuid": "9d8f84c3-1abb-4fbf-8870-74e3173ff51a", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955069, "uuid": "42dba6b8-4e96-4a4d-bcc7-e768a0af749b", "value": "PO4018308875.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06bab1cb-eaed-11eb-875b-42010a9c0053", "comment": "Malware payload (Fo)", "timestamp": 1626958930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958930, "uuid": "934c3c79-0ab1-46e6-9120-c2bd2db92838", "comment": "Malware payload (Fo)", "value": "655318bec9b30d5a2f2dedf399d87438", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fo", "colour": "#A7F2C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958930, "uuid": "e2d41b9e-5cd0-4676-b566-56e0b4ee178f", "comment": "Malware payload (Fo)", "value": "8cd1a5c6360cc1c0e513d4cc39f649bcb33b61c47c4b498b992ea8e9a41a48cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fo", "colour": "#A7F2C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958930, "uuid": "9a24b7cb-038c-488a-bc38-8fc6485464ee", "comment": "Malware payload (Fo)", "value": "23f37c9bddcd8393f499fee9b77220765288020c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fo", "colour": "#A7F2C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958930, "uuid": "3f1d8afc-d47c-4102-9e02-4d195dd3ecee", "comment": "Malware payload (Fo)", "value": "fe2ffa3522fa5d3a5d5e8e0e565189c3fe956b8e8dd2df7f94fc64cef9f0db7a92de8003ebcfabe22459108e215b6fb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fo", "colour": "#A7F2C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958930, "uuid": "d6476cd5-830d-41dd-9dcc-a55056b0700a", "value": "T153158C525DCE865EC2690DB65731AC5682314DAA2949F3232EC134FDD93F3EEC89F602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958930, "uuid": "a7506601-3680-4996-86af-4ba831aef340", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958930, "uuid": "2f249bf6-a60b-454c-91e7-40126380c3d5", "value": "12288:UgI23M132q8bSfGiWum/YBiXqDXRXITzftEFe67O+NAwcFSMPQipP5q:JI23Mz51BrMUh4/ftEFe+ipQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626958930, "uuid": "e948ab5b-a8a9-4d84-97c4-8d2e716f6a19", "value": 899584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626958930, "uuid": "8684030b-43a8-4225-8924-866c00b1fe15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958930, "uuid": "7ab05560-c5cb-4b43-9f41-89503b017e6a", "value": "PI-0387991.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5451ee79-eaee-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626959490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626959490, "uuid": "4c2fc4c3-1be4-4aff-9b2b-4592357f5c09", "comment": "Malware payload", "value": "7f52a50297c5622ebf51bcae89ad71fd", "object_relation": "md5", "Tag": [ { "name": "wbk", "colour": "#09CA42", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626959490, "uuid": "d55e5f98-dee3-4b14-a076-f7979a02ea90", "comment": "Malware payload", "value": "8dc06fc321e2e0f5b9a7795ae9dd79e95aefe51cb98beccb4bf1f467a8618156", "object_relation": "sha256", "Tag": [ { "name": "wbk", "colour": "#09CA42", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626959490, "uuid": "b4b693d5-1402-4ffd-9196-f82d4926a964", "comment": "Malware payload", "value": "3f44a51aef44f1e1baa05ce5a4854b273690d04d", "object_relation": "sha1", "Tag": [ { "name": "wbk", "colour": "#09CA42", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626959490, "uuid": "8c07c5ad-0cf1-4743-bb10-210665a20bc7", "comment": "Malware payload", "value": "9b25a948803debae3f306571e4f25c0d8a385a50112c480e572b7e8b6af50ec3a355ae9493889b0057b56b443bc4bc01", "object_relation": "sha3-384", "Tag": [ { "name": "wbk", "colour": "#09CA42", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626959490, "uuid": "01293a2d-c0a3-4f4d-8f75-2d1eee1c576e", "value": "T1FE625B7CE99782A8CFC9636405190A8C4264BF5CE3C591B379BC7B713F5AE260B19878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626959490, "uuid": "30059c00-fa10-48b0-81f7-6d18ccb711b6", "value": "384:AqUpjdOpuHty7mQbTlBZevVxf8heDKI1waxDRBcjn:OppRHty7htB4L8mKd8rq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626959490, "uuid": "f54598c6-4b97-4ab5-a647-abfa40d2f1ae", "value": 15140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626959490, "uuid": "9a2514f1-b554-4890-ab1a-06237293a135", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626959490, "uuid": "d4e2c690-15c9-4b19-8517-d2abb1c9cc14", "value": "sw.wbk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36662cbb-eae9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626957292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626957292, "uuid": "b9c3f2ce-35f7-4f6a-8bca-ac82375fa8d8", "comment": "Malware payload (AgentTesla)", "value": "6e52dbe109a73faf3eae3ffea3b46e76", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626957292, "uuid": "9a98c90b-ed55-4376-80e7-19a328937949", "comment": "Malware payload (AgentTesla)", "value": "8e7ebca2166256f89d506b309b900d60abf4118d2b76a802fb0ae347f59081b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626957292, "uuid": "48d9b4c3-8894-4d03-8b96-7fba32c8e39b", "comment": "Malware payload (AgentTesla)", "value": "67de2ae6d91c9c53767b0eb8270208dd93594996", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626957292, "uuid": "e097b71b-2428-499a-9399-b49a3fcc335a", "comment": "Malware payload (AgentTesla)", "value": "fc5595976a655076450fc542abbac66dc347077f25d0006d10079acf547b6e63b63b123e55112d2c1d64dc8e31949a68", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626957292, "uuid": "9818ad14-86fc-4cad-b8e6-343212d72f6c", "value": "T193F4E074671BA744DC3887FC2C14D15127FAA01EA32DD6783F9890BDBCB2BB896E0651", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626957292, "uuid": "db454fc7-bd9b-400e-b1d3-2d3804aa17be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626957292, "uuid": "ddb52e35-7a4b-4ff5-b826-4cba1e57aa10", "value": "12288:Lv9ilUFbxC9N5Qg97iPL9VuLHorvC8sPcacF2k6FuSbqFsyaUVKnp:Lv9i0bkQg/Ir68sUrIZezahp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626957292, "uuid": "2909dc78-dc41-4c94-ae3c-cd23aafeb2c3", "value": 771072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626957292, "uuid": "c43d1766-4902-4b9a-ad77-ce49a270c129", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626957292, "uuid": "982fdb05-5c45-4021-b288-6793a7876360", "value": "SWIFTS 001-010.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32badedc-eaae-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626931946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931946, "uuid": "85d5393b-b3bb-464d-9568-dcf51efabb6c", "comment": "Malware payload (AgentTesla)", "value": "569c5034055681e0b6fe61e6aed888d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931946, "uuid": "598112f3-66cd-4808-b7e5-500156584c1c", "comment": "Malware payload (AgentTesla)", "value": "8ed5b07f6059f515eb428156e40bf1e192ec7cfde40fa64d0938b7edea8fd3e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931946, "uuid": "88faef56-2c9d-427f-8772-f359204628c3", "comment": "Malware payload (AgentTesla)", "value": "d5336c0129b6047d9d725e6b72fb2681d720d41f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931946, "uuid": "a2120c16-5a80-4d86-aaae-3b914011054c", "comment": "Malware payload (AgentTesla)", "value": "3451fb31309128cb3d003f340f28876e326e2ef32d486395462a7901fb54a56c25bc872533af1638ca8348b851ef71d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931946, "uuid": "f6c099e0-e89b-4e62-b9f7-f92099039c2b", "value": "T110E423A728DC677B8175AEBA1F7F46ADA3BD102921B705322200CD16261493CFB1EDC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931946, "uuid": "1e447790-d6a8-4675-9b6d-210ffb7f0957", "value": "12288:BZF0R3ZGIgA9bH/AO2Fgo3wPMidwrPPnZXTEefk1au8O6fu:PF0RpGIbbfANPvZXz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626931946, "uuid": "d48c8a3f-6df0-4d39-8cd8-86050cef0697", "value": 660824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626931946, "uuid": "6397ab77-260b-4dbe-92b5-2a0c3a36a0aa", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931946, "uuid": "e463745a-0d4e-4844-a0f1-90edf9d02470", "value": "Ref 10M-86776.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "201e316e-eaf3-11eb-875b-42010a9c0053", "comment": "Malware payload (Hancitor)", "timestamp": 1626961550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961550, "uuid": "ecc71308-eb16-474d-8c0d-5f440a502b8d", "comment": "Malware payload (Hancitor)", "value": "7348620f737ec1b0997cae7548344f2c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961550, "uuid": "dd3f6570-4abf-4f77-97e6-030fa263e1f3", "comment": "Malware payload (Hancitor)", "value": "8efac1531e83525bb0806eebca0bb9a797a18feb1848a4ceee4a88fdb85cbbbd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961550, "uuid": "1cbfb432-b1dc-4b34-b528-ea07c4e885ed", "comment": "Malware payload (Hancitor)", "value": "5550f62fdc0963c331b460f8a967c45d481e505a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961550, "uuid": "f2c89762-faf3-402d-9a0b-014f34c72db5", "comment": "Malware payload (Hancitor)", "value": "4cd0b675c804411278eda0ad2f85a0ff211e23374dc5632a871b0eb9277cd6ca2f398a8140be3f9d5db8ff7c1326aa1a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626961550, "uuid": "70f45070-50b5-4d8e-8079-97c9ea319940", "value": "T1AC147C103652E872C2E752360F15E685273A74620B3489CB77EC3BAF5F695E3563B382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626961550, "uuid": "471c3242-34e1-4aeb-992a-b229f0a1346b", "value": "d9eb3ddd8c82a521b507418a727a0c08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626961550, "uuid": "d8eb88ee-f3ec-400c-b12b-dc0cec9e2659", "value": "3072:HLg/uYnxzUzb9HbHYgaf8odt7DBsXFJktl/ML5xtREVFW5p3d+0d:HMZJUzBZaf84VE4l/ML5xEop3fd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626961550, "uuid": "af0025ab-e79f-4a60-b749-deeb5e956e36", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626961550, "uuid": "b67e4bf5-e1ab-4309-9fc2-aefd1019be6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626961550, "uuid": "851e35d3-2776-49bf-b11f-16b34039f633", "value": "532.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0dd37fa-ea8d-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626918011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626918011, "uuid": "02f2ef49-4709-4cd9-aaed-989abc423a80", "comment": "Malware payload (Mirai)", "value": "2b1e69a9ee8c13c6f368c51f197f19e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626918011, "uuid": "19647c99-d73c-4396-9972-2cf93d064e1b", "comment": "Malware payload (Mirai)", "value": "8f0d65f90cd2828268d300d88ebe134bbb2cc39e3a32640bc73bed4b62ef4e41", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626918011, "uuid": "1c65f068-c24f-4abe-8b5d-28890b99cb74", "comment": "Malware payload (Mirai)", "value": "4b6dadd4af777b755d26e962143b5f3c9965a406", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626918011, "uuid": "fee47cc8-d6a9-4939-afa4-b0ce1663ef1a", "comment": "Malware payload (Mirai)", "value": "5792d6f72f0580ddca893d5c291f340724bd98a31ff25fb0b255687d362c5c5bbbb0339bd7ae2a3a0ee616fadaeb606c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626918011, "uuid": "1f21b013-b614-486a-9d94-e6347094ccd9", "value": "T1252385193A22BFFFE16986304BF38F7043D535522A919389F22CEA5C0F6168D2C5E794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626918011, "uuid": "6d82585f-0d75-4e7e-9175-0c3d3361e3fb", "value": "768:PWN1Rr171ogGc9siLgmK4JADpRXRAcX3zd+97kLISM1vSoGk4UkZepczQ:ONzxxoXc9sWgmr2n7nzd+6UMoG5UkMp1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626918011, "uuid": "7949b0c5-242a-4336-b00f-32e72b96759e", "value": 46675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626918011, "uuid": "268c71d4-b423-4827-a263-b74fe92ab3de", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626918011, "uuid": "779850ef-728e-4333-b604-af2639c8308b", "value": "2b1e69a9ee8c13c6f368c51f197f19e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2392981-ea93-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1626920670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626920670, "uuid": "993030e6-970f-4fb5-8f4c-db0ad361652c", "comment": "Malware payload (Dridex)", "value": "5356d87ef86953dfd99fd26b28927226", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626920670, "uuid": "81903ab2-1f94-4d13-8bb5-a91871ac7c35", "comment": "Malware payload (Dridex)", "value": "8f4306637d344a0673f623cf2b7326fd9b064a5b56b2e88ec3796c879274bf1c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626920670, "uuid": "912fee99-c8f8-43b4-9cb3-1b9581f78735", "comment": "Malware payload (Dridex)", "value": "22747f2e92618dbb0fcbf257b577bf29e382e17c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626920670, "uuid": "934e895f-94d6-4738-be64-41e7ba528f39", "comment": "Malware payload (Dridex)", "value": "fda2b0bcf9e129d33877921d02a613ab7e986c5b12cbff2e8763d83efdbab75d3c1aab8e0cbfb8e76124b1a12cf1ddbe", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626920670, "uuid": "1bd28986-bc09-4c02-9e04-7b2f2b92ad52", "value": "T149E449C1EBE1C92FFBD1957A0C564630127CCC4495804B973256F33AB72BA7C8E9A2D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626920670, "uuid": "a2eb8bd3-7eec-4b43-89ba-0071a268059e", "value": "12288:VGDH3roxGMC/mc4bl3q5uaFsvCgdz2l5MjavMmIf+1Go:VGDXEUH/4EnsvJZ2lKjavMm/1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626920670, "uuid": "9da8d808-1bbe-4b0f-8726-bb8157d8e5e5", "value": 676864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626920670, "uuid": "d84b677a-197a-4ace-98c0-6b9deb036d83", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626920670, "uuid": "13f3cadf-29a7-461d-8f7b-628a266405fb", "value": "5356d87ef86953dfd99fd26b28927226", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3057d022-eafb-11eb-875b-42010a9c0053", "comment": "Malware payload (Heodo)", "timestamp": 1626965013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965013, "uuid": "b23ea5b2-ac36-427d-b2cf-57470006684f", "comment": "Malware payload (Heodo)", "value": "f3b398221ba03c3c8576072974c36873", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965013, "uuid": "0287f84a-6a84-4c03-832c-cb01ce5ba989", "comment": "Malware payload (Heodo)", "value": "8f6b930ce5efb7bbe7afea91eb2bca883617cbfe501cb2be8a2f615f3f4d3ac7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965013, "uuid": "19bea118-f926-4e94-82f6-a83367fdab65", "comment": "Malware payload (Heodo)", "value": "f19a73bf92eae328e5d4589300f167feb22424b5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965013, "uuid": "fd6efd61-c31f-4077-afb1-21646f6c8da3", "comment": "Malware payload (Heodo)", "value": "2c787b2986199227dd444f0f2afad6704d38a937a70f2ae730374cca5a37c21d44910ddef684dab58abbfd0754d23cf7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965013, "uuid": "aac9d948-dd1d-4eec-9ee7-31a9c8be8864", "value": "T127E2930406C84BB9DADCABF8C4E2D501D73CF6A36E03EB9D1BED417B294BA15115227B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965013, "uuid": "349177d9-18ba-4229-8ed8-c1ee5165b1e8", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965013, "uuid": "cdeac2cc-02d6-4597-b7a2-8e43a3469b39", "value": "768:6XWhswDfo+eLj2lHzS8JWLvBfTqfHNOUaG:6mhswDnTJOTqvNeG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626965013, "uuid": "8a572aa4-a14d-458b-9ae3-aefda3494910", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626965013, "uuid": "859d0a87-ee72-4a80-b7df-7b9956c99f17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965013, "uuid": "32b513e0-f53a-4fce-829e-c30a92fa251a", "value": "a0f9ce88-b4a9-4682-be6c-e9c3d2c1621d.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b84b93c5-eac2-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626940760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940760, "uuid": "a7d8daa2-f055-4985-a253-f9137b4bb286", "comment": "Malware payload (Formbook)", "value": "ed43ff447cd5486610731a627a930607", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940760, "uuid": "fd901e5d-cecd-46ee-ad00-82d14f201729", "comment": "Malware payload (Formbook)", "value": "91cdb947644a5a802adac7583a79e7e560da38839489a02e7464730ff66fd004", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940760, "uuid": "0340dd8c-8549-451d-aa4b-114ec1ffaa51", "comment": "Malware payload (Formbook)", "value": "91449c85fb2fa5d27f8db3c8c08cdfb9d3287162", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940760, "uuid": "48f801bc-3f4f-4040-8af0-a91b3350f395", "comment": "Malware payload (Formbook)", "value": "65334c863f4af7046e2920fa903199ba8cd9082fed729270a545863aa8a1cefd9bfa9bc44d852aa30c90c263f2c4b1ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940760, "uuid": "1dce45a5-ad0e-4536-baba-60a8d6795fa3", "value": "T188358C61F307EA98EC2613F8C87AD8F12263BD6DD525892B359E7E1D79B334050E2907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940760, "uuid": "1dd58f7e-4b74-4251-991e-1e62b0410b4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940760, "uuid": "9c160a5a-9871-468e-ab4c-f008ae91059e", "value": "24576:pYxySdkFS+W/MMQM/3xu+ECDacAQahp6:ShdnrMpJUDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626940760, "uuid": "dc67d9fc-60ce-4bdf-ac60-60dbd82460d2", "value": 1148416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626940760, "uuid": "1ced0137-1f72-4819-9bb4-b082e39b0639", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940760, "uuid": "194c700d-88d5-4ed4-aa11-e8fc82fd6307", "value": "ed43ff447cd5486610731a627a930607.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a46c0fb-ea80-11eb-875b-42010a9c0053", "comment": "Malware payload (BazaLoader)", "timestamp": 1626912255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626912255, "uuid": "1680a60e-2ad6-4d34-b99d-cbed7a7ad329", "comment": "Malware payload (BazaLoader)", "value": "59b0d5d3d8ee9e13de4f6344c095d6be", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626912255, "uuid": "e2fb4a7f-0102-497a-b65d-2067bec09bc5", "comment": "Malware payload (BazaLoader)", "value": "922256a09b0e2637d287d41c289724e421d11576bc39f5be81ca70d254e26b18", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626912255, "uuid": "97a09ee4-f1f8-44c1-9a2b-99b68f345e4e", "comment": "Malware payload (BazaLoader)", "value": "30379a02526f27ceced13edcc982f411d20c964d", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626912255, "uuid": "bc6132fb-97a3-4e37-8cd7-9d4c7a82d4d3", "comment": "Malware payload (BazaLoader)", "value": "8c736ed974dee3612b2baeb71c6d7e19989d16e9899b501d05ffa22da8b22a064a8f28de95869c924f7e2c0bd27d0f03", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626912255, "uuid": "c35cd3d2-1462-41ec-abae-16945e0033a0", "value": "T18AA423B93D4B824E94E9125EC05E01086907852D89A7AF865F4EE86F5DDFCEFC20C81F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626912255, "uuid": "a66e9a7a-2c45-423a-a175-869c21a5125b", "value": "12288:sKx6XJX92FQTL5n4BSQLc3oOFuxUbg1t8GWN:Px6Zt2En4wQ43oOFu6bg1zWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626912255, "uuid": "491e03db-8ae3-4dee-bfa8-9a9bb968e489", "value": 480000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626912255, "uuid": "86102ab4-30e0-424a-ae2f-4223ebb817d1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626912255, "uuid": "5f5ae081-9d84-4aa8-abe0-2e28de60ae23", "value": "ZlvFNj.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db37f57d-eb1a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626978614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978614, "uuid": "4b11e06c-79db-40ab-bffe-f3ac23f6e1ba", "comment": "Malware payload", "value": "e075cce605118cfc5c9f1faf0ee22d70", "object_relation": "md5", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978614, "uuid": "bab06f7f-dbbb-434d-b609-b3f6ad6354ae", "comment": "Malware payload", "value": "94447f6ad37295dafe175c85c34ead96c9440a1511c7e6a999286a90a82e6bda", "object_relation": "sha256", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978614, "uuid": "1db461b0-240e-45c0-88bd-cb1cbd186b26", "comment": "Malware payload", "value": "374748de5ba70e7110cfb5a7e6ee6b840396fa2f", "object_relation": "sha1", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978614, "uuid": "872d7201-d424-47f8-ac7c-4931cb3b9fb5", "comment": "Malware payload", "value": "4dbdf7dcf29394160fd3992fbfeedf40ff6d3f60e7ca8056319d2e28e6e429006c5d3cd20b0bda8054ac641960142aed", "object_relation": "sha3-384", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626978614, "uuid": "ab73698b-fd0e-4b58-9d90-45078f34f47b", "value": "T1FD038D4BC5016A87C5373139C83B89E998A6BC03901559CFE4EE354B36B4BDB278E7C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626978614, "uuid": "b57d3188-1a84-437c-b84b-e7c21b284439", "value": "768:v1JPNpt4S0JS00SneS0yS07jS0MS0bS02S03SFtzg0ok5z/OPFbtTxozz2sT2l6P:NL5UnE/QaJCHE6ARtG9NP1k/X3Nhr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626978614, "uuid": "1f15c2f3-148e-4127-ac3c-ea3138611aae", "value": 39230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626978614, "uuid": "ec234cff-417a-4c81-9d5a-c299e288652e", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626978614, "uuid": "70691dba-7630-4981-84c1-502c2d65be2c", "value": "Request for Pricing, Supply & Quotation.ppt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d3ef600-eae4-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626955102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955102, "uuid": "72904a4f-c047-4245-b0e3-dab0c69aa1e8", "comment": "Malware payload (Formbook)", "value": "a3336f2a85c572aab40243c347ebfe59", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955102, "uuid": "f9360acb-5772-44d1-b828-5ab935f86ce4", "comment": "Malware payload (Formbook)", "value": "9604fbb0d387877ea857295c8b350e75d5adedc3907bc25f19baf16fff3b0d05", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955102, "uuid": "a4c74f31-d299-4ea1-a04c-4974009a431b", "comment": "Malware payload (Formbook)", "value": "f6b300530f6d294ea005b13ec08d881c9651f8af", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955102, "uuid": "4168ed8d-a3be-4137-91f5-910ea9ef5a0e", "comment": "Malware payload (Formbook)", "value": "9de291691356ba9851869358537a9db2e7b44eb459a12c3bf663681705b77b0217e17c6af797e263d8e7225e0619d922", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955102, "uuid": "8a69ebaf-0a5d-4f69-8216-8b2670cc1d30", "value": "T15F43607DC287025C8F856BF8A70B5F0A054C7A2EF794A47236389B326BD6C7B510683C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955102, "uuid": "5d228bc0-064e-4f8e-96ea-2bd032431888", "value": "192:LxTMzqwN3qeMDey6Bd86pouUDGQarNRJ+VoF77D4gVsJHMhOUtD:lTwjMOx7bL1+CN/dVQHgOWD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626955102, "uuid": "6293f700-78df-4313-865c-b6cc86a86575", "value": 56031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626955102, "uuid": "ca6cbb16-24f9-41de-80ca-341a73931c85", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955102, "uuid": "5beefe78-3a79-4ec6-a799-cca0e6a3307e", "value": "QUOTATION1100630004R2.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22ab5623-eb1b-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626978734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978734, "uuid": "e4a3b201-dad8-46aa-9bf3-bfd2bbac8a29", "comment": "Malware payload (RedLineStealer)", "value": "afd6309fd7b3122779f6967edec03087", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978734, "uuid": "cbcc0361-f392-43cf-86d9-ed69e5c5f279", "comment": "Malware payload (RedLineStealer)", "value": "966587a4421c9d7cab7b5defc79a47e7c319f0bd4166678d3a0425b85ca540bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978734, "uuid": "42a45ff4-6b25-44d4-8276-d492463fb58d", "comment": "Malware payload (RedLineStealer)", "value": "0aa3ed6239e0d0bba8dea86cc4a3a765749734cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978734, "uuid": "16541e72-506d-472a-bc81-74887a6bd744", "comment": "Malware payload (RedLineStealer)", "value": "9bb3c787583095a5e0b503e213982d147f48d90aa6b51a7936621184d43d5ca1b79e99725345002dd199cb174b87c6f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626978734, "uuid": "b0d13095-9c6b-43fe-88a9-830b6a2a05e1", "value": "T1BEF56CA1364AF6FFC14D087CE413DE03F92813F59DD88006D96D78F99BA2C422596AF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626978734, "uuid": "75662c4e-464c-4db3-99a1-33d3609681d0", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626978734, "uuid": "c3e44b5f-4bb5-4e21-8ca3-f62b25490e6c", "value": "24576:Ni6zc/WriXNjuCt1s1pgKUtuyL8AH+MivJ1n/8Iag1AbLszB6QeEKOrf1F02CwlT:Ni6lrzCwUV457sAmf8SIOJmucOWNGoPV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626978734, "uuid": "4dd937ae-a2d9-4584-b2f2-5c24710a41b4", "value": 3438776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626978734, "uuid": "c9e0cfb7-2d23-43bc-bdaa-21ad7f2d34a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626978734, "uuid": "6fb9adec-4b0e-464c-90a8-bdb24680d3dc", "value": "afd6309fd7b3122779f6967edec03087.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d26b4092-eafb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626965285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965285, "uuid": "63d12cc2-891f-4cc4-8403-ac0a9ee60780", "comment": "Malware payload (Mirai)", "value": "6834e61d65a63dab87c66996f54b1625", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965285, "uuid": "68ea40c7-dff8-4f01-8071-c8c78330f3e1", "comment": "Malware payload (Mirai)", "value": "974915fc572faa8afe86527a4412175cc250bb6b4c96e925ba1a83e473c09d46", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965285, "uuid": "3ed3931e-eaab-4caa-8d38-b1dba283e1ba", "comment": "Malware payload (Mirai)", "value": "06da18d855ef0139f6275fee4564051f3c20d576", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965285, "uuid": "8a22939c-3c09-4990-b9fc-81bd33ff61b0", "comment": "Malware payload (Mirai)", "value": "921993c54ef6bd69e501807a657857ad0f333afff69033ab287e254412e61115da70dcf99ab25376d3402d46064d956d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965285, "uuid": "1b4ccd70-d327-47f6-9b74-05229e30c477", "value": "T1BE63961A3E219FBEFBAC863847B74A219658339622F1C5C4E15CEE015E7034E745FB98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965285, "uuid": "43e575c3-28ab-471e-8ff1-c81f16f2596c", "value": "1536:AHNFnXDuPq/SyZBp9tsCI0v6bqfg/Kkz73o2x8sW:gNFXDKGrJI0SWYz73o2OX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626965285, "uuid": "8b62e790-c252-47be-a237-38fc20584b1c", "value": 69080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626965285, "uuid": "8dcc57eb-b6df-427e-b782-06d5ec4ec12c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965285, "uuid": "164e7ca0-9149-482a-a905-6ad1cef55851", "value": "6834e61d65a63dab87c66996f54b1625", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2850fdad-ea84-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626913889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626913889, "uuid": "fce719b4-bb9a-475e-90b8-d497e0b5b9ae", "comment": "Malware payload (Loki)", "value": "17ee7ef4673eab6d45037b04cf2c70b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626913889, "uuid": "484a7b91-0486-40e5-8dd8-55771130f342", "comment": "Malware payload (Loki)", "value": "989e2813477a4245e0357e0f8e49afae384af828c95eea29c0e56b905d8290fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626913889, "uuid": "fe12532c-2948-476d-b01d-e17af63e6af7", "comment": "Malware payload (Loki)", "value": "eab393fa429087dff64a209d5afdfedeb929e5eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626913889, "uuid": "341bb225-f165-47a4-bdce-d19a46f241f9", "comment": "Malware payload (Loki)", "value": "37b6a44a82b100761b325f4bb086ea79c56679295b3052d2600b5bee322018087fd2b83c5a14de4071fe8697d5c844a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626913889, "uuid": "ea1a6064-dc74-4863-a0f5-d7f5245ae73b", "value": "T146846C123750C08AD1191B3ADB57FE349B318EE47166858EF7E87D53B6B8383384A17A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626913889, "uuid": "e9588791-45a2-4355-a829-2ed95a57f27f", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626913889, "uuid": "751d9481-ce6f-4e72-96f7-8bbe5ed64128", "value": "6144:nQquppQadcTNtM7aOKuKg1/KjKGBtRW3HcRjg6qW8kt:oppMax12tRccRkLl4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626913889, "uuid": "444aa031-a19d-4d00-8e81-a11ce5f94aab", "value": 388953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626913889, "uuid": "d4bfe38b-61f1-496c-b921-46753354070e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626913889, "uuid": "63c52eb0-d8dd-4ae2-a1e5-b4f614b42269", "value": "989E2813477A4245E0357E0F8E49AFAE384AF828C95EE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50c3ffc9-eb1b-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626978811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978811, "uuid": "33cf8f38-e10c-4aab-959e-ddbc762da8ac", "comment": "Malware payload (Loki)", "value": "750919bd7e02e7821efa1b1bd0ed4eda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978811, "uuid": "9af0f9f4-fc38-4524-bf3e-47ec21fe047b", "comment": "Malware payload (Loki)", "value": "994f99037072fbea77a376832818fec2bdaf577a09b1936a7285e38ace5d8e4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978811, "uuid": "d890dcf0-f9b4-45c9-b068-9d0abd4e6f8c", "comment": "Malware payload (Loki)", "value": "2d925d1d04d12c72e4411d84b2c2b297d09f2c3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978811, "uuid": "f3bb7571-6b43-41af-94c4-e27fe8b96a5c", "comment": "Malware payload (Loki)", "value": "10843ad6a7f05a5db645c21be8ad6535edd96d32632a466df1902472bdf09d806f421afbf9999ab9f9b110f795fefa88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626978811, "uuid": "572874b7-bd32-4e15-8c3b-61ecba941fde", "value": "T17BE4F1097780EF4FC16B8E7784415D20EBF1E6225707E7876CC206ECA98E7998F17296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626978811, "uuid": "b12e00fd-b769-455a-bf66-ed8b33751334", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626978811, "uuid": "3d7d7c4f-189a-45c5-a9d8-c32ba3dc4bf7", "value": "12288:8xQ/7SxjdzTy44OiFTH/xar1sFrnRQPjiN4/3fhAjxDRHEiloRyp:8xQmfy44jtxxFtUjq4/pMxDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626978811, "uuid": "eac7b0a7-1c6d-4613-b6dc-616e9cb56192", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626978811, "uuid": "e126a2f2-e97b-43ea-affc-38e633c17e40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626978811, "uuid": "b0c2e12e-089f-4c0c-aae9-4f3d6aa2b6e1", "value": "750919bd7e02e7821efa1b1bd0ed4eda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d30d5213-eae1-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626954119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626954119, "uuid": "889a7df3-f17a-47d7-bf99-94adbeaa0cde", "comment": "Malware payload (RaccoonStealer)", "value": "6a6bcfa2451c8a2eb94d79150c4c23a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626954119, "uuid": "d0a12855-db88-4030-8df5-19a7df4a68bc", "comment": "Malware payload (RaccoonStealer)", "value": "9a89d59fd9fc97f37e19fd750bff125617632780fe9061aebd5988037e0101ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626954119, "uuid": "4072703f-9843-4478-82af-dcde727d1b1e", "comment": "Malware payload (RaccoonStealer)", "value": "4d136a12af7666fde086b58c978925b14e83f5af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626954119, "uuid": "0658a355-2765-409f-a70f-802babd71efd", "comment": "Malware payload (RaccoonStealer)", "value": "ef2399297ea30ac9edc6df0bbce6d4dc4283c01f106972aff871a514c749f4172d5d978b3a03b45efa20920597d93624", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626954119, "uuid": "9ab8f904-42a9-4cbb-90b0-897dbde4eea2", "value": "T124A412213582D833D0A6053068F7CB542A7F7D215AB6094BBBD42BEE6E312D05AFE747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626954119, "uuid": "1f127be2-274d-4095-b8ae-4b428bec72d9", "value": "ed31136d7e99c845aef2cc9c35374011", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626954119, "uuid": "da008427-c70b-45d9-9b6e-632f957391a4", "value": "12288:CDY2AwZrX3Gdnv7nLYM2M7R5MkAj+q1SohXstTysr:C02A6rX2pzp7Refj+qjsJyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626954119, "uuid": "1a05f0f8-faa8-44c1-9606-cafe55bf7374", "value": 488960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626954119, "uuid": "4ee69223-6d0b-4f5d-b7d4-b585599aa97b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626954119, "uuid": "181ecefb-2b55-49eb-b76c-91bd53f4f2c0", "value": "SecuriteInfo.com.W32.AIDetect.malware1.4812.7339", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "823cc221-ead8-11eb-875b-42010a9c0053", "comment": "Malware payload (DiamondFox)", "timestamp": 1626950118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626950118, "uuid": "d4dd1047-438d-4a30-ae80-74c72db331e0", "comment": "Malware payload (DiamondFox)", "value": "6002cef1c26bedbb75518deb75002cd5", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626950118, "uuid": "8a9d4e70-0bd8-4390-b0e5-3d64bb2d9c23", "comment": "Malware payload (DiamondFox)", "value": "9ac2e8a076204de0f77a79afcfaf7730d190bcff81c125b164e607c63231bff8", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626950118, "uuid": "2548ca0f-a251-495a-8866-81b8a320f8ad", "comment": "Malware payload (DiamondFox)", "value": "e6741199938e7915cbf78e5bf91d5a6ecbda9cf6", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626950118, "uuid": "f92a54af-ca5a-41c0-836c-cf6e9612be1f", "comment": "Malware payload (DiamondFox)", "value": "37ab8687e0aade7bd87d99f5feac06b6c97a0411fb64b87226bc688eda9607a16e22faec3e2cbe6367746efc27d6ef94", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626950118, "uuid": "d8f86c79-d28f-494a-a3b3-7b21790cd36b", "value": "T15AE533847FE280BBE6122434A9187FF5B1F9C3CC023144DF7B14D55E8F6CAA6D82A566", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626950118, "uuid": "f45e5394-fa27-4ab2-bac2-0d1a60a98867", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626950118, "uuid": "4cd4fef2-8340-46c8-938e-da682ee8a855", "value": "49152:xcBdPkZVi7iKiF8cUvFyPIbUgwvnJTn13QTNyfk5u4ocZ12EwJ84vLRaBtIl9mT1:xZri7ixZUvFyPIbYvnZnpQocu4xZ1FCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626950118, "uuid": "e19cfaf9-dc19-4bcf-ab18-17833866d729", "value": 3111859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626950118, "uuid": "c14248ef-63ee-4511-8290-eaf41512924f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626950118, "uuid": "aa00cff7-7654-4d86-a9ba-d7dfc81d9e86", "value": "6002CEF1C26BEDBB75518DEB75002CD5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df9532d5-eb0b-11eb-875b-42010a9c0053", "comment": "Malware payload (a310logger)", "timestamp": 1626972179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626972179, "uuid": "e6b4ec64-99bd-4ebf-ba40-4ed382146103", "comment": "Malware payload (a310logger)", "value": "c322f85e6710cb835efee217addd9a8b", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626972179, "uuid": "cfff3a17-318a-4399-a300-2b193f662183", "comment": "Malware payload (a310logger)", "value": "9b92adeb64ee21a611a7cea841101f878e78d37cbafbd51771416ad5edff9865", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626972179, "uuid": "284ca3c8-6112-493c-8e9f-fae47aa05d83", "comment": "Malware payload (a310logger)", "value": "7f90b476e41cd3f030c255c650def5f0c29cd0f9", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626972179, "uuid": "03ade529-f1bc-45cf-b9a5-56ff1ae335ca", "comment": "Malware payload (a310logger)", "value": "8069c06b917d153f194cb39e8ddb9792985923a7587eef584bdebf0adeaef56be6c1b4c29d60b03a94e1303d4c965896", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626972179, "uuid": "1fc82a9f-122c-4cca-9728-73a1bfbbe0a0", "value": "T19A74E004387E4D1CD499837E232A59B76252277E90CB8A76FB3004970974AFE91D8F7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626972179, "uuid": "3e060828-4212-48f8-b144-52a3b49d0656", "value": "ad7593902351b94d30c5d42690419916", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626972179, "uuid": "ec0b177a-c123-494b-80d1-50a5347223c7", "value": "6144:g8EY/1Wauh8f6JdRpmt0oPo8zlq9esLY9zF9YWvZey7:g8Ey1WgfyHpmS0z49el9YM8y7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626972179, "uuid": "290a07be-1fc1-450d-aa71-1bd6f3dfb75d", "value": 348332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626972179, "uuid": "92901ecf-a540-4e1c-a3cd-91fba0c47cb1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626972179, "uuid": "480b5d6f-372f-496e-a214-f9eb18fffa83", "value": "RFQ-DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c9b118c-eae4-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1626955209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955209, "uuid": "87f5b055-db80-4c4b-b81a-e0f239f0ae8c", "comment": "Malware payload (OskiStealer)", "value": "c6c39101ee5c94dff00cd940617d0294", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955209, "uuid": "bf3d79da-3893-4205-b539-376607abdb48", "comment": "Malware payload (OskiStealer)", "value": "9bafab21d172a1a4c7cc88eb44ca8292a8f96f812d7b4c71b706479f22690b7a", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955209, "uuid": "c0c97128-c6cd-46c6-bcad-540534d124be", "comment": "Malware payload (OskiStealer)", "value": "871a29c9dd5d17ed15e8da5bed728bf6158fcbdf", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955209, "uuid": "c5cce9ce-06c3-4e3f-b86d-64053f17ba9d", "comment": "Malware payload (OskiStealer)", "value": "ece4e80c86735f4d8d4d056b5001166724bca4f395ea6ed8aea68ebd5350d8d5354c046e60c68dfe37dd89e13ef3dc6f", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955209, "uuid": "f0727ae6-24fb-4679-a597-6896d2c04758", "value": "T181455C2AB303D080FE6D15B2CDD4FBF0051BFC2BCA0E991715993E96B477AAE1676142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955209, "uuid": "a1787887-b892-45d3-bf8e-4ece406ea5f6", "value": "12288:A0GiqKFs/QF1NnQKO4DvL7hcomsEZPBUzOlCNmQOk09lIhZ2B9syaUVKnplRjG0R:A6F9FHnQKOO6z59lymqkcmzahpr7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626955209, "uuid": "16b1d65e-c9df-4925-bc4a-b150b9398e73", "value": 1243136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626955209, "uuid": "a2533712-0142-4fac-938f-cf4ddabbbc5f", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955209, "uuid": "acfbf744-834a-4863-95d2-38a071d4301a", "value": "DOC98374933_JULY2021.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f74b8b-ea89-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626916306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626916306, "uuid": "cfb60c23-6679-4165-bc8d-285639647300", "comment": "Malware payload (Mirai)", "value": "2919312e892b35118b46dd309a4bb6ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626916306, "uuid": "8adde914-7281-4f06-9bf9-c9456af84244", "comment": "Malware payload (Mirai)", "value": "9c3767f9d3e6f6cd26521e54a5901160b8f1dd77ab27dae052d399b1addf0007", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626916306, "uuid": "ccefca13-6a7d-4c16-8142-49404c69e809", "comment": "Malware payload (Mirai)", "value": "7d15486c6f60183b84a97b8648ff4e6d10131ac7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626916306, "uuid": "92b315a6-8622-497a-9256-2a6b490ced1b", "comment": "Malware payload (Mirai)", "value": "6c1ef6b0e56b5d223c0454c1c131a244d0cacc9e0ed0e27b2dd03f51b41d483ec04774d9922d1d932495e8d9af2a1a1f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626916306, "uuid": "3fc826f0-0c59-40e9-a77d-ab7314321a4e", "value": "T17B933B06E7408F53C4E21B79FADF43153323DB14A7AB63065628ABF43F867AD5E22506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626916306, "uuid": "46890b97-a17e-4c55-b1e7-2ebfcd76a9f1", "value": "1536:J8nGejPKWeRZWlQyXUiCTGv/UBFm7B0u2FyEBhEgzw/9ObriEmqxw0QovAx:iPKW5uGv/UBAN0u2EEBh7M/9YmMw0Xve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626916306, "uuid": "f937cdce-bcab-4393-84fb-0976a100d8ab", "value": 93863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626916306, "uuid": "aaf3c051-43c5-43ef-92a8-2e8d80329186", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626916306, "uuid": "2c3b3cf6-5b25-41a7-9dc8-83f6c34ad09b", "value": "2919312e892b35118b46dd309a4bb6ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f159822a-eb0f-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1626973927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973927, "uuid": "85838932-ba51-4066-bfd7-2a9682ad34a6", "comment": "Malware payload (TrickBot)", "value": "47ba62ce119f28a55f90243a4dd8d324", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob109", "colour": "#78B843", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973927, "uuid": "7be3af71-b098-4290-8808-2e9632bf6d04", "comment": "Malware payload (TrickBot)", "value": "9da8a5a0b5957db6112e927b607a8fd062b870f2132c4ae3442eb63235f789e1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob109", "colour": "#78B843", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973927, "uuid": "c8f5c17e-70cf-435a-b92a-8be638e8e9dd", "comment": "Malware payload (TrickBot)", "value": "e12851dd2353651d4249a13b0cbc4ca1cc06e753", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob109", "colour": "#78B843", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973927, "uuid": "93e0c7ba-f30f-4ae7-9849-8e62d241cba4", "comment": "Malware payload (TrickBot)", "value": "745140f9bc7adaf2642af553292ae6ab992aebd3f6ff93d382813aa63625f2ccceb9679b2bafbdc2a7a4482b3de43245", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob109", "colour": "#78B843", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973927, "uuid": "d6cddbf1-ce90-465c-a1d2-edfc019e5925", "value": "T103C4CF2235E08577C4EF12345E667778A3FBBD942BF2C147678A890C6D339028B22327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973927, "uuid": "09fd6aac-d855-486e-9024-04be13e95791", "value": "f3deb6209dc9c95daaecc9f849af840f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973927, "uuid": "ad53d0f0-b0b4-4f29-b0a0-31a557d89cb8", "value": "6144:6nhWubOStZ6AbgmgwLp3gUhWeGtuOPc/woVPHma1MXohuPATdTpNSTrbkYW412ph:6nTltgBNwxgUXb/DGaXhu45pI3rep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626973927, "uuid": "237671e5-e1a4-4619-90ed-887739a47be6", "value": 557056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626973927, "uuid": "5df20a15-2416-4537-bc76-73434621db6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973927, "uuid": "ca4786df-fb43-45d7-899d-8b0bf8e4d6e2", "value": "47ba62ce119f28a55f90243a4dd8d324.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db600e34-eaf1-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626961005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961005, "uuid": "5ae24acd-8668-4d9e-b0ad-ca0688d1e723", "comment": "Malware payload (RedLineStealer)", "value": "ad89e162cf60de99d30e719e1a9c0596", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961005, "uuid": "060165e5-ed9a-4ae6-9c41-3b7e4097a960", "comment": "Malware payload (RedLineStealer)", "value": "9e1ed3dab561466709ba4f2b5111ed162ddf338fb7c510dbff4117470a71115e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961005, "uuid": "be05b9d8-b322-4b21-99c1-dad6a8a1c168", "comment": "Malware payload (RedLineStealer)", "value": "eb2ae7390ab6bd02bd373bde8683f8a57d14ee22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961005, "uuid": "8d90d0a1-6e32-4686-b51b-d082dff3ea4a", "comment": "Malware payload (RedLineStealer)", "value": "73c946ee6af6c25c9856b7f5e271a2d598d787fe580c123345df76b2a3293eb6fd203edccfe911fa6d463d8284f0cfdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626961005, "uuid": "7135ff1d-7f4b-4979-a3c3-e15566fbeb01", "value": "T1AB25F31869BFD01960E3FE512EDCA9BAD99A65E3240D747B10B533374B12B80EE4F439", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626961005, "uuid": "16ab3bb7-8658-484f-ab9a-d6c06ae55143", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626961005, "uuid": "24d0d468-e620-4c90-8309-ca634ecb0f97", "value": "12288:1PZuxdK/OrSkglCf+4bNXZZo5Ci15MR0avqCupf0vt94huiX4K1679IuW7LrQb2e:B6Sl8M/zxrav1rBvJp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626961005, "uuid": "75aa4da2-4833-448d-b530-2c670e1a480e", "value": 962560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626961005, "uuid": "270226c6-53d3-4718-aa47-bfca205da228", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626961005, "uuid": "7c2592d7-cc89-40b6-a040-e73eaefc8e6f", "value": "ad89e162cf60de99d30e719e1a9c0596.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb211fe0-eb02-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1626968360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968360, "uuid": "e84adc67-f1ae-417d-a56b-e749a887493e", "comment": "Malware payload (TrickBot)", "value": "d78b148f08b3a869fbc8fe66fa91ade0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rob110", "colour": "#4DA1FD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968360, "uuid": "23db711a-aca4-424d-a0d6-67f16962c6e9", "comment": "Malware payload (TrickBot)", "value": "9e2c9fa5f0c1bd5348d3a6996ab5855104ac9580defad7789f4296ce9d5305a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rob110", "colour": "#4DA1FD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968360, "uuid": "fb0e020a-3adb-404f-a265-3991c5f56259", "comment": "Malware payload (TrickBot)", "value": "3e5a8cf2c8bbf21c3f4edcc8720fa1db51234bac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rob110", "colour": "#4DA1FD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968360, "uuid": "74ead7e6-686d-4fbf-b715-d68191d44be0", "comment": "Malware payload (TrickBot)", "value": "937c959c00cde1377aa92c1b90c0b512f46fd589f80e82a0648bb312e1c05ffc1a17f82825ab866f77399f1a45bf8df0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rob110", "colour": "#4DA1FD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968360, "uuid": "6e4c8a57-b919-435d-b840-246ffb799e83", "value": "T14EA4E02C3480F4F6E0230175C9999665CAADB8247B2378E7E7C46EFA7F655C09A3431E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968360, "uuid": "af0337d8-d8c9-43c3-a451-eed18ebc0ef4", "value": "13012c7764c22db0eea00ae6b1458d85", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968360, "uuid": "3a7cda12-67a5-46bf-a215-adf5b8a36275", "value": "6144:ybRfnjXFr2KGL3bbHHjYXWOZcy8QGd37ci/fW6/gNXtlTF5yVNU5JhJDCyFE:UZr2zHHmjMd1W6/gNXtrkVQhJDrG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626968360, "uuid": "099f32c1-6c57-42c5-8a02-5dc9051901e9", "value": 465408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626968360, "uuid": "7659c2d9-b8ef-48ca-abf4-08dc4e41e168", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968360, "uuid": "0e0409fd-2798-4962-a0ad-7a4188591718", "value": "d78b148f08b3a869fbc8fe66fa91ade0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fda4e06-eab3-11eb-875b-42010a9c0053", "comment": "Malware payload (QuasarRAT)", "timestamp": 1626934115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626934115, "uuid": "60920502-8a2e-4278-bb0f-55a30beee78c", "comment": "Malware payload (QuasarRAT)", "value": "6f260afdc367ce34cc44584c35ef7da1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626934115, "uuid": "9d4a3b97-099a-4367-8543-024e244a74b5", "comment": "Malware payload (QuasarRAT)", "value": "9e4b6c3beacf15788e4ab0c3dc67962de4e1181854ea65124ba7231ff88730dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626934115, "uuid": "69ec6f4f-95fd-4483-98f7-7b2dd6d29927", "comment": "Malware payload (QuasarRAT)", "value": "b9c1be8368b9947a85e70ddee94b35c8dde43771", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626934115, "uuid": "9eeb597e-f914-4c93-b228-56fdaa1428db", "comment": "Malware payload (QuasarRAT)", "value": "1d0d84552d919c783d0e7712d592666b668bc8c9fb8831d49f2ec325f6ba0002ace9072517f87b689a256152c1a34f75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626934115, "uuid": "0e81b595-ac83-42ed-9baa-85221b88b95f", "value": "T12C15492439FA501AB173EFAA8BE879D6DA6FB7733B07645D109103460723A81DEC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626934115, "uuid": "2d4353b7-1169-43d0-8b15-205fb2ed9e61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626934115, "uuid": "05ebb466-22b3-4494-bdd2-3e8bc2a6703c", "value": "12288:acPZjsoI+a61FZGiKYuRSBn1vEQpZiQqK9dFDs0vH5+yRz1ZVjwlS7vNZFNmuDo4:acx357zpV5vVZGCz+AF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626934115, "uuid": "b9a29852-2490-4cb8-a0d2-2f1988ceaf99", "value": 919040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626934115, "uuid": "7ccf9a3d-8257-48e3-89c8-2a9457a7dc0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626934115, "uuid": "6cb41289-b080-4674-be57-f40c91a5c4ff", "value": "10303640_APMC-TRN-C0001-Stability_Calculation_Rev1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cdbe044-eb03-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626968389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968389, "uuid": "1dff961b-1ed3-48ee-bf47-260dd7a3c83a", "comment": "Malware payload (RaccoonStealer)", "value": "f29c224e592cb830816f2ac471c51c35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968389, "uuid": "8fc3d986-be95-423e-b98b-b5aa5d5f5ae5", "comment": "Malware payload (RaccoonStealer)", "value": "a02b64dc93daa45710a48d618f107e0ad5ac36b1b4ec65dfffa5b9a217f3364f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968389, "uuid": "807b455b-2395-484d-909d-ae485ab2162e", "comment": "Malware payload (RaccoonStealer)", "value": "5bd868da05710202d48ad575aee6286a970ad866", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968389, "uuid": "9f75fed1-4e72-4045-8593-23036ce696f1", "comment": "Malware payload (RaccoonStealer)", "value": "d15d14944ffb9d793c55b10156d10743c04df03a5eb78a3a9238ab6e47660c0e3ea5951e918b576aa807c17416c8d448", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968389, "uuid": "1340cc89-a760-499b-95e8-b6fe9561a404", "value": "T116A41220B4C1C033C8A50A349CF7CA65667DFC316EBA5A476BD92AEF5F702C1566E309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968389, "uuid": "f1382334-1e8c-42c1-b8d3-dcbcf0d33e9f", "value": "f8220ac65423f0267d42ab4cbda2e1d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968389, "uuid": "403e3862-dd83-4beb-8743-9b9784bf447a", "value": "12288:hAu9/6uHfxMFZ0uBhgaoClPFB9rNty10:hKuHZuvdZNRXy10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626968389, "uuid": "ca23b940-065f-48cc-acec-59f10999ae5a", "value": 477184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626968389, "uuid": "b9b4aeae-06c3-4f90-a36f-0b26656da404", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968389, "uuid": "faef5eb6-cc4a-400d-96c3-a5b80d1d8531", "value": "f29c224e592cb830816f2ac471c51c35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c67ec5ab-eb20-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626981156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626981156, "uuid": "24c4696f-275f-48a7-a599-7c34e3bc9785", "comment": "Malware payload", "value": "ded00ce5f2d97d2c052322e83c814d20", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626981156, "uuid": "df2a4c5a-c2b0-493a-bbc8-2c58d8b9362b", "comment": "Malware payload", "value": "a0c5b8f728ee17e96b5e49b9ba5de873331dda3f5751efc0665d22b3491c6139", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626981156, "uuid": "0aa7d241-6da5-468a-9ebd-75db0435e993", "comment": "Malware payload", "value": "653cbc3dcfd352a478850dc8f05080e219a2655a", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626981156, "uuid": "1412e9e6-0a32-4ccf-8932-9c6ea866a5f5", "comment": "Malware payload", "value": "2dfedc57bb9ca00d28b33d13a6a23e7e885b96439307ae922ea20ff64f3ac1d013ad3fc9e108e56b0cdc1d272b0d7e00", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626981156, "uuid": "161f5c4c-68d0-4d0b-9408-a4a8e47d4248", "value": "T1F9A423077FCE4DC6360C78D728A6318C9451A7ACBDE190ADCB0C5795223A86E85FBEC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626981156, "uuid": "e4bf3acc-0cab-4dd4-a2ff-6ba229b71471", "value": "12288:7HB7/k5GSHXpDjdsVBLXnwvZq1YQSgPHA2028jkJ:VOXFG/jwxqqQSsgj28jA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626981156, "uuid": "a4c2c994-66f3-47e1-a569-2f736d7dca12", "value": 478620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626981156, "uuid": "dad3e3b7-7443-4bed-848c-6c56ccb478dd", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626981156, "uuid": "7113d89a-a1ec-46eb-8bd4-c8c2c4d7457d", "value": "CARGO ARRIVAL.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c61db17-eb03-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626968442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968442, "uuid": "fdb7cd4f-5f92-4200-87b3-e039757ba217", "comment": "Malware payload (Formbook)", "value": "57f3ae2842ffb5ceea386d0b97a52818", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968442, "uuid": "02114871-9b0b-41d9-9b5e-203d2afa8e77", "comment": "Malware payload (Formbook)", "value": "a0c7b3d44a5cfcda917fc80c099da5ab3de582ff7c24f1373b4bd25f88d61e52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968442, "uuid": "3a051176-0683-409d-bfa2-eba943784f48", "comment": "Malware payload (Formbook)", "value": "68423398d025d3cbbb944ee4c3cea5501df67761", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968442, "uuid": "bd281af8-a184-49fb-9331-7841fd271779", "comment": "Malware payload (Formbook)", "value": "6be251db58532331d34fc9fc5f05d95a6a156d85ba9b64772d96903d6724ec2c2ac76f7bfb5e320b13a683b4c20a906b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968442, "uuid": "a92f34e2-ba63-4cf2-b95d-167f3267cc26", "value": "T128040240B33DA22AE5015BB165B050EB809FA737AF1F8977E76CDA095C7C4C3345AA17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968442, "uuid": "e50e8a42-73f7-468b-a769-2771a4563ffd", "value": "91ecb5a25c0109a651f89e2d72e3496d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968442, "uuid": "dbf3c5cc-1eb0-4450-bc8f-d70758cbdb52", "value": "3072:TwjHmsbeuEz5qDDOapMygfwt3AA4fce6/1DQj5U+FS8EoESO:TwjHFrtYwxAAMu/1cj51FSDdSO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626968442, "uuid": "02592eb5-80c1-4d2a-8753-da970f8aa0ad", "value": 188889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626968442, "uuid": "566d9c16-7352-45d1-8110-ba78649653ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968442, "uuid": "7f358cc0-9fe8-4ca0-b0ff-380d28a35cbf", "value": "57f3ae2842ffb5ceea386d0b97a52818.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f664f2f6-eb03-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626968781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968781, "uuid": "cc0e21bf-3bba-4787-88fd-2d982b9201bf", "comment": "Malware payload (AgentTesla)", "value": "398b8aec2323e7fbb280acf7990a5804", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968781, "uuid": "fef80150-1d65-49fd-8cb6-6a780abce324", "comment": "Malware payload (AgentTesla)", "value": "a11f3441afba44812c4a81061daf98989f79768776f1dcdd0d273947c3b888d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968781, "uuid": "81c9aca3-55c0-410d-9ff5-13f87adab1a5", "comment": "Malware payload (AgentTesla)", "value": "5ed57ceac721fe99ff76ac6f8d8a8de2eb2b51d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968781, "uuid": "5f2d0d9a-9ebc-4f18-b270-0e5bbea1a476", "comment": "Malware payload (AgentTesla)", "value": "2afaa7b01a4a7ed63bd6d75f0756d22efcc2fdb4c925df56c88bdb7dc2849f3efab13bfe386e2695e9c8ac6985bd8c69", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968781, "uuid": "c7c709d3-3a8e-4755-940a-43282dc24aed", "value": "T1D115F13A3227B608EC7C87FB5CA8D1A0A67FEC15255AC23819D4B47DBCB2BBC15D0156", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968781, "uuid": "767a840b-93a3-4bce-85ce-6c82397f6395", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968781, "uuid": "09ab27bd-9c79-4d1e-a010-f76e96570c81", "value": "12288:mREe0b97SSuKMNWudGjoLAtRIAa211+Eu1Q5XijVR7t1f58yaUVKnp:m2eK/uBLAzIQ1+E8Q5XijVR7/5jahp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626968781, "uuid": "2297480f-c2a4-43b4-b3c4-f3ee7a39e589", "value": 878080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626968781, "uuid": "f2335e74-c23c-4a8e-8780-6a3338fdaabc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968781, "uuid": "9a309cac-fdb9-4791-91ac-c2cef153cef6", "value": "Purchase Order 22-072021.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05fbc4f4-ea88-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626915550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626915550, "uuid": "970564d8-755c-421c-b1f0-c709d7da2e77", "comment": "Malware payload (AgentTesla)", "value": "b865eba7ad12435f66fcc532eeb6f2ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626915550, "uuid": "2a9d2458-2d47-4afb-bb0e-357bb889a36a", "comment": "Malware payload (AgentTesla)", "value": "a22a93aa201096c6ae9d68aa245093f3b922b90e31a529ce94bcdbd2c0507e86", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626915550, "uuid": "43bb9f34-442f-46c4-925e-2e120f207235", "comment": "Malware payload (AgentTesla)", "value": "53c1a9b23d65b6dc77bf79aebdef23ee815106f7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626915550, "uuid": "f3fb1218-5ccd-4206-9d13-df8e7bfca7a4", "comment": "Malware payload (AgentTesla)", "value": "340f1194076cba2a1a58d7ddf7efdb6554b6ce3a5c213c9115c7766c684794eb9b2804905a0fe628b5cd0b0c7e067710", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626915550, "uuid": "8e00cd96-04c7-4721-92df-017ee4b628fa", "value": "T125F4F1153780BF4EC16B8E7A84415D50D7F1E66A5B0BF7836CC312FC698E79A8A17283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626915550, "uuid": "8ba9d6b2-915a-4352-a6e6-8999a35ccab0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626915550, "uuid": "a98a8cf9-3c4e-48fa-90fe-caed76e47f59", "value": "12288:kHvzYlCqMLjBE8Zdm2Sj39MXsu5ovZzQq02kA73MBNpqsA381ErYy:a8ij28TKt1u5oqjxA4BxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626915550, "uuid": "a6ac6673-ffc3-4c79-9ae8-62a10bcee50b", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626915550, "uuid": "2256f07e-54f2-45dd-a432-d9dd29b42265", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626915550, "uuid": "c8d6c599-b5d1-444f-bbef-c22b49bd3f96", "value": "SecuriteInfo.com.W32.MSIL_Agent.CAC.genEldorado.5417.14032", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b0c1921-eae9-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626957246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626957246, "uuid": "a710990d-881b-4bfd-96bd-5234c234f46b", "comment": "Malware payload (AgentTesla)", "value": "8b606ce363521b23c5db44784d3999c4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626957246, "uuid": "822a8d57-ef04-40e0-9caa-fbe4fbbad447", "comment": "Malware payload (AgentTesla)", "value": "a2cb7106a55573bd7292b3bda6280a141c91e0e0fdaf4253f4f8e18b7127823e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626957246, "uuid": "71cb74ed-f82e-4e23-abc1-f20ab11fc7fd", "comment": "Malware payload (AgentTesla)", "value": "ec7ad43128b11370fc53d93573c65b6e5b048fcd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626957246, "uuid": "3841009b-064b-4c28-b97c-6dcf571b7d84", "comment": "Malware payload (AgentTesla)", "value": "e2057ce2877e5b1aa75eda2bf98b5d6018eaa240c854eba1804e5b68dc9aa478c56f8851bb438a6fab9d78ffb82d2e82", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626957246, "uuid": "aa0c55fb-c497-4822-a157-c1f441186066", "value": "T140458E61F307D899DC2212F8D87AD8F12267BE6ED465492B358E7E2D78B338160E1D07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626957246, "uuid": "697ab6e4-e379-45ca-857a-8152bc8ce5a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626957246, "uuid": "581a3a41-8399-4bea-96d4-049554b4cd10", "value": "12288:EW4ZguKkZi/Zox+XJSwyN5AnR657dXmUAqvSoIdH71AL7yaUVKnph4:CidkoCnNyw1Jr7kpahpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626957246, "uuid": "6d5d894e-b48c-4843-b320-469424641442", "value": 1169920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626957246, "uuid": "7dac4f98-6331-4b46-a934-130810fb3ed6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626957246, "uuid": "f4e9cf8c-182e-4490-9b32-42946e3e2b9d", "value": "comprobante de pago.PDF.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d338dae-eb1b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626978939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978939, "uuid": "d8147cea-1455-4866-939d-10a4a52e4d26", "comment": "Malware payload", "value": "92087ce2246db7c0a2ef9a332ce41eda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978939, "uuid": "46c969e3-d195-4a3e-a3fa-dc3bbc792b6b", "comment": "Malware payload", "value": "a315fdb87469ce17a90c9377bceb189c6e16fd57afe106d5a504de90d8afaed2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978939, "uuid": "eb4ac592-d8b1-4d21-a40d-70b4a7c85bc1", "comment": "Malware payload", "value": "a1ed591aea324aaec0359b08b195a8d234705c54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978939, "uuid": "50538f73-ae41-4f43-8a02-beba3c796dac", "comment": "Malware payload", "value": "f57db1da6272d23a051366be5a1f898cfc615ee018f0775e9074ffe2286cec150160e4dca8f7a7aba0e5e95fbc37700c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626978939, "uuid": "8d434546-e30a-41c2-abf7-ce65b60b7fb1", "value": "T12624DF147183D437C0A7063098E6C6A16A3EFF216F2B59477A4437EF2E312D696BE316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626978939, "uuid": "d2482641-e290-4016-af41-d69d83df274e", "value": "4d4fdfb7fcb2254a31ad850df30aced5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626978939, "uuid": "a90e939e-f1af-4407-b1ec-d8ec03560e82", "value": "3072:6QSvIUnIHLOX6yFRA09avSlnV21wSZLOOlTIqGZBwObLJDwXYhGglRs6bL:IvarOqZfv4SZLO0khZBJLyXYUglx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626978939, "uuid": "a15d2937-2048-454e-93ab-ff18e455634c", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626978939, "uuid": "b87420fa-1ad5-4b00-8f18-ba6089dbd517", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626978939, "uuid": "47b227f4-9bb8-4f1e-844a-a4003822bc3a", "value": "92087ce2246db7c0a2ef9a332ce41eda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e3ec16d-ea9a-11eb-875b-42010a9c0053", "comment": "Malware payload (LimeRAT)", "timestamp": 1626923348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626923348, "uuid": "36b53cb1-c829-48b2-b2d5-dff27436cc04", "comment": "Malware payload (LimeRAT)", "value": "2887c6eca27dc9a071a5c56cbaaf16cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lime-RAT", "colour": "#331175", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626923348, "uuid": "a3f0bc5a-3815-40c2-87fd-9093037b8a08", "comment": "Malware payload (LimeRAT)", "value": "a3269daa8b505dde535e55c76d5cc76236fb45323719cb34eedf9d120caf3be1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lime-RAT", "colour": "#331175", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626923348, "uuid": "d083d586-8602-44c6-aea5-64738a172d79", "comment": "Malware payload (LimeRAT)", "value": "de501f95cb4f87369d8e4d50f953e8c00c1f1256", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lime-RAT", "colour": "#331175", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626923348, "uuid": "4dbea82f-3c4f-43da-97de-f21e7907cb78", "comment": "Malware payload (LimeRAT)", "value": "6954c6fef5c3e58f3f5acd69938a633fccf4b522d706f8ec6f7eb3aea6baa4170c9c2335b6caff3beab89bc6417bd0de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lime-RAT", "colour": "#331175", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626923348, "uuid": "a1ba98a9-2143-4846-92c7-dfa094fbf6df", "value": "T11C335C80B3D0CB46E29C76728463565207B0DE079622BB7E0CC87A5FDD677A04A62F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626923348, "uuid": "14159732-b243-4f46-b0cc-292d5d8c05ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626923348, "uuid": "1c58a879-50e7-4a20-a77d-673bb995b4e9", "value": "768:Up846nrwtBochTMcK45NXVj78fEmr+BCK7PFl+nK01e7Nv62n3gYRN:UpGrwtBocVZID+BC3KH7NeYRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626923348, "uuid": "d26a2e97-9689-49de-9a90-b850901fc81e", "value": 51200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626923348, "uuid": "3601f3c4-9af9-42eb-8958-36071d529fee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626923348, "uuid": "2ece3874-a91d-4801-8b8d-ca1787336dd2", "value": "jRPSjUSf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e82e1139-eae4-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1626955443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955443, "uuid": "aa4a4060-b0be-41ce-82ea-b4ff0f3b9c2b", "comment": "Malware payload (TrickBot)", "value": "7b68c2c502809e55cd43aa255825f1ad", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob109", "colour": "#78B843", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955443, "uuid": "c8f38365-5c0c-4a5b-9129-fba29ef39f98", "comment": "Malware payload (TrickBot)", "value": "a3b6b719ce886b1b47b5e1d94d5d017c6bd58d3732ee3d43e0557b6395a87401", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob109", "colour": "#78B843", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955443, "uuid": "fdc56e81-731d-49f9-bc1f-7570d042c37d", "comment": "Malware payload (TrickBot)", "value": "4d02003d0030ed34d786f96e90d7131daebb45f5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob109", "colour": "#78B843", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955443, "uuid": "07b55f10-80b7-442c-ad11-68ec3415d2cd", "comment": "Malware payload (TrickBot)", "value": "52b69fae7e755e224f260011ad17f445cfb03362ecba2ff22593e88d84c741341f6b7e955ae4b0c013ca0f4c197ac49b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob109", "colour": "#78B843", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955443, "uuid": "dbc64a84-b362-4d73-a629-c66ea9fd1c12", "value": "T164C4CF2235E08577C4EF12345E667778A3FBBD942BF2C147679A891C6D339128B22327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955443, "uuid": "7d559244-dbb2-4897-ac2c-70b6955eebe8", "value": "f3deb6209dc9c95daaecc9f849af840f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955443, "uuid": "0dffb9be-4bb0-410d-aec2-87b3821c460c", "value": "6144:6nhWubOStZ6AbgmgwLp3gUhWeGtBOPc/woVPHma1MXohuPATdTpNSTrbkYW412ph:6nTltgBNwxgUXa/DGaXhu45pI3rep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626955443, "uuid": "8c22920d-37be-4cfb-b6e8-580cd6df0e58", "value": 557056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626955443, "uuid": "202c26c1-98af-43a1-a2ef-0feb4614aa3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955443, "uuid": "59c658b3-76f3-4a9f-9884-09c33f5ec1f5", "value": "7b68c2c502809e55cd43aa255825f1ad.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b562ba7d-eafe-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626966525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626966525, "uuid": "61030322-d4ab-454d-8bb3-6d4397cb10a3", "comment": "Malware payload (Mirai)", "value": "a4a0be45568f2b6ac9808781c6346074", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626966525, "uuid": "be751761-4653-440b-a7b7-111c08bd4df3", "comment": "Malware payload (Mirai)", "value": "a4efd9810d408db5b6b1723fc2b19c6afb286ab1a0998c6e18ef78bce5be90f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626966525, "uuid": "0493906e-f600-4a36-8f4d-9f590798e5e5", "comment": "Malware payload (Mirai)", "value": "20dff5479e97a847d0b7e5f1e9d17c5aea18ef2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626966525, "uuid": "41e561b8-f1be-4984-949c-0dca31c06fc6", "comment": "Malware payload (Mirai)", "value": "8b91a6c86b6de6c909d72354f62ba9a7c4ecf68d48762af2725e7907266949a512ef64bdeba0ec7ddc961549b65f4ba9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626966525, "uuid": "9901a2a1-348e-4556-a19b-64ac00185d9a", "value": "T161432925AD792E26C0D4B57A51F78714F2F2220E26B8C61E3CB21E4EFF04B4065577BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626966525, "uuid": "8d9b2b44-0a50-4435-a88e-a99855814d32", "value": "768:TXon00+q9wp3C+vactfa1sDHHYAzsv6WswWSHoXdss63B/9JO+zC3h:TXw00+SY3CaactfI6Hvzsv6vwcGJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626966525, "uuid": "94995136-3d24-4752-884d-c3edf9daf38f", "value": 60116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626966525, "uuid": "8c5844e6-37b3-4794-86dd-4d3fd7ebf48b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626966525, "uuid": "6c181269-7f17-401d-92ca-9a4036cf034a", "value": "a4a0be45568f2b6ac9808781c6346074", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bdf98b6-eacb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626944443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944443, "uuid": "8d0585b6-11e1-4828-9f19-a892fef71df2", "comment": "Malware payload (Mirai)", "value": "dafbf75b66b11d7d3b2dcd284c8ac302", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944443, "uuid": "be4a652f-44e8-4e0c-9f34-7b3bed831731", "comment": "Malware payload (Mirai)", "value": "a524c003fb6dda1f77eda693accef4fff0a0d9fbe7bb0dcfeaa319e526367258", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944443, "uuid": "54ff4fc2-ea30-4f6e-8730-4b009e5ec350", "comment": "Malware payload (Mirai)", "value": "d1736cc4d7efab8522907550ae0ad5c2e52b296e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944443, "uuid": "e95f4353-7021-4438-ad03-cb6d0d6d8b89", "comment": "Malware payload (Mirai)", "value": "0bb1c1a38288478d20e337b979428230e7cac98919d274a2d833b219325a41b2135e1f92a1a7482aea7929d6e3017927", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626944443, "uuid": "1d01c223-9334-4142-9613-9de5985f6ffd", "value": "T1A7332ADAB902AD7CF98BEABE80160E0AB23123541053073777EBFDD37E321549956E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626944443, "uuid": "07901eab-2987-4b02-8faa-d5839cfa84f4", "value": "768:mLGOe2kf9e9X9nbermI7vc59QPQs5gFHviPuzWeHXpi2UJTpDnH638gZ:mL/4f8F1ef0YgFvimzpZi2UJJnHY8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626944443, "uuid": "1b986091-8cb4-4c60-bb8c-b5e04601119c", "value": 53056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626944443, "uuid": "28a38939-22ee-4b23-83b5-1ebee7ff88a4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626944443, "uuid": "8873b17f-5808-445b-8c3c-cca660034c91", "value": "dafbf75b66b11d7d3b2dcd284c8ac302", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3223c956-eac2-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626940535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940535, "uuid": "eae3aee7-c0d2-4484-8f9e-2bf6869fd2c6", "comment": "Malware payload", "value": "cca09051ab8cc46e4f3fd27735d97497", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940535, "uuid": "49ec2235-1586-44bd-82fe-c9db2ca8b432", "comment": "Malware payload", "value": "a53f2adaa0f706b4269fc41a28e2330bb681933b4a3e4c66a0947934c76112ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940535, "uuid": "33241809-76fd-45e6-93e2-65a3b186fc7f", "comment": "Malware payload", "value": "64ea5e49d9930f88f0bc34b2d7ac295bdf75337d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940535, "uuid": "0b51d98f-ab25-411c-b49d-04dc3c6d4d8f", "comment": "Malware payload", "value": "54ee704ec56094f1c1d08013548f96c42cd9c8336404f9e0fef0af20630915d58532b9165c996f51c9482697eb628ce9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940535, "uuid": "31dc73e6-e4a3-4f6e-88be-873a7db6f9fc", "value": "T16EB309786B948C33E3AD57B88166414E9BF44017F68AF3ED8DD698F0B8427D15E818B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940535, "uuid": "40b3f926-fa27-4543-b5b7-3a92e9d9601f", "value": "1536:dohme9+jlrVlWaUOXc8DRMgVK1EaiCDsA0ArVfpwVrJpyDcsvVE7MS6Vq0:dAr9+jbqOXJmsLArVfpapyDcsvmNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626940535, "uuid": "e924d4d0-1f8b-4091-bdb2-8c4a6decbf92", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626940535, "uuid": "d02298da-6cea-41b9-a68c-5f5677392f79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940535, "uuid": "1a13be3e-1765-4b5b-baa7-7c02408fe7f2", "value": "cca09051ab8cc46e4f3fd27735d97497.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c24d7ac-eaf2-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1626961140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961140, "uuid": "8c9598a4-2f81-4e03-88de-ca0f3ced2485", "comment": "Malware payload (Gafgyt)", "value": "7381dadde2d22a166f09bf5029211568", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961140, "uuid": "4f3f6b22-4819-4226-8bdc-a6131a37e225", "comment": "Malware payload (Gafgyt)", "value": "a5d428c432f721d76817abd67c16056ff5acf8a9c9693a504c4bf0579d5417a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961140, "uuid": "8807cdc2-cae2-4fc6-b5fa-ad0dbbec2a84", "comment": "Malware payload (Gafgyt)", "value": "ab85d43ccabdac280a010339be28ce5aacf6611e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961140, "uuid": "6488df7b-7522-4ec8-8f0a-c2e4a099a716", "comment": "Malware payload (Gafgyt)", "value": "f13fea3bb10ca5c119cc028491b095251e72f3e061b2e0700b180413342e380203f072d798fdff5190ef9b36df8b66d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626961140, "uuid": "cb28b665-ab9e-4fb5-8b69-646f4ba3aa5d", "value": "T173833B47E9A19FB7C0866A7565AB5E300B13E9912B4F1A4A303CA7F8434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626961140, "uuid": "13909ad0-e9da-4e75-afe6-fc3f4f5f6deb", "value": "1536:ClN9YyOXmMSr4k9dgGwKGg0CfjGJC+dojMyTRLmkxVqOEeofzee:g7OXmMSr4krG3JdBQLmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626961140, "uuid": "0736ea1f-51fa-4f66-9895-52e63400e72d", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626961140, "uuid": "a8f28dec-3276-4e05-9938-86eabbe057ea", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626961140, "uuid": "2431b62a-9295-4f74-98d3-bdc35905d6c5", "value": "7381dadde2d22a166f09bf5029211568", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "177bf440-eab3-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626934047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626934047, "uuid": "e89e8f81-f7c9-4f6e-b0e7-0ac824e84f26", "comment": "Malware payload (Formbook)", "value": "9d9f2d5ba71372d4bbd85a9088ba7bc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626934047, "uuid": "e03ef290-12e1-4864-b2b3-b3eb0926a3cb", "comment": "Malware payload (Formbook)", "value": "a6169937c872aefc3f1e5c13e40f05d9cb0cbba3a16490f134b810b47027b035", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626934047, "uuid": "f4acb6fc-5d87-4193-b843-a9bf76cc1923", "comment": "Malware payload (Formbook)", "value": "353192974e4f523bdcb472478e5a652e194c6481", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626934047, "uuid": "3285e1f5-2fd7-4c53-bc6d-12cdf7fc7f65", "comment": "Malware payload (Formbook)", "value": "142dab4bae07cfa3744f2011d82e47c405b476d5168d63da09cf61471e6772550a2e7ae3b0f3f5ae12b66c8e9277348d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626934047, "uuid": "cb672f59-f6e2-495d-8f04-5a01c2a93137", "value": "T136E4D074A31BAB04DC3887FC1C25915127FAB81EA67DC63C3E58B0BC7DB36A856E1611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626934047, "uuid": "68da6b09-330c-4d87-8be5-c7c2b6381e0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626934047, "uuid": "f9075536-3bbd-471b-933e-abf2d0ac1bbf", "value": "12288:kTwHcxzSat9dTVv3NMHXE6544AhwFsyaUVKnp:swH4zhiF54izahp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626934047, "uuid": "cfd7defb-b086-47fe-aa77-3a9f8219e238", "value": 709632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626934047, "uuid": "268bfead-47c5-4851-b340-78746371428c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626934047, "uuid": "fbe1fa37-2710-4d72-a64c-d328ce044be4", "value": "uiza7XkNGQPRQvb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26796563-eac3-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1626940944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940944, "uuid": "bbe0d716-9b69-428d-9ea5-0b6d7915fafd", "comment": "Malware payload (ArkeiStealer)", "value": "b153a48172b1e3c4e93fdf40f704e4fa", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940944, "uuid": "ae27da32-1223-453b-afdd-3b6088dc5418", "comment": "Malware payload (ArkeiStealer)", "value": "a66228e6a0b619a07070c311713d3630b53a89a3e7fdd4b871859e001e693329", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940944, "uuid": "8d9b3f0a-1b3b-4211-8eea-44b98b8c65f7", "comment": "Malware payload (ArkeiStealer)", "value": "ff01494d36906e30b4a53ff9862420a3922cf7a1", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940944, "uuid": "8b39f3a8-cb21-4799-9749-1aab895ded1a", "comment": "Malware payload (ArkeiStealer)", "value": "e65809d21cabfe6f55c1379af597f397810ae1b4956e25afb5d81e8deb9f868356d9aab432ca9ffb2682517c35a7accd", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940944, "uuid": "884b2946-4783-4cc2-834b-522470fc5dc2", "value": "T1B3B54B1869BFD01960B3FE916EDCA8FBDADE55E3240D743B109153178B22B81DE8B439", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940944, "uuid": "ac8afa17-79cd-4b82-b5ac-4dc6ee9248ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940944, "uuid": "d7dd29e6-9cd4-4fb7-8ac8-7b14d9b097a1", "value": "24576:S62PqWtz+bEEiD5F8yPx1tWLSYsW4Cu39Ih32e4Vv5+c4/fkAlHipIIQxtVLmNXX:9EHE18", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626940944, "uuid": "4327dca2-6654-48d8-aac7-f26f1451c91b", "value": 2294784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626940944, "uuid": "c9ff56c7-6851-4047-8f7a-e3f6205ab685", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940944, "uuid": "6b8a315b-1039-4310-bda8-d65080279941", "value": "b153a48172b1e3c4e93fdf40f704e4fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c39e01-eab1-11eb-875b-42010a9c0053", "comment": "Malware payload (DiamondFox)", "timestamp": 1626933313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626933313, "uuid": "930b8402-919d-4a1a-845e-e24ff176124f", "comment": "Malware payload (DiamondFox)", "value": "bc08eb98812457e50f866ee0fefb974b", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626933313, "uuid": "36339fc4-8811-4dc1-a1ed-35929b8b3dd4", "comment": "Malware payload (DiamondFox)", "value": "a670218090f05c2a429b5ee9003371b14dfa1e6d1eac85108eec37fc84c5e5b6", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626933313, "uuid": "db5e2f38-f2e4-4b7a-8336-c67ab80a2d28", "comment": "Malware payload (DiamondFox)", "value": "442a332a73f85e2b3072a470c552ed4e89de1098", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626933313, "uuid": "1c703581-bfe7-4b4d-8a1b-42b4039970e7", "comment": "Malware payload (DiamondFox)", "value": "ee44ca7fb2e13c3ba09474d887a691007eab98ab8daa7ac1a0adfedfb1815cbcdffff11a5a83471a81959bb827e87719", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626933313, "uuid": "83f39e7d-82d5-4f61-9fd6-eaff4da4ca16", "value": "T1A8E533B8FD08717FD81BB9F929E85D0CB932DDD72619ED8A87A442283FA04D2D4C5178", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626933313, "uuid": "cb5e59d9-4921-4941-8748-cd4dde6a2cef", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626933313, "uuid": "cdf3cc65-5776-4ce0-ba1a-a89a9b9309ef", "value": "49152:EgGya2Czd6EVjzzai+qMGY0I42sIPI+7bQcm4B4Xm9KCAmTIRTPpCYo2pNmDfhuS:JO4EVjz7lMGNIA+gcm24Xm9Kjr2ZLhuS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626933313, "uuid": "f49c1999-9981-43d4-ba28-ec7eed8fda0e", "value": 3123815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626933313, "uuid": "c40955a7-117f-4647-adf2-ba5be86ee198", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626933313, "uuid": "44ad86ed-f929-45a7-a810-b36fbe138a7f", "value": "BC08EB98812457E50F866EE0FEFB974B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f19087-eaf2-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1626961403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961403, "uuid": "9c7c4228-4c82-42a5-8191-78b028f851dd", "comment": "Malware payload (Gafgyt)", "value": "d15183751fad3c2ccadd716c33a7e747", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961403, "uuid": "79fa8c51-b0c0-4469-8367-4c71bb41d5af", "comment": "Malware payload (Gafgyt)", "value": "a67e95eeec40105d7f9d92d79abcbc5fe3eb3453b3597b2b460e46f04723971b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961403, "uuid": "f36610de-bd29-4a98-9ac9-a80ee7c4b1dd", "comment": "Malware payload (Gafgyt)", "value": "a82d5e8df9202fd530247f2d8bfb89168f3a499b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961403, "uuid": "b8e3d962-0325-4cd8-b947-14b7b2ecb963", "comment": "Malware payload (Gafgyt)", "value": "5be33b6e386f8c16ed91e7c188b2a154e57a14f6a9acf520e57a50405015d7f1eff8ef9b00322cc8bfab974d1ee31765", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626961403, "uuid": "f1efcb23-b3c8-4d80-b7d2-8e6ff9934304", "value": "T18FA31A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626961403, "uuid": "26fc5301-a289-44a6-af27-02bcea62dde8", "value": "3072:VSx+i6mqaObhNMnPNKV+qKmZuqQ4DPwXXtse:y6mRObnMnP7qKmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626961403, "uuid": "689c8a8b-49e4-4351-ba1e-7efc65e759b3", "value": 100871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626961403, "uuid": "ad2ec601-c9cd-41c9-82ac-de83c9213473", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626961403, "uuid": "ad5a5b74-ebf4-4770-9e0c-de33d516010d", "value": "d15183751fad3c2ccadd716c33a7e747", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c293534c-eaae-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626932187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626932187, "uuid": "80b82866-7b58-4107-8838-5a065b60458b", "comment": "Malware payload (Formbook)", "value": "d3564945f7bca84c662520b8417d3b39", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626932187, "uuid": "d94319b1-fded-4410-a12d-7292de317318", "comment": "Malware payload (Formbook)", "value": "a6bd7955c36addf2593f1fd2ec04ea6557db2e1e2af523ca750f5923116994c0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626932187, "uuid": "7008870c-73b4-4a3c-9b56-a080df268178", "comment": "Malware payload (Formbook)", "value": "62699efe190636d3be8bb8391e4d3a38b150a527", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626932187, "uuid": "49cf2da9-9aab-47d6-88b0-4a087777d1f0", "comment": "Malware payload (Formbook)", "value": "16f1b7c84b2379326f3f7155d502ae89667f4b1adf8a19669c74c2acee06d08ad55e74fae8d4f97ae17f3fa310b3d949", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626932187, "uuid": "ae7297b2-e301-42cc-baa3-b89c53064c85", "value": "T126B423F7D4AA09CF81B263457983D21556A0BED3B5DD6287F8C5335B3860BC36082E6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626932187, "uuid": "8fb5a386-74ca-41a0-abdb-21e00eeca1be", "value": "12288:yMZvwoNf5WpZX3Bw8KqlOnrff3lwqOZfhXvp3+jSa:yMZYoNf5QJxpSb3+vZfh/pujz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626932187, "uuid": "87f9cc53-9594-4590-bd56-10bc89e5e53c", "value": 510810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626932187, "uuid": "7d8c4bbd-dbd1-4d9a-9e2b-fdd628b3f129", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626932187, "uuid": "6c7ef0b4-a3e0-4251-9b9a-4ab5541c38e2", "value": "Payment_invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7222cef1-eabc-11eb-875b-42010a9c0053", "comment": "Malware payload (SendSafe)", "timestamp": 1626938065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626938065, "uuid": "9797ff4a-9441-4157-b3f1-6998252cc470", "comment": "Malware payload (SendSafe)", "value": "251c861e3eccd02d7b2535ef55c869ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SendSafe", "colour": "#92E28F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626938065, "uuid": "cf609f88-34ec-4b6c-bae7-4fb5060b1e02", "comment": "Malware payload (SendSafe)", "value": "a6beaf180ecbb10d5f12d64d7f111b0a7b7f08ef01080cb5fc9316a45df7660d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SendSafe", "colour": "#92E28F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626938065, "uuid": "cbd3e2c2-90ab-4534-bf5c-775bb87d7b1c", "comment": "Malware payload (SendSafe)", "value": "a3c743df09e97c0a45e4871c151eec5db583ac78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SendSafe", "colour": "#92E28F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626938065, "uuid": "f5469358-546e-46df-9222-86b0279d85cc", "comment": "Malware payload (SendSafe)", "value": "11f87d07409c2e1474c8bc0ce71b94252a37433bd78ec9ea3a37c835bbac4273855b1cae4241bca660e9be7c10db22c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SendSafe", "colour": "#92E28F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626938065, "uuid": "fc90d337-67a7-4075-bdab-44c7a013fbe9", "value": "T1688501CB57A4C535D5882BB0E99D84A9880E5F5A6C580DDB7BBCC233B50B0177FA1B8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626938065, "uuid": "4c8cbe17-3d61-45a6-8ab5-7950bc4daab4", "value": "8ba7e9308373f504987c6030d7eaf6e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626938065, "uuid": "d460a82c-cc30-4cef-8be1-06ce0e428af2", "value": "49152:MotfzwlYpM1WbpHFKu1AKjQ1570J6hVNXqP:M6FpAWbpHFpAh1x0JiN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626938065, "uuid": "7c250d5a-19e2-4896-8679-2d841c5cb3d1", "value": 1860952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626938065, "uuid": "837cd41f-a742-43d4-abb8-ec6625f27443", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626938065, "uuid": "592c891c-ecbe-4d32-a0c0-58d9878521a2", "value": "251c861e3eccd02d7b2535ef55c869ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5579c27-eb0e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626973450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973450, "uuid": "2b4410f5-3724-4cd3-8cbb-970e79ddb6fa", "comment": "Malware payload (AgentTesla)", "value": "e5b234b445e81c5a55f21bc75eb40e5e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973450, "uuid": "82b23e6f-3478-41df-b223-7ac387be303d", "comment": "Malware payload (AgentTesla)", "value": "a76a64fda4a0e041ff234597f21fd66cf2ef66b2d3f56fea86316c997bb0e5bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973450, "uuid": "0e0d644f-3738-4ae1-9d99-77fe10b8707f", "comment": "Malware payload (AgentTesla)", "value": "f01fbe23b71016e967f30700c3b547bbf9ba1ef3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973450, "uuid": "e4a3fe6a-e00c-452c-9a9e-6187937abe77", "comment": "Malware payload (AgentTesla)", "value": "b81d8821a80b6a47fa91f9c43acc0b07a0c1911841002ff543290003ad9a2b585474c74d6f72009436fdc191e96d0aa8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973450, "uuid": "2cf2f2e9-7936-43e2-ba3f-7560d8b1a64b", "value": "T16DF4E178A71B9704DC3887FC2C68916167FA901EA31DDA783F98807C7DB2ABC56F0651", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973450, "uuid": "4ec9dd10-4abb-48eb-92ed-300385f3c939", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973450, "uuid": "11464745-38db-4ed7-af59-639987e79a8d", "value": "12288:XS+lyzDi60EZRXFqsWe35M6Y35rFoD7jTxiMmJlsasyaUVKnp:XS+6DBdhdWe35MjprQ9eljzahp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626973450, "uuid": "f5798532-12f9-40e9-9f61-d88ae6fb7405", "value": 778240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626973450, "uuid": "236b6b96-c8b8-41a8-b04c-7a4d4f9291ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973450, "uuid": "4122f6fd-8119-4097-b4f6-edfd66878417", "value": "PROFORMA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f5070f7-eb3f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626994271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994271, "uuid": "027f2228-4d42-4f1c-aec1-98ee99678a9b", "comment": "Malware payload", "value": "7ee3dfce2e67f47480241d8d0c3bffd0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994271, "uuid": "c8ef7c8c-fc1a-45f0-9c4c-492988d6cd8f", "comment": "Malware payload", "value": "a79dab47bc4941b27078a2fab8a02fbb2d3b2666ae859d0659eb8d375d8376e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994271, "uuid": "b3cc4197-a18a-4d0b-91e9-6362d0f9b3bc", "comment": "Malware payload", "value": "e3c331bdf06a0b4732515c245fbc1b52dc718842", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994271, "uuid": "51f6b817-6088-4a91-a899-b5c01718a80a", "comment": "Malware payload", "value": "790936c32d6321bfcc018ca5a6dcfa03a3fa27b2775dbfcc21ff6d41a97c06d3db091c23a699b6a038714453975ea2d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626994271, "uuid": "631ed761-7761-4903-8bca-c1bf90fbe4e8", "value": "T12272E79C78D7EB1AC1E0D6BBFA0B9BA833A553D8D2DB37138514934C968365D8F12B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626994271, "uuid": "52843a41-3a60-4eb3-8e76-39a792a4b2fd", "value": "384:Qzz5XZfdsKFZ6bWacwtd2/PTEWsajfo5eS:4plsKGWwtk/Pa3QS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626994271, "uuid": "e96be282-e47e-4c34-9b85-b46e7dba9a4e", "value": 15996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626994271, "uuid": "dec53cc9-becc-4abf-8ea2-50f99ec49e32", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626994271, "uuid": "136db019-580b-41b9-9c8b-d1a475b37ce9", "value": "7ee3dfce2e67f47480241d8d0c3bffd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a470996-eb11-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626974478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626974478, "uuid": "c9332eeb-4316-41db-b224-c18bbbfd3fad", "comment": "Malware payload (RaccoonStealer)", "value": "a1f55028dfca70ddb48f95e753352b01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626974478, "uuid": "943e7c1f-d1c7-4f11-a1d3-57a60292d7bd", "comment": "Malware payload (RaccoonStealer)", "value": "a91d1235d7b44e451dada8c9a827e570b7b83eb8790c065af88c0c974de5dd51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626974478, "uuid": "d5310429-b6ff-4469-9373-6ebe5c747eb0", "comment": "Malware payload (RaccoonStealer)", "value": "7574fe499d96951c75a695d4aca93afc969f9cb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626974478, "uuid": "89c4c33e-6717-40bf-ac91-7bdbf545f809", "comment": "Malware payload (RaccoonStealer)", "value": "082989e509c08ef8f93b1b21f1faa5f4df5cfe0fec9f83ab7dc22e53fd846d34f1e80a02af0db87b9c5d1aa99a462de4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626974478, "uuid": "29bc2278-49ad-4400-a3f2-1ee0fff72862", "value": "T19A940210F9A1C432D7E34A70A8F896A02A3F7CD2AA38850F775477DE5E711C1A66E353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626974478, "uuid": "76e1965f-89d1-4465-81b8-2632697366aa", "value": "a9059890404a9de63e79f558c8e2fa3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626974478, "uuid": "ed79e440-f86a-4a90-8881-e9b25e19f384", "value": "12288:0Rdcs63GXojy/VGejr88RXj5ePXTYyyG:04Fhy/AejrHxty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626974478, "uuid": "98c3bb12-15d8-4701-9549-dcdcd53197c4", "value": 444416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626974478, "uuid": "d8fb96e8-e755-473c-b824-ddf10d36c41c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626974478, "uuid": "b2fac451-9d46-4570-aadb-3a844a1827d2", "value": "a1f55028dfca70ddb48f95e753352b01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daa8f932-eaa0-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626926214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626926214, "uuid": "77047e04-c375-41e4-924d-30a93d23ca1d", "comment": "Malware payload (Mirai)", "value": "e43661e1c1f8734613d8072d9fe108c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626926214, "uuid": "4c4f7095-66e5-4428-a39a-f7950ec3130b", "comment": "Malware payload (Mirai)", "value": "a99faca25d9801c5199b088433f4c70c8041d4ab1d13d52687685476b97ba483", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626926214, "uuid": "ddf45941-141c-4b5f-8484-67f14d08df41", "comment": "Malware payload (Mirai)", "value": "ad8643f0793303e2f73f0a7fb8eb308200d3f44d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626926214, "uuid": "e34f5db4-5070-4a6c-bcea-3fd39398e4c9", "comment": "Malware payload (Mirai)", "value": "1e922db19f3b66b7ccce4ffe5d939ed695937b77534e9450f711b8425ac5cbebc21052b6c02d9cd01fed3072a2147709", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626926214, "uuid": "579925c5-29cd-4725-b9b1-22d25996ee56", "value": "T15FF2B416EF544FA7DC6FDE7389A81B4630CD954B22A427363670C538F26B14B49E3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626926214, "uuid": "52502db8-80ce-41ac-9e84-14c1c3ad8773", "value": "768:+khD/PGmnTi/YIxBHfxtGOFZdrec0e4ejQZTXgoXik+nQOk3fSTev:TD5ToJdFZdh0De0ZTQW+QOTTev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626926214, "uuid": "1e44f9fc-ec3d-440b-8bf3-8dbb2c71c7d5", "value": 34660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626926214, "uuid": "2c1a3b16-611f-4d1f-b523-cc93838d4f9d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626926214, "uuid": "54797122-b779-4e3f-a073-5e9ce3d11b13", "value": "e43661e1c1f8734613d8072d9fe108c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96295ddf-eb0f-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626973774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973774, "uuid": "f3bb23d9-51f0-449c-9ee5-446017c670a8", "comment": "Malware payload (Formbook)", "value": "351d96e9ca8eb437a9798ff51b56193e", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973774, "uuid": "25d3b84d-4944-43bc-8462-c31a4719522c", "comment": "Malware payload (Formbook)", "value": "abce0ea2750c27a38060bfc389b2587c2c644c78362e700434b6243d0bf9e718", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973774, "uuid": "5cfa8cbf-65a9-4e7e-aeed-c03c823d8b17", "comment": "Malware payload (Formbook)", "value": "0e20b1d17a6997e46cbb948f70b14df6121b132e", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973774, "uuid": "6cf669ec-7ed5-461e-b21f-617e06306ae7", "comment": "Malware payload (Formbook)", "value": "a1d49901fa7d9a522790839d8c8e5f001c6f465e243a6aa37f64c5cc24e38c0bbd0acd90dc2dccc90983d29889b1b096", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973774, "uuid": "996136a6-fec4-47ed-8a3e-ef2dddf1c083", "value": "T12F5512B0B8F10753E0760771FC7387D0A55EEF69136A784CB18EB8010E7672A82A46BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973774, "uuid": "3a697b1a-9f16-4de2-a343-da97ea90ac29", "value": "24576:kT/wWzqFABiZm+pQNGDuiHPFjDoI0DhT00E6SyoR5vkPcCk9a:A+uiZnfuMkRhT0h55cPG9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626973774, "uuid": "a3bc5653-e5da-41f0-9aee-10bb1ac9886b", "value": 1310208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626973774, "uuid": "80b8d671-8427-4a99-873d-a72f9ec66c21", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973774, "uuid": "1d1b99a9-ddcf-4c6f-afca-84c4be6bd891", "value": "DHL 07988 AWB 20210798.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "433b3256-eb04-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1626968910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968910, "uuid": "f1d9a895-54e3-43c3-bd0a-7317319495e3", "comment": "Malware payload (Smoke Loader)", "value": "73d3a78e66a6b595b0bfacd301d2c518", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968910, "uuid": "759b576a-66cf-4231-80ef-2fc3f72dfe64", "comment": "Malware payload (Smoke Loader)", "value": "ac4a02bea52792524b42d95b70128893d27ba266096832783bdea10ce780591b", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968910, "uuid": "9f820024-c408-41a2-b59c-5f797d48aada", "comment": "Malware payload (Smoke Loader)", "value": "5fa9e9c66f87d1c761cff8e5432e43825e8cc28e", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968910, "uuid": "39732fef-0f3a-4358-8e56-9ad12f7550c5", "comment": "Malware payload (Smoke Loader)", "value": "c7dad043764edcb6d2ecbf95184cdefca4a46884a809afa2611849d5dfb4cbe03e65c6726024785d3cc4dba275e8156c", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968910, "uuid": "7f320881-608f-4f9c-8eec-f65dae0a7399", "value": "T13914C0207591C432C5E20A3854E5CB957E7F7C22DB68C94B3B5526EE5E303E1A96F30B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968910, "uuid": "ee871206-fe1b-41be-8714-49983915fa11", "value": "ed31136d7e99c845aef2cc9c35374011", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968910, "uuid": "5fb4dd39-1306-4487-9f35-3668c27e3747", "value": "3072:SABNFpY0Rzrhd83fvCJPFwLOMlvfftYP/jLJDwX4T45ClRswbL:nVZrhivM2LO8fftuLyX35ClD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626968910, "uuid": "43ba05fc-dfcd-45e9-aede-387e1b2425b2", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626968910, "uuid": "61ca868e-33f7-4479-9c70-8410bae775df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968910, "uuid": "e7364deb-70fa-43ae-a693-3e1446fd644a", "value": "73d3a78e66a6b595b0bfacd301d2c518.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd93ea2c-eadb-11eb-875b-42010a9c0053", "comment": "Malware payload (DiamondFox)", "timestamp": 1626951613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626951613, "uuid": "5551db20-c096-4dac-88aa-772540380039", "comment": "Malware payload (DiamondFox)", "value": "bd6fe266f81a88abe3c95129bd77757b", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626951613, "uuid": "70764dd6-9975-472c-8c45-54c61ce4c3cb", "comment": "Malware payload (DiamondFox)", "value": "ad059ada4911aa16829da483216cb466f07613edbc0f9f65a5ffd04ab1ea1732", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626951613, "uuid": "fb8ac334-bd92-4b95-a9af-097f909806d3", "comment": "Malware payload (DiamondFox)", "value": "63d464262f4d7b865bda334f50ee8975a38a57b0", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626951613, "uuid": "9ae24a22-ea53-4e56-86e5-09c0ed434bb5", "comment": "Malware payload (DiamondFox)", "value": "3645d92dcacf2083088d13892bbecad3fb0c0387b3db2682a2462e7e93f67706a60c602e6349806ed03b3b1facf2d883", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626951613, "uuid": "e61cf21d-5ab3-47ee-8f11-a575c763af0b", "value": "T166C5334A3D368347DD748E3C6DAB1553CA7AF906268D07CD574E23A8368D3F2849DB0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626951613, "uuid": "813e96b8-97b4-4607-86fc-5491442a0fd2", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626951613, "uuid": "f3febe45-cd57-47e0-a374-4db3ce0c301f", "value": "49152:Egzemi6aM0D6DbiCww9fbZbuD4J0LGol/13qViuFYAFL8iObHFAZ77cu+:Jzi6aM0kikZ6D4mCS/18K1VFSXx+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626951613, "uuid": "0a1a037c-6be9-4fbc-9d2d-944edbc6465b", "value": 2615434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626951613, "uuid": "bbd6d95f-d202-4eb4-aa7f-6abe987f9769", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626951613, "uuid": "691709c2-aa3a-4c46-8cb7-4f60cf2c7f81", "value": "BD6FE266F81A88ABE3C95129BD77757B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb28905b-eb03-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626968762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968762, "uuid": "bdbdeda2-d466-4c11-abc7-8ce0af400956", "comment": "Malware payload (AgentTesla)", "value": "e85a0e1e81acbcea6a0e10eeedf32f6d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968762, "uuid": "f06dd8dd-ada6-4518-bed4-2c2ac79d3ca7", "comment": "Malware payload (AgentTesla)", "value": "ae7399822ad5ef4d9bd2690df74f6f1b472103380be74fca33611ce7265ebc01", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968762, "uuid": "0ddd42a7-ffdc-4010-beab-1275dee4bfa6", "comment": "Malware payload (AgentTesla)", "value": "3c613a4d232645cccbc7c1d8a3a8afb54cd2d56c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968762, "uuid": "75f07d67-545a-443e-8a69-3da9a8a0d0d5", "comment": "Malware payload (AgentTesla)", "value": "6d892a50d6e65c6b25754161c7ca7c42e43c153081eaafb860ef4f5f3c632e99fc4d88d915a015abb98b8d63f6e2f651", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968762, "uuid": "82a63f6a-245c-423b-8a03-6807a08dea1d", "value": "T1D215CE2D721BA634DDF183B68C9E81511BFEA41FA60AC2352DB8DEBC387376845DD085", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968762, "uuid": "e9a47be6-ca2f-4e17-b98c-f0ccdd84d93f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968762, "uuid": "fc86f90b-d87c-4a02-a1f5-1aa70b85ed7b", "value": "24576:o8mDgYIvzz43Apj32FeC/V87ZXKzahp/:e1KHcApj3ql87EO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626968762, "uuid": "768f801d-6b21-4ebb-bd66-b2513e17b2a1", "value": 918016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626968762, "uuid": "a1749f06-ac9b-418d-9d7f-d8e34050dcda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968762, "uuid": "0cce89bf-b0d7-43bd-9783-500ac95cc0a0", "value": "e85a0e1e81acbcea6a0e10eeedf32f6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f084454-eaa3-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626927188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626927188, "uuid": "7759df93-3c8f-4437-85d6-10705494dd80", "comment": "Malware payload (Mirai)", "value": "4c1794bd08478b348e31fe061c5c08e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626927188, "uuid": "f3055e20-51d1-4c0d-8429-88c927f1eb12", "comment": "Malware payload (Mirai)", "value": "aee65b3730867cd097ceb572559bc86dcf710d3faffb6dc2666bf8ec2f9c485f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626927188, "uuid": "e1bcca8e-0a20-4019-b94a-46de0bcb0438", "comment": "Malware payload (Mirai)", "value": "fd103a879df5c1b1d7afc1862bb9cc485eef8311", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626927188, "uuid": "396dd566-1bcf-4059-867c-ccc91a093bc5", "comment": "Malware payload (Mirai)", "value": "32dd3ede6df1ea018e31611dde65ac225f98464f2bc7ae9068dc0efe08227be702b42f3165f48cde3dd79f4b064407fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626927188, "uuid": "a1cb2993-9a09-4cc6-b774-7a8566ae1b35", "value": "T113E24B35BE62186FC4C85E7A55E74725B6F6434F38F88A3B3C220E9CBF04A447253669", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626927188, "uuid": "5c2f0c8f-5426-4b9f-bb6c-887eefc9acc4", "value": "384:OGHQmVI7tBJ3aXoOCZM4P8IFU+pMqdY9HlMaGACqq8jDw:OwQmVI7l33FNO+uKaGACqq8jDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626927188, "uuid": "0332741a-a04b-4389-835a-61439c32f9aa", "value": 32920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626927188, "uuid": "25797938-ea29-4965-ada2-bd8faa74d1e4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626927188, "uuid": "89a772b8-031e-4e74-b456-5340b04747b0", "value": "4c1794bd08478b348e31fe061c5c08e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0228b43e-eafe-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626966224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626966224, "uuid": "79258cb8-1137-4d21-9d03-86542aa4f6f4", "comment": "Malware payload (AgentTesla)", "value": "ccdf27ccfb2e075cc8875fb0a925c151", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626966224, "uuid": "2714af03-6ef4-4f24-8e3c-99e38438ee7f", "comment": "Malware payload (AgentTesla)", "value": "b0407b75e7659930d5bc07ed877d82727eaf74b82fbe84db63186f2fd33f9ff5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626966224, "uuid": "2602e800-d794-4e6d-a439-6df3171036e7", "comment": "Malware payload (AgentTesla)", "value": "6fa51588abf19fc4e37720cfb62cbc93a3120425", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626966224, "uuid": "a211fcd0-37bf-4838-9d99-21ec57d361ab", "comment": "Malware payload (AgentTesla)", "value": "a9659bf3281508ff28fb5126fad939a1e409237a71c383f0dbc8151dc59a412ae6f27f120679fe2763d7681b21a21cdd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626966224, "uuid": "d5e9e160-f329-42e6-9faf-3c7870c5a7ff", "value": "T1A3332C5CC89B0198CF89ABB85B5B2E58214C376EF789493670BC977853E2D3E601287D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626966224, "uuid": "cae377da-4215-410b-a2f9-eeb99e505720", "value": "384:MbxWp3jBeDqX/0Y+aBXVw00B3ST2YNXaqaD+j:kxWR1eDqX/BYwHNl0+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626966224, "uuid": "9c3daf17-3734-4c26-8b73-3b395c5b4c46", "value": 53331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626966224, "uuid": "eac1b137-f636-4426-ab41-91f73abc28d0", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626966224, "uuid": "21d0c69f-d4aa-4047-bad3-0acfce784b20", "value": "38373-invoice.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02524d82-eb04-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626968801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968801, "uuid": "d60ec85b-b2e7-4bc5-87ad-1e6bfff28f28", "comment": "Malware payload (Formbook)", "value": "de87f1794377537dda721afd9137e491", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968801, "uuid": "c660c06e-78fd-4c84-aea4-fdb6b1a917f1", "comment": "Malware payload (Formbook)", "value": "b0a684c7dfc5a94e3dd2edcb1c706eae088ff9d701ec55f0adb1ae977e5e9081", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968801, "uuid": "35be6be3-dbbe-45ec-b89f-028426a9288f", "comment": "Malware payload (Formbook)", "value": "3b0480a4afe176722d9b8cf6f9f9c9257b1d132f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968801, "uuid": "3190f090-66f4-4a5d-b05e-d3d29c42c044", "comment": "Malware payload (Formbook)", "value": "69f5446db8b274ac98ab225a37549d9fc0416de09762c2893983d88de05b7c3b035c2389f9ad613fff5c92f80e3f4465", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968801, "uuid": "ae0d9bc9-5020-4ef6-9708-45d94820d7c2", "value": "T156041259673C1B84CBA558301831233B7486F673408FD1FB5F4CDA6CA8A96E96113BCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968801, "uuid": "3815aa52-af5d-42ad-8c64-922c65c77f4e", "value": "10de39a2884c15c1630de9015f14f501", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968801, "uuid": "045709e9-5b4f-4d25-ab28-d7f7aed7cc43", "value": "3072:vMWOOOOOOOOOOOOOOHQ47MB3Fvd3cvtS99ZwlRtlL79ZF5/CGnrN8pCcFOOZPJIZ:EWOOOOOOOOOOOOOOH9sxd3+S9CRtlhEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626968801, "uuid": "c5c755e2-9171-4ff2-be1c-489b72bb3755", "value": 177067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626968801, "uuid": "ddf8672b-254d-4f3c-831f-fd683cede527", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968801, "uuid": "13eb3d5d-adcc-46ad-8e97-8dd0bc4a12e5", "value": "de87f1794377537dda721afd9137e491.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "863e52b0-eb24-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626982766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626982766, "uuid": "d7f59e42-5e03-45dd-be69-51435b339394", "comment": "Malware payload", "value": "48b86834eae4754427c9de930bd9ce90", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626982766, "uuid": "e55d0006-d654-4b60-a8a3-3959097f0275", "comment": "Malware payload", "value": "b161eb34e5513131f4b0a4c0318646ed3448122445d7924e03ff5822a6e2d2dd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626982766, "uuid": "60365318-722b-451e-849a-ae96eb0c3001", "comment": "Malware payload", "value": "cdcd3bcb11ed490a9603808347455f52a1676ec8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626982766, "uuid": "2adf1250-e83c-444a-8302-e01985540a64", "comment": "Malware payload", "value": "4ee0d2fa395e30f963de6f47df425dd2487ba4044cac2fc585b9575de3fc4dd0b1cc181b70e24f445f00f453ab9fcaf3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "PNG", "colour": "#C87515", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626982766, "uuid": "3af62b7b-9f15-48eb-82c2-37338062f708", "value": "T1DFC4CF2235E08577C4EF16345E667778A3FBBD942BF2C147679A891C6D339028B22327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626982766, "uuid": "8b9ccef4-2a2b-48d1-99af-6e066f4a42fc", "value": "f3deb6209dc9c95daaecc9f849af840f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626982766, "uuid": "fa959160-2d6d-428f-aa92-9f9e9cf79d7f", "value": "6144:6nhWubOStZ6AbgmgwLp3gUhWeGtLOPc/woVPHma1MXohuPATdTpNSTrbkYW412ph:6nTltgBNwxgUXw/DGaXhu45pI3rep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626982766, "uuid": "8798e53f-b2f7-4d29-89f8-aa8a5fcf807b", "value": 557056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626982766, "uuid": "f2d4a7d5-ae2f-41fd-bfc1-aceb58d52db2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626982766, "uuid": "b110e622-48fd-45db-973b-39d5bb0b45fd", "value": "http___142.11.195.33_images_lovemetertok.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23fa6975-eaf5-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626962415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626962415, "uuid": "ca0776c8-c830-4180-93a6-5cb0277f5a78", "comment": "Malware payload", "value": "636350f28a3cdccc10002d8b89a361aa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626962415, "uuid": "ef6473ce-29e8-4717-b815-f683e31d0827", "comment": "Malware payload", "value": "b162c6e6d251bdfa02f4adbe4fd21cc3678f16a07a678fee15ae69a2649bbb0e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626962415, "uuid": "437f9009-26f0-4bd6-bc7a-f97e3fe3a37b", "comment": "Malware payload", "value": "c49a1498eb959f9f19bcddef8efa27f7455a2450", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626962415, "uuid": "c490a352-077c-4076-8a98-21021bc2bd6a", "comment": "Malware payload", "value": "0b5b87403b15e51a4cfcc2cb557e0060f232e292e004bc67ee6cda5c34a667fc51a0c1d4fcd03166fff3f329736d8f52", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626962415, "uuid": "dcf05d39-444b-48fa-a097-a94caa2afdb3", "value": "T1EC42E885FD92D191C9CD13BBBD1D89CE3302B3A5D2DA3292DE0D5F28B2CA54D0E65583", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626962415, "uuid": "16d1cde8-7cf8-4a5b-ae06-4cbde0848bf4", "value": "192:ClcTnOaDjV79bAT9SK0WIyDZA0LB9XYkTl89Vlscw8a+CT6uBOR0n:CMnLhb4FlDZAsB2Jh+8avT6uB9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626962415, "uuid": "f06459ae-8f0c-4416-9ad6-abc385b4e69f", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626962415, "uuid": "98d6150f-78bc-4779-80f0-3c5f0d22eccc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626962415, "uuid": "80553e91-b6fb-4b83-a29f-b2e20cda8a1d", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d2a6dfa-eab3-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626934111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626934111, "uuid": "c32e546d-d6b6-4617-a33e-7990f21914ac", "comment": "Malware payload (Formbook)", "value": "a88ede93b065e5cffca40acbcf5c211f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626934111, "uuid": "e11ca446-4e04-4e55-bbc3-4e86691a5d56", "comment": "Malware payload (Formbook)", "value": "b1ea67aa792591a3a7fe1e0666c1d156e33a225742e9af401d92cbc46e24ec3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626934111, "uuid": "65c2708c-1400-42da-b900-5468919e0ba2", "comment": "Malware payload (Formbook)", "value": "d7c10bbe96a68661a5c782b6e23717b6157e77c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626934111, "uuid": "6f4e7c24-ecec-4714-9694-860e0ecf69e1", "comment": "Malware payload (Formbook)", "value": "df2194d0f778ad0747eadc8d93ed43b1ab4d068b4c19275f8a01554e65983190c35ae8225b416ae7d1542890ddc77ba3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626934111, "uuid": "0d22d24e-9ce2-445e-8ed4-443e18043893", "value": "T10505CE35F227A748DCB4C3FB185891612BB9BCD9721AC7396E94B0FC68736786AD1310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626934111, "uuid": "1c6adbca-4359-4bc6-90fe-da730d476678", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626934111, "uuid": "b93ffd0d-2d60-44ac-8bb6-1f61faeb1ff2", "value": "12288:oyM+58WR1BM3MGYgZvwDRI86BBut8kmVIHPdgWTMyaUVKnp:j5fLBdKZvg56BGeOHXTTahp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626934111, "uuid": "0ae051ef-3890-4282-ac88-a006c056a60b", "value": 833024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626934111, "uuid": "443e795f-b24c-4581-8229-fece00749294", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626934111, "uuid": "d00df499-601e-4d24-9e91-e8db8b7efd5d", "value": "Orden de compra cotizacion.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e34864-eab3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626934207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626934207, "uuid": "af8fb213-bfc1-415b-9b33-043315207102", "comment": "Malware payload (AgentTesla)", "value": "a0a630a119b19ef3d8e9987371121373", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626934207, "uuid": "c6bc0d3f-f82f-4bd2-a3b1-afb255b928e8", "comment": "Malware payload (AgentTesla)", "value": "b2708f388708fd87b4b362bc00be90494d27daa7cbd4624907501b2553473ff4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626934207, "uuid": "a1e16150-e4cb-482a-b1cc-1a2e2fdc8b00", "comment": "Malware payload (AgentTesla)", "value": "583201161f8032ea1045eaa46741262ca2c90474", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626934207, "uuid": "9aa5f9f6-c302-4b0c-8308-ae48ee8e27ef", "comment": "Malware payload (AgentTesla)", "value": "34b1ca88951d52cd27e8746a25ccd8e10b68c53bf2550f036fa0c9746d18033f146f88668869c788975be518c40d0031", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626934207, "uuid": "668b5ddc-e0bf-426d-96fd-348f371f74ce", "value": "T1C5159D525DCF865FC2680DBA5771AC4682314DAA2A49F3132EC134EDD93F2EDC99F602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626934207, "uuid": "8f429b65-0c8e-4a85-8bd8-e64b88e0a7c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626934207, "uuid": "b996050f-531e-4c67-b723-1fd0adfcad8c", "value": "12288:q7ZYu8/mlup3CHOBjJ/GH8AEgQVyRWEAu1TGdiSMPQipP5q:qtYuGZ3MOxJhNgRRv/eipQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626934207, "uuid": "79e4d4b2-d26b-46eb-8449-f075de6a9012", "value": 924160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626934207, "uuid": "a0aaa148-5ed2-41ab-ab88-11d2eae8e6ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626934207, "uuid": "8dc17a18-275a-4a28-bd4c-fc797658f471", "value": "Specification Requirement.001.002_003_0555.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e51031-eafb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626965044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965044, "uuid": "61072dfa-67a9-4f53-8918-cf61d52c6062", "comment": "Malware payload (Mirai)", "value": "d0fc63f83949da52df045f90774099a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965044, "uuid": "cb83ffff-ce6d-40cb-ac34-4519f3e0faeb", "comment": "Malware payload (Mirai)", "value": "b3a30b12fe85fb9664bb5a87a508ab0510c2c1b8d4115a2617f52517fed05f73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965044, "uuid": "7fa3bafd-7a45-4245-9181-30de9f761b6a", "comment": "Malware payload (Mirai)", "value": "60029adb756a26f66e5dfc316185783d84ab4ab2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965044, "uuid": "20facd60-052c-4c51-a02e-93bbb882d617", "comment": "Malware payload (Mirai)", "value": "10a8c1a3ea8545f2ddfa3871249ad8444818018defd96420db444a4830bc1f8a2684c10bc8d996273d514406aa609f01", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965044, "uuid": "f85f6575-40fe-418c-865b-91cf83a4961e", "value": "T17D233AC4B583F8F9EC15457C307B97729EB7F43A603AEDABC39994239815601AA072DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965044, "uuid": "68880335-0a42-4dd1-bde0-58f76d25a500", "value": "1536:4LInPCqAAXJLE7cxtdG8NCqBNM7vk9YXPSP0Hoa:FCqxpE7cxtdG0Cqvsvk9sSMHz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626965044, "uuid": "ac4c5ab9-7964-42bd-bffd-0975c837c088", "value": 49752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626965044, "uuid": "83ef56bd-0a19-44a4-b1bd-db9181716903", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965044, "uuid": "0394cc12-7095-4583-9866-58abe7102bf0", "value": "d0fc63f83949da52df045f90774099a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec7ed9c4-eae2-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1626954591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626954591, "uuid": "19183125-44a7-4528-a410-e04ddaa3a190", "comment": "Malware payload (AZORult)", "value": "302b089cdad737572251ed036c828168", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626954591, "uuid": "c7e0982c-31a4-46d3-90ba-2ae5f3f6dee2", "comment": "Malware payload (AZORult)", "value": "b4f58a5e9cc1c3b94f848aeb3830e9e28a38ec98cc6ec3337661d7b17c08e358", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626954591, "uuid": "e118919a-45e0-42c4-a359-2473812b8f28", "comment": "Malware payload (AZORult)", "value": "a22de587007bf85f3998b4cdde2e794409ea0c0b", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626954591, "uuid": "2bf03acd-f98f-4586-b78a-50de9db7dae8", "comment": "Malware payload (AZORult)", "value": "f4728ed461a5acc2f7a7320e30ca51f3be6a6e0e26f729400e1aebaa9a8c9ec982c4d8073826e4af392dde83e8e66e14", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626954591, "uuid": "73cb7adb-1789-4b92-abbb-63b4023aa8f9", "value": "T1B503BE4B91719C89C4F78F78800680A6D225A8C0416BB6895D80B77B6B8B0FA755E2FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626954591, "uuid": "2fdfa8ca-8942-43e4-9467-1284560d020c", "value": "768:bgZWN3K08+AJP/Ui5ZjluSQS+cCL+Fj9/IyUByM/IN8iItsBd1VYSKy7oCp8RlW8:bgqa01AJjflupcCqFjWfGPBd1R3o60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626954591, "uuid": "22c7a664-8eb4-4bae-809d-b4e0b078342f", "value": 39630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626954591, "uuid": "4d3a5f11-7378-4555-8719-6e3514c97c8d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626954591, "uuid": "c08328aa-f649-472d-887e-1a6eed36df05", "value": "MUN_2207.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e444c5c0-eb21-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626981636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626981636, "uuid": "c0af9da2-78e5-4b02-883a-e8bca66b291b", "comment": "Malware payload (RedLineStealer)", "value": "ad4c4594a0dab8bd5e304bba26531f55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626981636, "uuid": "2f217366-90e2-42e8-ae14-6b8f94b32121", "comment": "Malware payload (RedLineStealer)", "value": "b5e1b81807bd2689a4e3aa59e3ac8fa87ba36c249a44ee705833bc5b6baedd18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626981636, "uuid": "9cd4dc2c-6fed-4e47-a732-a25880e601f7", "comment": "Malware payload (RedLineStealer)", "value": "9db988f5870728c2a369e931e8dc6ab9574d4d3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626981636, "uuid": "cd1fcc06-358f-4b58-8861-fe55d04c82cc", "comment": "Malware payload (RedLineStealer)", "value": "8b2fde63dbe14d0bfce8a7521b1b2e9d46399fe65677e327922e8887b89388e14b8c3570ddc1fdb9fb35d3718539c72b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626981636, "uuid": "c5b323ac-e1fb-4529-9156-2db8b1e031f1", "value": "T120953303D5AEB8ADCAC71431AD3CFFD3212DB97F38A1159BBB59D415E180902F989227", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626981636, "uuid": "25e20b7d-aeab-4d32-844e-cb0298921c9b", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626981636, "uuid": "2173b71d-1406-49df-8c0d-48b8609efc26", "value": "49152:EgWs9W0CxbTAR+9F22uNI9Jadl8lfc3XxRy0cca0g8GrrbeyWy:JWsU0KXA+dral8yyYO8GiyWy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626981636, "uuid": "de402e21-60c0-49dc-9c07-78e48c06ef4b", "value": 1995523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626981636, "uuid": "c1ec4a36-dcf5-46f9-9b54-2feddbaac1ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626981636, "uuid": "aa4adcba-8231-42f9-84dd-0de6056e6279", "value": "ad4c4594a0dab8bd5e304bba26531f55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f5627aa-eb3b-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626992445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626992445, "uuid": "313fb126-fca1-4469-b89d-1d436cb9b2e0", "comment": "Malware payload (RaccoonStealer)", "value": "c9fc03ae8ccf60677cfedfa93fb41cf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626992445, "uuid": "ac100163-a70e-4456-bfb2-4d7f52a5da02", "comment": "Malware payload (RaccoonStealer)", "value": "b5e3ebba289b7a666d91af6ca9e80d973ae0aecc14f12df0657490d910df166d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626992445, "uuid": "39eb0774-d3ef-4914-9119-99e32bb644ce", "comment": "Malware payload (RaccoonStealer)", "value": "d63d3c03373f7a523a23f1b131bcc66d11ce49f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626992445, "uuid": "e84009e5-aa62-4e43-8903-58bab20bc694", "comment": "Malware payload (RaccoonStealer)", "value": "3d793a3b409665048a8ba635c8e2467a92767a0360dad0d5b3a1a742b70d6e3876dd7ec1cc316a88ba7d2d61addb33c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626992445, "uuid": "783e3f02-0aad-44da-990c-ada9ce8b54e2", "value": "T166D4E0017190D132DC252D394465CB685EABB8329F168E8BAECD2779EF307E17B35319", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626992445, "uuid": "20cf1c2b-6c2a-4408-ac6a-8751e6cbcc34", "value": "6a72306840a854d575fa6619d1f51527", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626992445, "uuid": "7c9f822b-8e78-4e76-9776-31fbd4534a86", "value": "12288:AlJy+0iYPtRT9JuIf2+7hAENmhngVJLmUxx:AlJytiyb7z2+72ENmhLUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626992445, "uuid": "dd545772-559d-4b22-80e5-cd3d7625d245", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626992445, "uuid": "1b3f452a-1fb5-49c6-bfef-ea87d4d7bcdf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626992445, "uuid": "31e2cedf-4e7a-4c93-a7e7-06ca842b5455", "value": "B5E3EBBA289B7A666D91AF6CA9E80D973AE0AECC14F12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6942e57-eace-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626945991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626945991, "uuid": "faf277c6-b855-49b4-bbd8-56fd100d3a2e", "comment": "Malware payload (RaccoonStealer)", "value": "aa717550158faf72a3776ce7115f80d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626945991, "uuid": "7d318460-6301-43f1-8359-c09f9126262e", "comment": "Malware payload (RaccoonStealer)", "value": "b61998322190573353437177fd9a48263cae5d867055800d86b5fcf006253fdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626945991, "uuid": "b85057d3-aa83-48a3-a389-d8beade102da", "comment": "Malware payload (RaccoonStealer)", "value": "6d0bbf0b16b7f9e5948c18f488b5428b329821f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626945991, "uuid": "d88315c0-b164-456a-bef7-75e69e03a85e", "comment": "Malware payload (RaccoonStealer)", "value": "7aafb89f4fb1390f29e9b37ab543338b4cad97b1a9af2958619ca3551eb3984c383659a2f4ae7dba1d60412676479e5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626945991, "uuid": "37c1c251-df10-4939-b767-5579572c8531", "value": "T192B4F15071B1D977D1E60A70587CC2E4393ABC621A74BD4FB2973E2B3D312A1B676382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626945991, "uuid": "5121b417-9ad4-466c-92a8-2b8fb5b25e07", "value": "9500feeae6f2027f3e5f8d8ceaf88edd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626945991, "uuid": "e4d21c25-a691-4182-b622-a25527c41ce3", "value": "12288:lI7ZRLRib1HDDNR57wPf7mlLmhwpX9zYWDv+2XBJ:WFib1HNRN0iaSpvDv+2XBJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626945991, "uuid": "73c60472-4967-4831-a611-6a9d7b08a79e", "value": 506880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626945991, "uuid": "82ad98d0-2ebd-427d-8ab2-c593582fb497", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626945991, "uuid": "697f7dcc-2358-42cc-a6d1-e6f0c8364c6f", "value": "aa717550158faf72a3776ce7115f80d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd4fc2f3-eb20-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626981168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626981168, "uuid": "ec474ab2-7f31-4400-93e3-7277c74e8d1d", "comment": "Malware payload", "value": "772dbe40c5ca30bbb28c3665df67aa33", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626981168, "uuid": "5bc6ef56-61a4-445e-8872-0970cc34e2dc", "comment": "Malware payload", "value": "b65038e3bc229cd01571c7a62fe86c433ea2d316d81f111dec27632fc7ea2857", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626981168, "uuid": "e094af28-7477-4c92-878c-6fba0a85ef84", "comment": "Malware payload", "value": "2c79f84a56941848f1b79c7ca3095fb53553c56a", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626981168, "uuid": "169882f0-10a7-4655-aae1-720ee38fb35a", "comment": "Malware payload", "value": "428c9b2830c410b8038010a6d7e1d131e56395c978bb06d9c9838a3126ba61c7bcb0f82e0c87b20a419c410c980b4067", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626981168, "uuid": "48e43253-cfd6-49fe-aea3-6a5c87aa8e11", "value": "T181A423067FCE4DC6360C78D328A6328C9451A7ACBDE190ADCB0C5795233686E45FBEC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626981168, "uuid": "fec720c7-ff79-4832-b289-143a04b0cadf", "value": "12288:pHB7/k5GSHXpDjdsVBLXnwvZq1YQSgPHA2028jkX:vOXFG/jwxqqQSsgj28jw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626981168, "uuid": "26aba5c5-d69b-42ad-811d-6bf2167afee5", "value": 478454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626981168, "uuid": "a8ff8036-79b2-4125-90fe-270f5cd52883", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626981168, "uuid": "deb6fa03-30c4-49f2-8a55-b6f2daeb9a18", "value": "CARGO ARRIVAL.BAT", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bd71ad1-eac9-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626943638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626943638, "uuid": "a989bba3-d17e-4f19-8822-326bbbf139d6", "comment": "Malware payload (Formbook)", "value": "89cfb542cda6a428cc5c02feaf3c55f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626943638, "uuid": "0233fa34-dab4-40f3-970e-bc30175caf37", "comment": "Malware payload (Formbook)", "value": "b663fea76aadbf574e5bb9f704ad689ec10f0d720b0b9641e70b27494fe4cc17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626943638, "uuid": "8a08d2df-8a87-480a-a96b-b58608b7df36", "comment": "Malware payload (Formbook)", "value": "9a0606c633ffe5ae4b6dcb7dcfba57b7e22cb05d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626943638, "uuid": "eedb4ff8-928b-457d-952a-6eca32d79695", "comment": "Malware payload (Formbook)", "value": "fbeba4a03829b5c8e983a3c7e76d410aa8cda9cddecfef8ad4e76fc07eb580745b9809d1fe8b859c55841182ed29a734", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626943638, "uuid": "1af6f76b-4abe-4f73-8728-1100e2d5fe38", "value": "T1031412870B9FAB56C261D3B7429CE93BD636A1F3558F422B1715F70B80E11C44616F83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626943638, "uuid": "71bc5b49-74a3-40f4-835e-a2bb2ff89ca3", "value": "ad7593902351b94d30c5d42690419916", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626943638, "uuid": "be88148b-b497-4056-8fe5-3ab922e51d7d", "value": "3072:p5y2zSw5QFZ5h8gOgXN15tm4Inoll4wegWYXzb+f3iIvwDrqvHDlkNBKrD9CafOn:Dy2OVbFvLKzTwePi+nQrU8+fLBcMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626943638, "uuid": "d398afbf-8043-415e-9a07-538b3aa64bd6", "value": 198124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626943638, "uuid": "63fbfe66-c623-47f7-82ca-93103a52d842", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626943638, "uuid": "02dff9dc-172e-475d-8bb9-ef6b1637f24e", "value": "SecuriteInfo.com.Variant.Zusy.394472.15672.20727", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f73b04a-eae9-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626957334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626957334, "uuid": "99478f24-073e-4cf0-9b2e-530848fd5192", "comment": "Malware payload (SnakeKeylogger)", "value": "78015f9defe5b97192708769bd57afc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626957334, "uuid": "6ffc7c75-ce00-4d59-a692-f44297e54bf1", "comment": "Malware payload (SnakeKeylogger)", "value": "b6f371e3895f840676f1b3716f92f078ae5b57d80b19adece970e4e013700e60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626957334, "uuid": "2d738dcb-354b-45ba-a2b1-416257684e74", "comment": "Malware payload (SnakeKeylogger)", "value": "c415ba40d88e682fc6aaf2932ab598b1c3f2aeb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626957334, "uuid": "36b9be64-7257-4507-924b-86e2f5d64711", "comment": "Malware payload (SnakeKeylogger)", "value": "0cf790ac2120615011d75945ea2e0a8232e57e4ab315759c31d228ad8185acf2b739aa46db4b6ce08825fdd7f80406be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626957334, "uuid": "daffb25f-c608-407f-a62e-bc3b9e16b698", "value": "T18ED4D078631FA744DC3883FC2C69D05127FAA01DA61DDA793E9890BC7CB2AB856F0651", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626957334, "uuid": "b58ee003-9021-4f4f-ab2a-2e1561c9212e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626957334, "uuid": "77773438-a0ea-4459-9fb0-e435af32e3a6", "value": "12288:IOZO+PfYPZgR0qIl6ZGabya2a5uQShrg0+tg9syaUVKnp:IOZrYQFIUZGta5Yhcxg9zahp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626957334, "uuid": "1ab0eb2b-04ec-485a-be04-6d0fd91ef88c", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626957334, "uuid": "cfcc3f25-a021-454a-a5ff-8e8638621cdd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626957334, "uuid": "44b7b8ea-e483-44c8-8b17-9c595f0b83ba", "value": "Bank contract,PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23618cc9-eb20-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626980883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626980883, "uuid": "a0923db3-30ba-41ee-8755-43284fa32941", "comment": "Malware payload", "value": "cba5c5b53439f062b9edf4577967958d", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626980883, "uuid": "16f5d06e-2067-4c76-b427-87743332a7b7", "comment": "Malware payload", "value": "b7233384574bb22afe5b463083228ad6e9d2cd12db7107f98fc37de8f252d389", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626980883, "uuid": "a9bfd170-518b-43e3-864c-3c97c938965b", "comment": "Malware payload", "value": "c9e80b86f80d5e14187d1b72f89da9ad1397c4e5", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626980883, "uuid": "2a2157bb-c9ae-4c34-8af7-cf86601cb952", "comment": "Malware payload", "value": "d4bbbd766819913565ca887722f5a54d663561b04596707a089891088ba957257b87cf24402178c0b5804c6eba9ae4df", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626980883, "uuid": "fa726609-eda0-444f-b4c8-ea9a543788c5", "value": "T10983F80388594B57E82D43F8BD470E982F1A67ECE5863FEF15650E8F7BA12260C4E16D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626980883, "uuid": "f9f1a624-2693-4593-b233-54e13eb092e3", "value": "1536:rJx/IBjfM268htEI0Y3s2iwdNP7rLlU0KLV:1+dMb81MsZU0K5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626980883, "uuid": "7914dfce-6ef0-47ed-9f2c-c0c183d6ef10", "value": 87437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626980883, "uuid": "4da185e2-a58e-4999-89e4-1339852f5932", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626980883, "uuid": "7c496acb-01ab-4491-a20f-be8376c81d6a", "value": "b7233384574bb22afe5b463083228ad6e9d2cd12db7107f98fc37de8f252d389", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e56447c4-eafa-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626964887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626964887, "uuid": "60049e62-e1a7-491b-898c-1f7eb19354e6", "comment": "Malware payload (RedLineStealer)", "value": "a5952beb1c4823eae9fcafff7283c59c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626964887, "uuid": "d9ad98eb-6fbe-487b-97b3-a6935b1016dd", "comment": "Malware payload (RedLineStealer)", "value": "b741ea1dc642657e17b6a4dd71b08003f13284b1e74069f6070ca58d4255b530", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626964887, "uuid": "1deecc6f-c5cb-483d-a3bc-0035c5d444dd", "comment": "Malware payload (RedLineStealer)", "value": "99a7b6a91037a71ab11aff2921a988d11a8d65c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626964887, "uuid": "3b2dd8c9-a4cb-4146-a75d-0ff8075005a4", "comment": "Malware payload (RedLineStealer)", "value": "076e16e188323338f2afc7d7fed42e9e544dc6af0b159caa0da16511ab2a0644998133a15b027b67e925a9f9888e1dd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626964887, "uuid": "a0c889c7-fc66-4281-bdac-66a315eabd05", "value": "T12B84012864BFC05980E3EEA52EDCA8FBD99A55E3640C743701B4633B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626964887, "uuid": "04fb2a1a-a652-44f9-9625-dc60edd6705b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626964887, "uuid": "1e5f943c-d898-4e0d-acd8-1ca19d9df76e", "value": "6144:lNDLvCkr1R/M7DjRupDSKgwqmcpm58O4G:lNDLvxr1R/CjRupDSKgw1cpm58O4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626964887, "uuid": "96f0b814-7127-4146-987a-7799d9f0b084", "value": 373760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626964887, "uuid": "68b2dc55-c306-4759-8425-00c52a548005", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626964887, "uuid": "dae8e88a-1d3b-4f4d-9884-fd7919ac91c2", "value": "a5952beb1c4823eae9fcafff7283c59c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a0e542-eb03-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626968614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968614, "uuid": "b07febad-09ef-4d1d-af44-96fa29e07428", "comment": "Malware payload (Formbook)", "value": "91663bee11ec2466c36ff85805041fff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968614, "uuid": "1ddd2849-abb6-43d5-826c-0cf9a5126cc6", "comment": "Malware payload (Formbook)", "value": "b764504a2998416edbba85e1495c8311f8cc94f5775ce3413b8d3cbd5acf03d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968614, "uuid": "916b35d5-bdd0-480e-a879-d5366a4d04d5", "comment": "Malware payload (Formbook)", "value": "944de18e73bbcf9807c960ba925641211d46cd6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968614, "uuid": "653445d4-ff5b-4186-a562-e8dcd10a7a0a", "comment": "Malware payload (Formbook)", "value": "b32bf714891d6bec0a6c2ea79ed44baa542127ad2cabf30d3d4187366b387e5bf83254f93e2f4cd44e0804f6c727986c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968614, "uuid": "31fc0643-1a86-4bbc-b7f9-fd1874919620", "value": "T159040225EF4E9B81D62458354BED242F6086C4BEDA9F6273D323553980B83C2E518F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968614, "uuid": "20dc7436-42f7-472f-aeae-8b9aae60c646", "value": "63b0867460dd31e465a337a5e3e003e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968614, "uuid": "4a780e24-9063-4c10-9fc0-eb38ccd4ae7d", "value": "3072:Se8sLVMMnySqjooMKC8r8onTKtd5xYMhVwHlKKUQKZ/1CUmXAgrhIWS2OWYilqje:SEL6MyS8oB3KnIdD18gKUQKTCUpgrhIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626968614, "uuid": "d600635e-14e6-4cc0-9ce0-0d152b69c2ce", "value": 177038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626968614, "uuid": "010838c1-bda9-492c-8ef7-323d953f81fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968614, "uuid": "51517f63-4452-4b50-bbb9-df4ae916795c", "value": "91663bee11ec2466c36ff85805041fff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc9fa3e-eb1c-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626979266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626979266, "uuid": "f0ea73b6-e7b3-48ac-b243-83a97f784bbb", "comment": "Malware payload (Formbook)", "value": "3165d57f4ead430128b156cff27437d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626979266, "uuid": "9b50dd1c-34f6-4cc9-b221-0ee97fcc9efc", "comment": "Malware payload (Formbook)", "value": "ba49de17d6fd296078762362ffce28e37dc3896e9118566eb3c541e197a12d33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626979266, "uuid": "b5d961a8-8bc3-4dd7-b36e-e16825f3fd20", "comment": "Malware payload (Formbook)", "value": "af85eb7faae52bb4fb9292bb746f7a7080d1068f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626979266, "uuid": "a6183558-f141-4101-a7f0-52fffaf7dce6", "comment": "Malware payload (Formbook)", "value": "e8a9ea54d3f4db1c8ec32b39b9997224a50464570ecf934f590774b7c1cf3f32599c226b1c301913c41942cf9d2f657e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626979266, "uuid": "0858358f-7de4-401d-9231-a55272aa8bf4", "value": "T1C6A48C3805A80A63C676E273C268E701FFF09AA37250DE1957C7D5CB1E1264369CEE5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626979266, "uuid": "4553fd22-be08-4806-b1d2-46fae0ac52e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626979266, "uuid": "0c4b5fe9-cbb2-40d7-8f76-bf0a104554e7", "value": "12288:AzR/ttg5u7rwa9DCyrublSB5oggXu6xhpfiDFD:YlOgPD6xo5oggH7pKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626979266, "uuid": "e51f5d25-be25-45dc-9140-21b6e12852f2", "value": 479232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626979266, "uuid": "ef00ddcb-e051-46d0-a359-025de6b3682c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626979266, "uuid": "ac458976-5ae4-4035-8346-54aea604d9be", "value": "NewOrder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7bfa3d4-eafb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626965294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965294, "uuid": "35f70bff-c653-4b59-8a95-49316693e5a6", "comment": "Malware payload (Mirai)", "value": "25ee6b4f033abfb306eeb3d7343a6710", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965294, "uuid": "1097e980-9bea-4e13-84f7-cee20f5ad4f4", "comment": "Malware payload (Mirai)", "value": "bbeddf033ad78be683db54a66ca977e17988f98afa30fa75cedc830234709735", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965294, "uuid": "28eb5466-2e0d-4efb-98a9-21e4303aa780", "comment": "Malware payload (Mirai)", "value": "5d5aa12d15c19cd90a340ab52ed7208928f10443", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965294, "uuid": "5fed945b-92b5-443d-a9c4-4c402589c5b4", "comment": "Malware payload (Mirai)", "value": "f3f37ae1cb90deddd5c8f7e5fb794cc93864d8614f69ab7388ba363561ea632feb754b1079ea53c23c4631008d0328f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965294, "uuid": "3a90acf6-5d62-408a-867c-6c951bc3c9c1", "value": "T15F332942B22C094BF9E65AB0353F0FE093BFE94024E4B585695EEA458136F731586F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965294, "uuid": "9ab0a078-c31d-4905-8cf2-881aba711386", "value": "768:/KfsbnHAt1ezbnAgCN7RkIV3fgB1TRNRR7Eg3tbv6VFssuWXwdyHq:k6HAt1ezbnAXZUBt33tbC/3XwOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626965294, "uuid": "f2089449-759b-44c3-a752-d9f083ccc108", "value": 51332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626965294, "uuid": "0f9a2f42-dffb-40c3-9281-68c1bbe74d95", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965294, "uuid": "9a8d19f7-2ea2-4b3c-bc53-4f704586869b", "value": "25ee6b4f033abfb306eeb3d7343a6710", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05ba7080-eb35-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626989852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626989852, "uuid": "51bf40af-7df8-49a0-af18-6b237c971d0e", "comment": "Malware payload", "value": "8d4b77fa3546149f25bd17357d41fbf0", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Pegasus", "colour": "#15B0C8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626989852, "uuid": "cdda5d85-902c-4df8-8397-df97f7535900", "comment": "Malware payload", "value": "bd8cda80aaee3e4a17e9967a1c062ac5c8e4aefd7eaa3362f54044c2c94db52a", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Pegasus", "colour": "#15B0C8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626989852, "uuid": "ae5c6423-3fbf-42c0-8f3b-a46dbc292f8a", "comment": "Malware payload", "value": "7289737c1dc462726abbe89335a7702c130bbdcc", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Pegasus", "colour": "#15B0C8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626989852, "uuid": "87b0ad15-eb6b-4488-b1d0-83fa1b840595", "comment": "Malware payload", "value": "18eb63bb5b2e7cc9cbddd56cebbeeb05ae6dc0530c8a33eded278375dba3399f52feeee82cf2b03569210daac1b78265", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Pegasus", "colour": "#15B0C8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626989852, "uuid": "07b83ae6-598d-4b2f-a8fc-f60aba03fc64", "value": "T1FB35330B3523959FF88353B6D50884CB3564A7A70E4F90BB28FDC8BEC6518E26631D4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626989852, "uuid": "e2c794ae-17eb-4651-ace8-c85d45a79c34", "value": "24576:RkVMvDz5Q6P8aJnB94XqMOkkXLjD+F5VCq7ncRL4GchuT:qKvDlhP8aj9bMvk7jDJqTmsGch0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626989852, "uuid": "b3c3bf7a-f01a-480f-87ef-1891239a8067", "value": 1108049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626989852, "uuid": "e0a734f4-3bea-4ee4-8392-e10e90aba7df", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626989852, "uuid": "7d037f10-edb2-4bc1-98ea-d904861c9c9e", "value": "Andr.PegasusB.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85165596-eab1-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626933372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626933372, "uuid": "a816a20d-a5ac-408b-b0b8-af7f3be7790e", "comment": "Malware payload (Formbook)", "value": "bd472cf05ab7f61043a3035af93b4252", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626933372, "uuid": "b5948530-1093-4802-8d70-fb81a82b388d", "comment": "Malware payload (Formbook)", "value": "c0f9927bbf25d29cc37936db7b00a09f94b23dcbec9103b77802891c49b9f4c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626933372, "uuid": "f3a523b2-65b5-4c60-b47b-4ae9b7895f83", "comment": "Malware payload (Formbook)", "value": "0b1206c106583ea7c7ff9fb08ac0cf521e84526f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626933372, "uuid": "5dc2f52a-7df5-4ad9-97ae-228d38eecf26", "comment": "Malware payload (Formbook)", "value": "c22d50d2ff65312e3f9c207e7bddca1c74ee8a1d6097242c0f75097061723d37f88100d5a414aed21a375bbcecd6dd5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626933372, "uuid": "f5245d4b-1434-4f7e-8574-302d0bbf01ca", "value": "T15D150E3E6AA42A27B777D2644681C015F8BC91DB3A395CD742C7698C350E8027EE7F2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626933372, "uuid": "fcea8c83-385c-4260-ae6c-e0979770c18b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626933372, "uuid": "8b528d1a-8811-4add-bc5d-c86532ced5c1", "value": "12288:wSTxZ0EG3KQyTs4XlhyI/vbUykcXBmDrOmOQOmEjjgfh8w7kuIofxXTsXvaj:wS5XqrdOxmIgfH7kqf9Tsfaj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626933372, "uuid": "6b2d7e7f-27e4-4dea-9cbc-d04508f8bc76", "value": 956928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626933372, "uuid": "496e9296-87f8-4504-a5a7-ab4c22af7c9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626933372, "uuid": "6291256b-dd96-42e4-927e-deb1098bf8f7", "value": "FORM.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7a54d27-eac0-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1626939900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626939900, "uuid": "f5bd7206-7d61-4873-92fd-f6c302ed576c", "comment": "Malware payload (OskiStealer)", "value": "9c75d0a696028660f0f7333c2d3f5d8a", "object_relation": "md5", "Tag": [ { "name": "103.153.76.164", "colour": "#84DB86", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626939900, "uuid": "3398a02f-b316-4188-ace4-03c3ede31431", "comment": "Malware payload (OskiStealer)", "value": "c0fa9b79d5ff08641d2490f2942b205120e157e790bfb7540aaed7a0e69a1d49", "object_relation": "sha256", "Tag": [ { "name": "103.153.76.164", "colour": "#84DB86", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626939900, "uuid": "4f1f3993-5280-4a76-94bf-cf26fb39c0b9", "comment": "Malware payload (OskiStealer)", "value": "3a3f86412b3d48bf9bf4f73fac3fc0d6c2a49293", "object_relation": "sha1", "Tag": [ { "name": "103.153.76.164", "colour": "#84DB86", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626939900, "uuid": "f30e62e4-2c80-4f2a-a715-5efa378bbc13", "comment": "Malware payload (OskiStealer)", "value": "7af9279bf4595d04267d2aa4d931a38d9e28d45dcbce27c2db686f110c0e0d251bfd95beca6c3b7d0b47b7f1102b682d", "object_relation": "sha3-384", "Tag": [ { "name": "103.153.76.164", "colour": "#84DB86", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626939900, "uuid": "b0f752d9-87a0-44d9-a1d2-4b46099072e8", "value": "T15C146D30B690C035E8A310BCDDEE86BEB96C7A301F5950C3A3D45A662F712F27A71657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626939900, "uuid": "c2b2e057-fb03-4228-9986-5b9a56764c3d", "value": "7bb9d345a5fec4fbbf5100d6a3ffbb8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626939900, "uuid": "9b7e5096-966e-4669-aebe-63ff4c1605a5", "value": "3072:WfUomEuYm98dlSq7gt5q7Dx+XgS6aCEwhOfUbCalNT2pbB3fIs1Xi6FLPo3c:WfUauY68uSWCx+XA7mg2pN91Ljo3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626939900, "uuid": "fe59cbd9-e295-4756-8426-dd4404a8b1e9", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626939900, "uuid": "c9dab522-99f6-482e-b59a-01f4f85a88f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626939900, "uuid": "6b788828-dc27-4388-bb21-59fcc72a2533", "value": "c0fa9b79d5ff08641d2490f2942b205120e157e790bfb7540aaed7a0e69a1d49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e8568c-eadd-11eb-875b-42010a9c0053", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1626952191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626952191, "uuid": "98397b64-4cc4-4d1e-9592-03eea9036761", "comment": "Malware payload (ArkeiStealer)", "value": "53660ddc9a468660788a2b064b62a56c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626952191, "uuid": "42269f77-6fb8-42fe-8e68-1d2279807f86", "comment": "Malware payload (ArkeiStealer)", "value": "c272907c7c9d138993e44dd4e837cd6ac26ce14378acc962a3c4acda14726d42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626952191, "uuid": "2ea26495-cf9b-45f6-8639-32c0e321eedb", "comment": "Malware payload (ArkeiStealer)", "value": "25b7fb1e8325e331bd359a11d2b063f0b1408cd2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626952191, "uuid": "06b7a2ac-5c68-404a-9560-136e020629e7", "comment": "Malware payload (ArkeiStealer)", "value": "d7655cd990a9819be441ef19958ce8b9039ebe2c8f45a8bebfb8ca40e6402db5f735025c205247ddb8f89e2e3ddf10dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626952191, "uuid": "c892890d-ba68-4de0-97be-73c33bc24674", "value": "T186B4015ABD38B08EFCCC2CB95C9B45F5DEB82D722C0162577ED53A0E1D7A7807909298", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626952191, "uuid": "2b2118d8-3eac-4406-923f-0a2a12fe9d6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626952191, "uuid": "4985d251-f45c-4ec6-9928-b29322176e4a", "value": "12288:LdgzNv4IG3MQLQ+RSKua8PB3JsdAZvfGA2pl4UdpEESWoi4Q:LdgSIV0Q+vbSsdAZHOpEEfoi4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626952191, "uuid": "538c071c-7293-4061-a36e-ce279badca22", "value": 518912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626952191, "uuid": "c7ce0fc3-d419-470d-8fa8-8d8efb9cc85d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626952191, "uuid": "d3b69ede-b057-4d3c-bb06-cc52cb0ed259", "value": "53660ddc9a468660788a2b064b62a56c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f67780c-ea85-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626914304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626914304, "uuid": "5bcb558f-6cb0-48b4-a750-1783dbf05c23", "comment": "Malware payload (RaccoonStealer)", "value": "81a0de5f566e305cea72406bb029812b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626914304, "uuid": "00f26ecb-06ed-47cd-a2f8-d4a8bb52187e", "comment": "Malware payload (RaccoonStealer)", "value": "c317497533e17391aa3e1d4c9d8f67620f9a6381900a13b125eaa76947ea36de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626914304, "uuid": "b1e84ac3-75c0-4902-a1c0-cf8d6a5a75e3", "comment": "Malware payload (RaccoonStealer)", "value": "4fb97923b202b3dedcb4addedc0f167f212e5e2d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626914304, "uuid": "443a18a2-daf5-46ec-9ae1-01f1054b543d", "comment": "Malware payload (RaccoonStealer)", "value": "2e00e0b77bbaef926548ab3dd2f9d2dfe5e007d8f8630c369b530db28f434b69ff9659a084ba6bf77ba3cdcd0fda64b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626914304, "uuid": "e3337292-e756-452e-bfbb-84af05e08f49", "value": "T1E1B40110B380CC72D255493158D783E4A67EBC626E7DC64BB7843FCE2E7228162BE356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626914304, "uuid": "5d7c5e1e-bb49-4202-930a-83e7fa3d08ab", "value": "7780eb9cc098185992365509d7637fd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626914304, "uuid": "48070e3d-dae7-432f-a183-06d0240da633", "value": "12288:j82XSt4o4ONDm8gL1uIw1SeAWrAVjzx7xdZxlcayUy+Lhm2ld:Y2XSt4oo5uIDesx5D3hyUdLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626914304, "uuid": "b2fc3e42-5512-437c-8da6-297de56a339e", "value": 517632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626914304, "uuid": "f3dcf1d0-f299-49ee-9aa9-3322047bfa74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626914304, "uuid": "f27c062d-ba8b-4062-a95b-8ba4f9824dff", "value": "81a0de5f566e305cea72406bb029812b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "318b80f3-eb1b-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1626978759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978759, "uuid": "bc319bd8-c897-414e-b09d-5fb20d10f6f3", "comment": "Malware payload (DanaBot)", "value": "60ff83c79ebfa3accfe9393e62bb231d", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978759, "uuid": "9748a7e0-3ddc-41fe-856c-94f86ab03248", "comment": "Malware payload (DanaBot)", "value": "c3bbe5a98b9a6cb9d90e25a5b7930cb6dd0b61268fa0e2c5d0568507d4291b80", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978759, "uuid": "0c393499-3b3b-44a3-963c-7e893f21eb4a", "comment": "Malware payload (DanaBot)", "value": "e87cb468009795e3a06534ebd447c0d15273143e", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978759, "uuid": "9f7eca6b-ff3b-42ab-ac4b-23826e992eef", "comment": "Malware payload (DanaBot)", "value": "85a50223ecbe90e43789956e9eb672eebffb24531f474a50a990073286b24a0294b9b06ca7349e917dadf6a2494c18b1", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626978759, "uuid": "12747a2a-ac8c-4cd6-a59d-a8259242b544", "value": "T1673523217425D87AC2A919359FE9CF21751D3C321F3998037BD816EE0EF0692E78F626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626978759, "uuid": "0b216861-88e1-4c43-9200-14d8283b4cd5", "value": "f8220ac65423f0267d42ab4cbda2e1d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626978759, "uuid": "a3a5be70-140d-47f5-9e47-05db2d5e03cb", "value": "24576:nGKpRDTouqTIXt7G1ZxjC3911vzGahtf30BY7F0U8yA:GKRD8utd87+3z9zGOh30BY7CU8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626978759, "uuid": "37c3dc8a-6091-483d-aac5-f1d2ed0e672e", "value": 1104384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626978759, "uuid": "c6ff4bb2-7bef-42f6-a078-8e039a981ce0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626978759, "uuid": "cbd78450-aa2a-4730-9e07-1eb90bf7df1e", "value": "60ff83c79ebfa3accfe9393e62bb231d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daef6e4e-eafb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626965299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965299, "uuid": "2fef0c91-b91a-4267-95ed-3727ab42a0a8", "comment": "Malware payload (Mirai)", "value": "9969d10ef6a196b68009f5308e703934", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965299, "uuid": "1d3d2095-e421-47f8-b48f-515000ed587c", "comment": "Malware payload (Mirai)", "value": "c5bfa6033062a5ae9935c310a93fbf39364222f00d9774a9dcaa1f23c63c20db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965299, "uuid": "303297a8-d8b7-47db-a223-ace588ee9650", "comment": "Malware payload (Mirai)", "value": "5d48bb18f9ab34c48c3c9f0da4f40f76d2a94d9d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965299, "uuid": "1e97019e-8c24-4dcc-b000-5247d6b4219f", "comment": "Malware payload (Mirai)", "value": "85f9e8b34ea6a62d081f80e56815e65cce07f62c99267f82a05fa08d149d7db4656dab603d24863547d073456d48d263", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965299, "uuid": "83ca096a-cace-4546-bf78-09ad04d24653", "value": "T16AC32A46EA408B13C5D61777FAAF414A3322DB54D3DB330689285BF43F87A5E0E57A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965299, "uuid": "3a5d6846-69de-4ce7-9ab2-e4c90eda173f", "value": "3072:IZMu4C+u2dLhLRE90bYK5h9T96NO2+5/YtM/9gM/:eMu4C+u+RfbYK5hb6n+5/AM/9gM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626965299, "uuid": "1b1a21cd-ab86-4b23-a314-6783c17b5643", "value": 128047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626965299, "uuid": "23751605-cfd6-4a6f-a245-9a5dc5c1423d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965299, "uuid": "ee4edd07-5b3f-4fb3-a792-686a186c87b7", "value": "9969d10ef6a196b68009f5308e703934", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "767ab45c-eb14-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626975868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626975868, "uuid": "0dce555a-b1ac-4f13-9323-88ad0e602f99", "comment": "Malware payload", "value": "eb45969490173b3158a03d753effde3a", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "janeleiro", "colour": "#7D2244", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626975868, "uuid": "60596d76-c5f3-4d66-82d4-e83c2c9229f8", "comment": "Malware payload", "value": "c5f8a697a886ddb9e866d2e9b7585c49f104ae15cc3cb480b54b2575368ab6fc", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "janeleiro", "colour": "#7D2244", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626975868, "uuid": "eff13b2a-4e61-4d86-a7f3-2420a5099a52", "comment": "Malware payload", "value": "1d2984a524dfdc663825ebc74b3601e5d75e44b3", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "janeleiro", "colour": "#7D2244", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626975868, "uuid": "651c3ae6-d43e-4308-9a34-5337a5399b5d", "comment": "Malware payload", "value": "3fe3f43c628f24b09d834d8057a7642125a9d9366ac732bfe71d5206e5d55e30c5861bc8193a2486aa2ef18ce634075f", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "janeleiro", "colour": "#7D2244", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626975868, "uuid": "62fb7982-285a-4d21-8f7d-577f5d7a22c0", "value": "T1BC750211B1CAC936D57E0AB0352EC75B4169BE204BF1C9EB63C41E1E1EB25D19232FA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626975868, "uuid": "5d6a9a34-b592-4f4d-a2f2-ab5b8a187bb1", "value": "49152:i+gY2w+W7SCkfNQGiA6JHS/a3KfsN8jNWTChQ:SYZ4SAyRaf9jNiCe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626975868, "uuid": "662c8c00-a196-479a-9504-8a447cb58761", "value": 1669120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626975868, "uuid": "44eb2af1-e209-4708-a67a-1301cbb03069", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626975868, "uuid": "da4fbbfa-a820-4905-a045-399a0d195a2d", "value": "FMC.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f7342b2-eb3e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626993922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626993922, "uuid": "069f8d4b-da93-4bb0-9999-16575bb366fc", "comment": "Malware payload", "value": "56d73f0b8c89094a9f0ad6277f042b3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626993922, "uuid": "ee9b5ac1-289d-4a82-9db8-c4396d376653", "comment": "Malware payload", "value": "c6c9d678a3313c5bb7fe71194a2a1e4d3ffca2f04252dd1983ba657cfe17320e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626993922, "uuid": "bc89b60c-cec7-4f78-981b-df5bb9a1ed1c", "comment": "Malware payload", "value": "6efe8b8257f030fdb63a069aad558b6282310a31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626993922, "uuid": "5622b572-ad9e-460c-9916-9b78fc79db1f", "comment": "Malware payload", "value": "734fee2023df74a1dd2ccd9ab086045768b365fc85aa85e4433c9587b9e0315d1788c89cc3e0c5acc0f97ab63b2e8b2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626993922, "uuid": "64f2354c-58fb-4ce5-8326-6c9b02112542", "value": "T1DB1523112BF1C1F9D24A04B0112B5BADBBACD20819E0B29BFF1DAD48FD925D65D1E0ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626993922, "uuid": "f5dfbc0b-6a3e-42b8-a116-dc420567fdd6", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626993922, "uuid": "a46a1a5b-563e-4daa-a428-6cf811332085", "value": "24576:6jpbJJhMQ/P5eS2XIaz5+X4fJjZ+YAzKAVS+quye:gbh9ReSI5+Uj2OARJye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626993922, "uuid": "84736a8d-8937-4fbb-92ae-c89d1e978d46", "value": 932064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626993922, "uuid": "2d71b902-2993-4083-9adf-31bafad6580b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626993922, "uuid": "2b15ebd4-8a50-4f84-8886-fd180e38c9fb", "value": "Software v3.0.5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38a97d3a-eaee-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626959443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626959443, "uuid": "9cc1dc56-408b-44be-a9b4-99b77444856f", "comment": "Malware payload (Loki)", "value": "e33ae837801aace971e1bddc2dfa44f6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626959443, "uuid": "e0776e7c-2fb9-445a-99b6-8d47eabeb992", "comment": "Malware payload (Loki)", "value": "c758c8ca932901784d48b9ccf7d68a998a9ba51f55ea810573dea4b5bb39acbc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626959443, "uuid": "809918a0-51d8-459e-a9b1-c0ab4f48c89f", "comment": "Malware payload (Loki)", "value": "13b13b2ac94545ad5e23ec5c39b07f1f74712f64", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626959443, "uuid": "05f9ba3b-36e7-4329-9f9a-60c46854b5e5", "comment": "Malware payload (Loki)", "value": "89a978f0a61d5cd14e6494f05e88c6e00a8249020b298a7e65de5c1b559cd02e4ec8ababee93eac76c21c8e28eda5ec9", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626959443, "uuid": "f277d559-351c-4723-9d4b-d429833019a7", "value": "T125227D7CC689A906C256187DD01981FAF32C6057A243F8A6654673DC4BA17C347DA1FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626959443, "uuid": "c8cec15c-d865-4915-8575-461ed12b9aa2", "value": "192:ScIMmtPVG/bD1YafOOnAwgb5SEzBC4vNqW603vV:SPX4D1YLOnhKhlqat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626959443, "uuid": "4106cfce-b291-47a8-bb0e-6df9cf87797f", "value": 10332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626959443, "uuid": "e1c78e07-c5d0-4f55-a72f-26160552c90c", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626959443, "uuid": "98d055a4-ceaa-4d9d-8f30-018a1ea02abc", "value": "USD_SLIP.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0ea645-eafb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626965033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965033, "uuid": "3db7c185-a894-4825-8c34-76afa289ea37", "comment": "Malware payload (Mirai)", "value": "96fc133108ded7eba87c0bf5eadfe17d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965033, "uuid": "11c2d469-5a62-427f-8694-097ed6df7406", "comment": "Malware payload (Mirai)", "value": "c911fe805d9e26fbc02ffe52c67bf05fabcece62686ff0e71831dcae28a2083f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965033, "uuid": "b75c3727-a4cb-476c-9710-89565bd513b7", "comment": "Malware payload (Mirai)", "value": "af0fd6b613acf51d2b04fee2d6a8a1ca5a847f40", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965033, "uuid": "5c5044b6-b764-4ddd-bf3b-4a38802fc00d", "comment": "Malware payload (Mirai)", "value": "d6d1e4da3eed08c9b6882850c85b9578a10e4826594205319506620350f04b35145a5d25061d99fec6d5ed9bb6e49ecc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965033, "uuid": "c2be6b68-d44a-497d-8f14-374e4a3bf871", "value": "T1603329DAB402AD7CF99FEA7E80160E0AF221235510530B2B67BFFDD37E321549952E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965033, "uuid": "9ba310de-43d2-460d-b3bd-509585ed9896", "value": "768:7MehvKgc46P1imWQc7/JgFHdIp8LujWeXzpUGRJTPOMdL88pI3k:QIK34GMmbBF28Sjp1UGRJbOMdw84k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626965033, "uuid": "9d9f224b-e7d6-484c-be42-059dfd391dba", "value": 52800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626965033, "uuid": "513c7882-ac9c-41cb-aef2-731461c1f070", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965033, "uuid": "1f9b571b-bfe2-46a3-a628-1b9b591e4f9f", "value": "96fc133108ded7eba87c0bf5eadfe17d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87e444ea-eaff-11eb-875b-42010a9c0053", "comment": "Malware payload (Heodo)", "timestamp": 1626966878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626966878, "uuid": "203eb1c9-5d84-49eb-a8af-033c76b52498", "comment": "Malware payload (Heodo)", "value": "6a25ffceff0b5ac1527fde53d112aa3d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626966878, "uuid": "1f78290e-c99e-4c3f-aabc-6179787df4bb", "comment": "Malware payload (Heodo)", "value": "ca356ff9009ac2d383fe7a0763e88a4bdd0af65a6aee5842c9271ae73489497e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626966878, "uuid": "4e504869-0df9-4815-bf17-2c592ec3fd26", "comment": "Malware payload (Heodo)", "value": "a3a534429e25ab96f1b1ac7d0f3208d279b5af16", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626966878, "uuid": "480cd595-3f00-443f-ab1b-5b06219d4607", "comment": "Malware payload (Heodo)", "value": "12ece8e7d842c01f6c9459cc05bf70033a12b1fd6c0867d2e6201f2b96f431a922c3e6348e51e7f079accb774462e8fb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Yellow Cockatoo", "colour": "#82FE98", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626966878, "uuid": "c4ce43a9-708e-455d-bef1-a9f69f2aced5", "value": "T12913F80A15C52276CBDD9AF4C0E7D016CB38F52D9E03EF6E6ADE14F79C0BA5854902A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626966878, "uuid": "4cfa0dd3-bf3c-4ec9-947a-c8336965f164", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626966878, "uuid": "7ac9ecc2-6d83-4100-8af8-0ffbaff317bb", "value": "768:mHPtwN6AvPEcjJduSmu4KxgRveyLwMVLMNUD2wiw:mvtwN3jJksVHyLwMVLMNUDow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626966878, "uuid": "5978f916-7952-4527-80b5-90cd8c29c6f2", "value": 42496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626966878, "uuid": "1dd95b6b-9ea4-493c-8c50-73b594b4d20e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626966878, "uuid": "5e1ffb64-0e0d-48a4-99c7-6824c3a88949", "value": "706f3290-5d38-4cb5-934f-7fbfa53c66ea.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf70da6e-eb04-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626969118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626969118, "uuid": "cca85581-0407-4fe1-b3e4-3161708e7d25", "comment": "Malware payload", "value": "f5041ec4ce468a07ecbfd076bc0f879b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626969118, "uuid": "58c40e3e-7374-49cf-8013-6d98b04773e2", "comment": "Malware payload", "value": "caff14d450514a35eac5ba34b3e74126360662d7c8fdf60a8008a0e3bb8ed0b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626969118, "uuid": "5246ad6d-867a-4430-b0c7-b6a052658529", "comment": "Malware payload", "value": "bda8cea1ec8d1cea253fc661559cd84cee2195b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626969118, "uuid": "f918d1dd-687c-4c19-a66b-5fe03fb70bc4", "comment": "Malware payload", "value": "3a22d2c9c538377a3a69d860496b97ad1eae96f23ff83f3a8494603c0c0290f9f2848df1cf75296b3732f2c75a118419", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626969118, "uuid": "bc48c3ca-ea1a-40ba-8b6e-2fe460421e3d", "value": "T1B1C2D80BA3412BE9D555C4F4A1DC6333D0B2F4373A5A17AAA7E082273D395E86A39670", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626969118, "uuid": "8a9753eb-d1c9-4f88-a295-963b1d7c2209", "value": "eb4027891a3c2b24db6240a4f60e56ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626969118, "uuid": "e2f0361d-6341-4169-8a04-e8951efc5785", "value": "768:ko9xN+bR7ftwwAqCnv/sx3OfEbR7t6ll:nPwbR8t/3MR7AP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626969118, "uuid": "13a1275d-4f66-4bd9-a78c-e5ab53ac94c0", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626969118, "uuid": "35b46ede-dd49-4fa9-8a9f-c72068d32715", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626969118, "uuid": "625d0245-ac6b-4310-937b-a980427cbcc3", "value": "f5041ec4ce468a07ecbfd076bc0f879b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3714f9e4-eac2-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626940543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940543, "uuid": "fa8b05cd-42ec-4bea-a4fa-b2b1c0dbfa15", "comment": "Malware payload (RaccoonStealer)", "value": "60a3d906905af4dba10885673ac9e45e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940543, "uuid": "7818fde5-53a6-4ed7-af90-b9f4fb7e1356", "comment": "Malware payload (RaccoonStealer)", "value": "cc700dbe94443210da536da83b5eb74444d81fe581d018c8b4a9fd6800eb6947", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940543, "uuid": "4fe395ea-3236-4a5b-922e-13a3bddd0e32", "comment": "Malware payload (RaccoonStealer)", "value": "fc74dfc0217f3321a03a784f7e5006122f7ea499", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940543, "uuid": "bbb310a6-0d50-4f8a-9b0e-e59c1c636601", "comment": "Malware payload (RaccoonStealer)", "value": "4bf98b60393aa1f8bd0afc2888fd81ca99a118b5f3b956a8809a9fde5517b9cc01198349e172d735288337635fac27a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940543, "uuid": "3ff102fb-445c-4d60-b80a-9acc5681e147", "value": "T19DB40104B680DC32D195083048F7D7E46A7EFC62696D495B3AC8B6CF6F742C672AE346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940543, "uuid": "95ae9239-48a0-4fbd-a0da-a2e1a5432917", "value": "562fce12eccc4f3ad217a9cd9041ef76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940543, "uuid": "e6902748-728f-4178-a38b-cb77cda2887f", "value": "12288:UIyWINQi1ivAMxVteO1lbwclwCy1MLhm2ld:OWIaqOj1y1MLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626940543, "uuid": "2bdea447-be09-41e9-9970-504e89de608c", "value": 517632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626940543, "uuid": "c5a1615f-2ab7-41d4-adbe-427a8e4d9788", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940543, "uuid": "5de3916d-c505-4623-976e-6a502bd90e94", "value": "60a3d906905af4dba10885673ac9e45e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fdbaebf-eac3-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1626940933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940933, "uuid": "a198bdd9-e735-4b96-a081-1d847272a87c", "comment": "Malware payload (TrickBot)", "value": "2e6fcdc4bb4622a80f70db990a217718", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob109", "colour": "#78B843", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940933, "uuid": "323798fc-ac56-4ae2-80da-13c3adef8323", "comment": "Malware payload (TrickBot)", "value": "cd7f39f9f95a1161878980631e4069057e715e84bf3ecf940bfca97ce5a96e20", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob109", "colour": "#78B843", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940933, "uuid": "3d12e197-1a6b-40ac-b2b2-9afb833f44be", "comment": "Malware payload (TrickBot)", "value": "905a13957f196b48bbd3d2c6876d3e76d8ac1119", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob109", "colour": "#78B843", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940933, "uuid": "19f9a324-b457-4629-ae2e-5f8de67cec9b", "comment": "Malware payload (TrickBot)", "value": "70775e70d130168165a4f2da0b78d4b2639374570398191a5530fa62809b181ee75c46827d61a17e51ed9a13706b2a3f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob109", "colour": "#78B843", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940933, "uuid": "e8cf8aa4-6dc2-4bd5-852a-be8fab2918ef", "value": "T172C4CF2235E08577C4EF12345E667778A3FBBD946BF2C147679A890C6D339028B22327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940933, "uuid": "ec38678d-21d3-44be-8991-20f2c14c4c5b", "value": "f3deb6209dc9c95daaecc9f849af840f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940933, "uuid": "fd0e5258-bbb3-4f49-b691-287c6cb67f8e", "value": "6144:6nhWubOStZ6AbgmgwLp3gUhWeGt4OPc/woVPHma1MXohuPATdTpNSTrbkYW412ph:6nTltgBNwxgUXd/DGaXhu45pI3rep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626940933, "uuid": "5d3e8073-b496-44b7-a6a0-9721ddc129d0", "value": 557056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626940933, "uuid": "515390ee-1569-4168-817d-eaf1bea082f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940933, "uuid": "841bf214-aa1e-43ec-a368-82ff919a3389", "value": "2e6fcdc4bb4622a80f70db990a217718.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9a95edb-eaf2-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626961378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961378, "uuid": "4757c24b-f1b7-41ad-bc58-e2bbaff3b9c8", "comment": "Malware payload (RedLineStealer)", "value": "41aff158bfefe4084b88da1cb7caa13b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961378, "uuid": "f876b3f7-28b8-42b4-b4f5-ba2b3fe98fdb", "comment": "Malware payload (RedLineStealer)", "value": "ce74452fd637d3940d3973282fe9fa0ba2b891690cbcd51d6d817732ca560bca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961378, "uuid": "6338e6e5-0b94-4dff-842a-179080fcadaf", "comment": "Malware payload (RedLineStealer)", "value": "39d6b0d6be866153c13d78d73292542efa5d24e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961378, "uuid": "3793937d-d4a8-41bb-95b0-269cd509737e", "comment": "Malware payload (RedLineStealer)", "value": "1ccf2d1e390b6bc30cbee8d5e7948878307f6eff62232b259d7d8b9cea6749ee709a06778a3d1125a0b97d22c41b22bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626961378, "uuid": "4c781e06-5557-40f9-81b5-24eb8ed65951", "value": "T1EC65061159C0DA15DE6532F78E7782EC42E19FD0DA33D61AD91F32E72D72B286A0E2C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626961378, "uuid": "21899861-3fa0-4ab5-bbf2-02adf1a0787d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626961378, "uuid": "0173069a-88e9-4d3e-83f0-0940df36c875", "value": "24576:wLGsk49UX5eQYZ4lJ6WKvG5M+73fqvZhCNr/B7uy0mR:RRor8O+LCo7B75", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626961378, "uuid": "985907b4-3893-4121-83e1-40445b4dde17", "value": 1486200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626961378, "uuid": "9ab7989f-502c-400b-b3ab-bfbbc095eecb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626961378, "uuid": "eda3b633-f394-4a3f-8787-f2b2ebb43a34", "value": "SecuriteInfo.com.Trojan.PWS.Siggen3.1355.24733.1611", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b033ec5-eae4-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626955072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955072, "uuid": "1310f211-2fa2-46aa-91c0-e3be28f5208c", "comment": "Malware payload (Loki)", "value": "79cbe5c736dca5564640e51892f32c1b", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955072, "uuid": "97fbe39e-e8fa-46d6-9a87-f7724d1125aa", "comment": "Malware payload (Loki)", "value": "ceef223bf6dc75ffe9eb1af19d6d440b59def1fa06230ca79511eae1c155d37a", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955072, "uuid": "42d19743-1c82-48c6-8509-50a6a81b3179", "comment": "Malware payload (Loki)", "value": "dca92a17d05be974c19ddea73ced3786d0eebe0f", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955072, "uuid": "1651700b-90c6-4ba1-affc-780cebafb4e6", "comment": "Malware payload (Loki)", "value": "1911a7c328ff01da58390d592c487c4d527063ddd54b5e6a02849f3d89f8269bce341cf3449e58fd9db41c43ef0b8b08", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955072, "uuid": "36e0e2ea-fd28-40c0-9a12-780374ea91ef", "value": "T1DB55122556E1332DC5A6A332708AF9BC4265BFF3936D88C5634532EAA43C9F713581F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955072, "uuid": "46e70df3-3112-41dc-9492-55f70f2cb01b", "value": "24576:rOppJ0YNSJn8DQAZm+B+rmvz7NSFvFgaYNjgLTUXstdZ5dWwEigW:rOzJbNSd8UAZmg+rmvz7c0aY5gL3tj5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626955072, "uuid": "81a03bf8-a190-4b48-acf3-5857e6c36daf", "value": 1280512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626955072, "uuid": "03acda1f-c0ab-49f4-b128-f7633d227b91", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955072, "uuid": "0e37b600-27fa-4490-8908-a75a9011cd35", "value": "swift.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "158498af-eb04-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1626968833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968833, "uuid": "0f2e4162-f5b6-42c1-a091-db53d1e3e215", "comment": "Malware payload (CryptBot)", "value": "b07c1308ba6a6164e3c419f7d50d4c00", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968833, "uuid": "2f3dbe88-b44c-4f60-9d63-260356841fc2", "comment": "Malware payload (CryptBot)", "value": "cfd8b67f3e21558c90c0a84d4f1f74b4691901c8e898308ce4162095b6b597fa", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968833, "uuid": "40914543-994c-444a-8d23-2949b2ba90b1", "comment": "Malware payload (CryptBot)", "value": "e984526c40cb7330670a62694b66ef096dada238", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968833, "uuid": "551d2b55-27ce-4bea-91a5-7677b8552648", "comment": "Malware payload (CryptBot)", "value": "abce2312b8e0324b67c01e6f2c8375c59865a3d3ab5ecfac1b2839c6c37f3214401247cd0df3ae374ac8e300b9d42aa4", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968833, "uuid": "1e6bd8d2-d7d0-4493-84a2-0c27f72586be", "value": "T1A3D41220B942C836EAB51A7098FA96A0793FF8615D68482B378437CF1F724D1677F316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968833, "uuid": "03a47e91-5fa9-47fd-94b0-222d1ced3ffc", "value": "6acba419afd0f4919c1c58d62b0b66c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968833, "uuid": "fab3df57-2d88-493e-8913-44dd453e1879", "value": "12288:Rtqa9Ho3SHlgqJy44jqIz62/maScZTn1fQV+fBvBew1htyWBL6:Rtqa9I3Uljy4MzlSun1YVmRym6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626968833, "uuid": "89d6687a-7c20-4947-b054-f9cb1b96c812", "value": 646656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626968833, "uuid": "923425b8-67d0-482a-bcae-672e024f7c22", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968833, "uuid": "24c87f68-77c3-49e7-8381-30021b10c27b", "value": "b07c1308ba6a6164e3c419f7d50d4c00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1309e38d-eaf1-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1626960669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626960669, "uuid": "b8158430-8588-4d65-afaf-9f82508fb9bb", "comment": "Malware payload (AsyncRAT)", "value": "4f14fac1020ee677bdec589add99b81f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626960669, "uuid": "22c94e43-d80d-433e-9fe1-fad98a8dbd01", "comment": "Malware payload (AsyncRAT)", "value": "d03e935641dfbd69c834d63cded762ae1c3ec41dc4502bcfd52d8cb8c5baf731", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626960669, "uuid": "430d9ff3-2d3e-4bfa-8216-05a299514ea5", "comment": "Malware payload (AsyncRAT)", "value": "2e0587c5f59d350dde083d01e91f1ba4bdf97900", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626960669, "uuid": "a7a76c91-dfbb-487c-8e7e-039d0686d4ff", "comment": "Malware payload (AsyncRAT)", "value": "b9e68bf852504896312f94bf4817966aa9571b3eb1b3ec697aa0d92f3c17cf4d9795b512855c80879cbbba5175e0149f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626960669, "uuid": "97338f4c-85c3-43cf-bade-1c41645eec31", "value": "T1A1D4CF35622BA714EC7847FB9C58D59067FEE816461DC5381DE871BEBCB2BBC25E0202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626960669, "uuid": "a527ac32-22a7-4952-83d1-461f17b6e2ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626960669, "uuid": "33256761-bfd0-48f6-9b87-4aa1caee116e", "value": "12288:HcTKSzkuz8GJ7v7KU0FQ8jEkT9oFtYfXrwJ12Wu8SsyaUVKnpILVWVO:5sk+8G9OUEZ7TFfXcH+zahpIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626960669, "uuid": "c4325f88-d1fc-4a06-8218-55efbddccab8", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626960669, "uuid": "8d79909b-f587-46f6-902b-e20f35d1c94e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626960669, "uuid": "1f099436-220f-4c18-a5b6-1da3da8ca34f", "value": "partsDP35212202122000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4852a05-eb03-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626968751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968751, "uuid": "1638a6d1-0ca1-4e58-8e34-d234bb457132", "comment": "Malware payload (Formbook)", "value": "734a568749c7879e5ca5ea2b8e082f5e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968751, "uuid": "36be8acd-784c-475c-90df-9b4d9d02739c", "comment": "Malware payload (Formbook)", "value": "d0f6f28c586b78dfbc7d4e6c277c20761c9db38e0cd059807be5252b52d10660", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968751, "uuid": "b62981c5-455b-43d4-b6d2-46e051b14d1b", "comment": "Malware payload (Formbook)", "value": "27d6276e49602f3633dfdd94de400db53e209b51", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968751, "uuid": "33580485-37a0-42c1-9fd5-e5b4002fb62b", "comment": "Malware payload (Formbook)", "value": "ccd371e44da1f3ae4dc75b833c2bb902e4389306ed6ea740ff51ea4bd0c1f943bcb3fd377767e7c832c24c377f61f860", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968751, "uuid": "da85e6a0-92b5-4f44-bd1c-10e926fdd2e6", "value": "T1C4E4E074631FA704DC3887FC2C19E15167FAE01E965EDA383F98D0BC78B2BA856E1641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968751, "uuid": "b23d8910-805b-4435-8e3c-cf28358046bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968751, "uuid": "8a223d03-6eb5-41c7-a767-0cf6f945df90", "value": "12288:BUEnk8yfaR+DaY3bsojKdqFyirJ5Y1oDpgAwUzl3XoJPcISRqzGWl06bsyaUVKnp:KEnkZCR+ZjKYjrw1o1H73XwPcIll/bz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626968751, "uuid": "51b41b7e-a1b4-4568-9f0a-745016ccc040", "value": 713216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626968751, "uuid": "855f58ef-dd70-47a9-b772-980a16515c20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968751, "uuid": "7339a53b-536b-472d-a715-4eb5845a9f5f", "value": "734a568749c7879e5ca5ea2b8e082f5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ee40163-eab3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626934221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626934221, "uuid": "899579c8-19b4-4afb-95d6-34a7debb2a8f", "comment": "Malware payload", "value": "c71257572d8131728c62b52248017025", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626934221, "uuid": "13eca446-df5e-47bb-bffc-00f7a16cfd82", "comment": "Malware payload", "value": "d2099233a72c282e64e85abcddb284cdffc18b24e088947254f9b55670f52f83", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626934221, "uuid": "20383231-54a2-4b92-8c38-ff9b3ef9b3fb", "comment": "Malware payload", "value": "e4c7ac7b3f4047d7ace1559df4c9894f3224e2f8", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626934221, "uuid": "e383f7c1-9c19-41ec-ad18-551d285a5dc3", "comment": "Malware payload", "value": "c0c0941fd3aa98084006ffd544bf19c0aef3ae1947b17d49d93cb249bbcd55326fc05754fe08b50324f519a71e82c5bf", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626934221, "uuid": "47aca30b-d069-4150-a352-e80132d0e9ac", "value": "T1203340AD7D19868A9D09B0E3589E309DD3B4CDB55830E590BB30D9CF1F103B69B846AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626934221, "uuid": "96950d45-1df3-4813-80f3-be5bb8735837", "value": "768:jeTSVFNEBLC7cdv9TKlFI/0EkJRdpmm3MfDVDtEKIOsL/k7wgMk2GDL5E9:STSV8Be+FWlqcEkHdpZEDVGKFZE9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626934221, "uuid": "91ed4fce-544c-4637-99d0-10e855ee9506", "value": 54104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626934221, "uuid": "15d28669-e524-40a3-9c1c-c58ed9d1522f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626934221, "uuid": "361f17a8-33a4-4fa6-b667-f139c945936c", "value": "Comprobante1.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a6c553a-eade-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626952709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626952709, "uuid": "f80f60b0-be8d-4351-8392-091f7052d465", "comment": "Malware payload", "value": "5524836ccb59f40d628f0dd0d8895baa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626952709, "uuid": "f8a05c19-eb4b-4156-82e2-67b806e9c32c", "comment": "Malware payload", "value": "d223ba3f46e2085a558c1ee3009dfa51dbec2683f500676611f92080fd3d7a2e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626952709, "uuid": "5065e743-a11e-4e44-8d01-6abb961df3c1", "comment": "Malware payload", "value": "056fa6661b4a0df5e10fe88005bc95a02a15b424", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626952709, "uuid": "683b0501-b915-48b4-b0ea-9ef7e4c018ec", "comment": "Malware payload", "value": "02b5b5a8e049931cb64eb6a418ab0cf551e9f3b69a5d462f37a707f2962d917bc518e893d82a04cdfc986b5eb0b92c6a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626952709, "uuid": "6ece6b5e-c2bd-4176-ab28-9fc4b472f2a3", "value": "T10534D02079A1C873D4A7093048F6CA67762EBC62AFB88647275513EF3F712D2567E702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626952709, "uuid": "fa2b054f-86a3-40eb-8424-c917a205f77b", "value": "61ef104eaca526f41b548a0ec177afb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626952709, "uuid": "fe902225-627a-460d-b293-94fdc3d7fce0", "value": "6144:PFzbrsB+5EVaONwVP9VLYNDLyXvJhJNl6:PKQ5E3yVP30pyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626952709, "uuid": "024d7462-e500-42ac-afc3-30c3ee67e182", "value": 238592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626952709, "uuid": "d6007b8a-016a-4726-a9b1-f307d8091d6c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626952709, "uuid": "c7747c2e-6d27-4853-8c1d-d5683eb8b105", "value": "5524836ccb59f40d628f0dd0d8895baa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e3463ca-eb03-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626968526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968526, "uuid": "27003247-cfa2-48f7-b600-c5f0366c7a1d", "comment": "Malware payload", "value": "0f315b6196e7c41e649262d54aaa268d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968526, "uuid": "dc6b2006-9819-4f4f-bd32-6de62a2aab67", "comment": "Malware payload", "value": "d22671c40188ffbee05210cfaf8e6679d001a9004d62342456899ab39bf7a917", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968526, "uuid": "50766eb7-5ca2-4ffa-986c-8c133e8eb2ca", "comment": "Malware payload", "value": "bdc61d3b2bd44b100ca482103eac3d1c56a1315a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968526, "uuid": "e9bbcec1-7da4-493c-85e8-ea76137b44b2", "comment": "Malware payload", "value": "6f33f119eafd56aa9ae67e27af3e50d9762834f8ac2988c45a6655c54c356b3f066aef63a4db8a7b8feca175ba59c3fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968526, "uuid": "8b9a79c9-2b40-4af0-ad51-5c4dc008cb1b", "value": "T14E34D0203580D473C0531A7058E6CBA1FB6EBC225FB98A2B379926EF5F712C2567F245", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968526, "uuid": "35728fa0-f3cf-4bba-9353-5d6e443854f5", "value": "f8220ac65423f0267d42ab4cbda2e1d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968526, "uuid": "3e1f40cb-368b-4f65-bc4d-af5d8015c1e3", "value": "6144:JGGmEiK2X4EFkm+0+seSTLI/LHoLyXaZl:JGGdptQkT0CSTIzQym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626968526, "uuid": "377525f4-3490-4826-902f-1b4e29928557", "value": 235008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626968526, "uuid": "f20fac2b-faf8-4ccd-b3d3-5e4a54634cfb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968526, "uuid": "cced7eb2-26b1-4027-ae62-b6c935af447d", "value": "0f315b6196e7c41e649262d54aaa268d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26058569-eb35-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626989906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626989906, "uuid": "c2ce9e2d-bf66-4a71-b50e-a9039df2726f", "comment": "Malware payload", "value": "4aa966ff0455560a2918b746ada2ed52", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Pegasus", "colour": "#15B0C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626989906, "uuid": "10e3844d-b625-4bc0-a49e-aa55a283aa01", "comment": "Malware payload", "value": "d257cfde7599f4e20ee08a62053e6b3b936c87d373e6805f0e0c65f1d39ec320", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Pegasus", "colour": "#15B0C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626989906, "uuid": "6df80949-0c92-44d6-b93d-3145750e990d", "comment": "Malware payload", "value": "4984af24225d3356689585399ef5e49553e6436c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Pegasus", "colour": "#15B0C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626989906, "uuid": "fe2787c2-9513-4fe7-b25b-288a2421e27e", "comment": "Malware payload", "value": "0eb0f2b54363057be340ae8a2701d05f4f638193ca7ceb6fd6b343145b011d628a79dc143d62d7fa87d27f05ff63b230", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Pegasus", "colour": "#15B0C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626989906, "uuid": "8ab8bc53-2f00-490f-aace-1713ef99863a", "value": "T10284224DCD63F54ED1CEAA32D1A6D17B96210070AB73FCDC110E8C9ABAA2C550B9CED1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626989906, "uuid": "87aa200c-9993-42f1-9829-afa6ad60116f", "value": "6144:1krLrE0XFUxWeau+qEqoh5pFtdiEnVXZrAhk3X2I9FZIqovhFa5Y5jQ5m3wQ54:1L0XFuNau+qsDkwX7xIqwhXML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626989906, "uuid": "115bc760-3d35-404e-8dee-a6a00a3665e4", "value": 376117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626989906, "uuid": "e2703c9f-a4b2-41d9-9b35-52091a9f3d19", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626989906, "uuid": "363ea235-9485-44b8-8ff4-be3b9b2cafcf", "value": "chachakppjb_veryhuo.com.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee1e1596-eac8-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626943427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626943427, "uuid": "ba77296b-02fa-418e-8fb9-369149e2d9e6", "comment": "Malware payload (RaccoonStealer)", "value": "977e58eeed2abd4a02e40be131d88b5b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626943427, "uuid": "565c1927-3f66-49db-8589-c3a2332dfce3", "comment": "Malware payload (RaccoonStealer)", "value": "d2bab01fe3f3615831a146acbe0b099deb680545132eb28a0f1e42e37aa3870b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626943427, "uuid": "7999306d-cf83-487f-83ae-52a077edfbc7", "comment": "Malware payload (RaccoonStealer)", "value": "0f15fb8159919b246fa1d9ade78043cc6459721a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626943427, "uuid": "51ab4d4f-bbf2-4ac6-98be-82c256e319d5", "comment": "Malware payload (RaccoonStealer)", "value": "476daced8ca815d8dcce7279e4b3692f9e31326b2ae96945fea4ec6fd8c7d8e508df98dbc46e867c9b76660911394f6f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626943427, "uuid": "5360e7b6-4c0e-4b9d-98a6-7dea008ed11d", "value": "T120A41220B580C477F1A6497188E2D6A4E9BFBDA3692C484737983ACE1E332C5777D352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626943427, "uuid": "d78389cc-95c3-459b-befe-edd4617a602e", "value": "4d4fdfb7fcb2254a31ad850df30aced5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626943427, "uuid": "8b17f033-ccbc-408d-85e5-1a2811843173", "value": "12288:gfiKRwUTZ+d78EsJ+7BIisd47Mmsv56OQn0oyO:glwWotscVXshMyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626943427, "uuid": "a5d683d4-0069-4adc-bf49-94706b68d42e", "value": 468480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626943427, "uuid": "30617191-d00f-4aeb-acbf-dbb67d9a2a52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626943427, "uuid": "f0d493b9-89fd-4baf-8d24-8a5562b902cd", "value": "977e58eeed2abd4a02e40be131d88b5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27b16b42-eac2-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626940517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940517, "uuid": "2e0fab2b-9f56-496e-aed5-fe6529b544ac", "comment": "Malware payload (AgentTesla)", "value": "313e75021856dbfeb3845ddbcd656153", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940517, "uuid": "0abebc52-3d4e-4cd2-be59-f42a95edf42f", "comment": "Malware payload (AgentTesla)", "value": "d3b8e9e564a71513336d3d04d9bc752bc61baacc51df486287127b2b1f5a32e3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940517, "uuid": "9627d886-3aea-4277-8a33-648a2b07d95e", "comment": "Malware payload (AgentTesla)", "value": "e0d9154f7c9abe61e4bdfde04efc2ea3208c19b7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940517, "uuid": "37a3942f-72fe-4b5f-9f3f-15e0ceac3fd8", "comment": "Malware payload (AgentTesla)", "value": "c5704350e277e6ee51a8513d0fe75bb5d5e4962ad05d15809035d466ad408c80bd7a9dbfd468845bf140c50ae4f05d09", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940517, "uuid": "cddc9c48-9758-4599-8f4e-05743dccc226", "value": "T103B423311BD8EEBBD87E4D3011E61814EF35790B1A2ACBDE65D841AE1DDB3412383A76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940517, "uuid": "a7cf7b6e-9768-49d9-b1a5-376e4fe755e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940517, "uuid": "9239adbf-7c08-4560-bc64-52c0eefbbad0", "value": "12288:hdkIw/Cukjy3G71/w+uFYBwN3ZADpSQ2msfe:/kZCukSGxY7FYChFmsfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626940517, "uuid": "d3586623-d012-4869-8216-4909d6bdeb31", "value": 527360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626940517, "uuid": "69ad9074-f4c6-4e07-bc44-4d068e948047", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940517, "uuid": "9b6f73e5-7db3-409c-b48d-3a190975a963", "value": "313e75021856dbfeb3845ddbcd656153.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c26bea0-eafc-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1626965543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965543, "uuid": "9ebdc09f-5e15-478b-8c05-237b6f01a553", "comment": "Malware payload (Dridex)", "value": "a411479d9de4f5c8bcc364d6adad2854", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965543, "uuid": "eebcf389-7e3e-4e63-8f01-476278e84a45", "comment": "Malware payload (Dridex)", "value": "d3bf39bbba7b499e7cc2e20a2986a95164376b2331c1493fd280a467c49d773c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965543, "uuid": "7ccc0b3f-9274-4540-a024-e225251830f2", "comment": "Malware payload (Dridex)", "value": "c8521479155c9c8f11bd5a1a0fbf051d94b034e9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965543, "uuid": "84e344a8-bdd2-43cb-b01a-d4aa16ad30dd", "comment": "Malware payload (Dridex)", "value": "503c34da180489b6d592e4194920dedb8cab52c4aaa3bd1be63bc820965268345951ee058688365b71305e4aa20f5594", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965543, "uuid": "688bc64d-630f-4f44-8be2-bf1b9d9fe22e", "value": "T1BDE449C5EBE1C92FEBD1D57A0C564630127CCC4456804B973256F33AB72BA7C8E9A2D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965543, "uuid": "ead40e9a-676d-4a63-8c6c-41b54b394fb8", "value": "12288:kGDH3roxGMC/mc4bl3q5uaFsvCgdz2l5MjavMmIf+U:kGDXEUH/4EnsvJZ2lKjavMm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626965543, "uuid": "65e426fc-5abf-42c8-88a5-793f4f152b37", "value": 676864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626965543, "uuid": "96f137c6-cd42-4713-901d-512f6322b7da", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965543, "uuid": "22a57a37-5086-44ba-abf5-30ea9a45c498", "value": "a411479d9de4f5c8bcc364d6adad2854", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84b87b3d-eaeb-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1626958282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958282, "uuid": "4c3b439a-4dae-4dd5-8a14-ccddab583308", "comment": "Malware payload (GuLoader)", "value": "c937fc9ed4325e6ab24d49a3175f3a5c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958282, "uuid": "83555190-1208-4e14-96b7-19fef82ad2d3", "comment": "Malware payload (GuLoader)", "value": "d54cafc1ca36d0ddd134f53d033ebbaaa490721d62d4168106a9b6c7cfa200ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958282, "uuid": "2086658f-7a88-4cb8-98b9-31bdc5e19026", "comment": "Malware payload (GuLoader)", "value": "00439295920e78ecac31d1dbf7eb67118d76299a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958282, "uuid": "79910071-dece-4a32-a1a3-dd3d67fb3886", "comment": "Malware payload (GuLoader)", "value": "ff83fc04ca4eee7c9a2c20254ecbef4d233cec519498d8cf5662071726936b1309518e28bbd2d41e971296edfd9adccd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958282, "uuid": "023ec30e-1cca-467a-b8de-667ab4b3fe58", "value": "T1183439EC7779EC4BF88BB8746A85FC6192B8E464568D4795B8C0A3E8DCF4F4108B5207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958282, "uuid": "111e14e2-eb93-4566-902f-d3dc809ffe84", "value": "4e1e57f6de47f654992269152dd1e659", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958282, "uuid": "b8d420ac-b517-4836-9df1-7119b9c13fce", "value": "1536:HrnnnnnnnnnnnnnnnrKDnnnnnnnnnnnnnnnCnnnnnnnnnnnnnnXnnnnnnnnnnnnE:H6LVbA8nT1vnv9dnj6czcW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626958282, "uuid": "d2ad90bc-34ea-436b-8d28-5256d053e74b", "value": 246888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626958282, "uuid": "23084c2e-6f2f-49d6-938f-5d61b69208b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958282, "uuid": "30d6e6d1-3dea-4d8e-8da2-50f7c4c90a53", "value": "c937fc9ed4325e6ab24d49a3175f3a5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f45ce3-ead0-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626946876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626946876, "uuid": "0d33d2ae-c4e8-46e9-b53b-f137533aa149", "comment": "Malware payload (RedLineStealer)", "value": "f471bf615ef92f5ee73b48fe203373de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626946876, "uuid": "ff34309a-b5c0-4a83-88a8-4f923ae0391f", "comment": "Malware payload (RedLineStealer)", "value": "d5608cba3115764a7758fa21c3e2f69724418dc48a8d0f5aaabe7efb71e2f28f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626946876, "uuid": "c1452edf-39e6-4773-bcf7-16d596a02ea6", "comment": "Malware payload (RedLineStealer)", "value": "11f0b6de8d4baf8e039f6244438ebb05bc589923", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626946876, "uuid": "a63892b1-72c0-485f-b750-ddb60cd7fe1f", "comment": "Malware payload (RedLineStealer)", "value": "1df3a5aee22d1e36127cd2fad8a4d61b99a432ca1a1ae9efec25aa4e968c20cfca3e0636121ea128e5904de2350f1510", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626946876, "uuid": "2836dd3f-258a-424e-abf4-98b64e34dda8", "value": "T15384352864BFC05984E3EEA62DDCA8FBD99A55E3640C743701B4633B8B51B80DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626946876, "uuid": "6ad1fd69-6356-45a8-b8ac-b4e84a3dee4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626946876, "uuid": "a0de5562-9304-46bf-ad20-3ec835febe04", "value": "3072:TmY641YUVNCkr2R3ke4G39if7er133h2sgwqJO+mm58gCp3D9qp9PYBn8hoJ/UBg:N5LvCkr2Rn4G30Ta1nhgwqJmm58jAG1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626946876, "uuid": "2e509427-8fb8-4088-af6e-574c8aa08e18", "value": 373760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626946876, "uuid": "bee7fe4e-292d-4aa4-9f4b-08f71bf00e38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626946876, "uuid": "3956cb67-4076-42f5-873f-8f99a97fb0d2", "value": "f471bf615ef92f5ee73b48fe203373de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16ab5d9c-eac3-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1626940918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940918, "uuid": "e1c264e0-cd09-4473-a36a-e60b7ff389b7", "comment": "Malware payload (NanoCore)", "value": "b0876b8da9dcb8a3b22d2cbf2b6a4711", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940918, "uuid": "d0881575-c0b1-4be9-992c-4a9fe8401d9f", "comment": "Malware payload (NanoCore)", "value": "d6215a4b16d74db6dafc28a78f15885de77570347acfbac416f18b223ba08e26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940918, "uuid": "25af1d35-a9be-4a7f-a721-f4f53a289760", "comment": "Malware payload (NanoCore)", "value": "80e619da78e64bf6845f284c50bfacf17c55a274", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940918, "uuid": "35b03e02-7ab6-437a-8f8d-070ed65e7802", "comment": "Malware payload (NanoCore)", "value": "8967d776b710aecb739722bf7b74990d6a5f04047d1a9daddf47243cd40d35fcf47f2fde54475b41e9b14784450e55f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940918, "uuid": "370abc4e-9517-4456-a0a5-393877f63c37", "value": "T170C423312F64F4E3D7BCA77742B32A407F346DA34811B59DE8C909ED025BB084B895BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940918, "uuid": "980bfb7c-5689-43da-910b-cbeaf474a622", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940918, "uuid": "37c86c34-205c-44b1-bf26-899e2f2984ea", "value": "12288:3FBH6YCzj8MFiAInR2MDDT/lgCc+zElDiUQm:1/Czjli14m8ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626940918, "uuid": "0bd4893c-1439-409f-8b4d-a0d11ce65aef", "value": 565248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626940918, "uuid": "27c1a407-306f-4b63-a6b1-8c6b28602524", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940918, "uuid": "26fe61b9-8966-44fe-9a25-4fa12d0d6fd8", "value": "b0876b8da9dcb8a3b22d2cbf2b6a4711.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae5c632-eb40-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626994800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994800, "uuid": "eb9dee31-891e-47c6-9b17-b28158500299", "comment": "Malware payload", "value": "a34832e07b046b5a8236591c932d828c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994800, "uuid": "160bf880-6399-40a6-9669-0f6ed47a7756", "comment": "Malware payload", "value": "d73cce8b67b83dc7482a685ed5043daf8d1fe0810bac574eecaf1b4ac0091e9a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994800, "uuid": "61e37b38-6cd4-4503-b2f5-784c123ccfb8", "comment": "Malware payload", "value": "868480c2e2ec1749c003b79ff32010055701c9c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994800, "uuid": "ce3e1684-8339-4550-87cd-be50324c3fb3", "comment": "Malware payload", "value": "5fa6b799768146acf42eef7a1f185945a53910baac135ebcb29c3927801889e0dc9ee575c205a051fb6d8a6698cde91b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626994800, "uuid": "68a4ffc5-a368-4252-916b-2a83032b7346", "value": "T11DB25EA38A792F18E258C5B4A011CF385753E516E94B2FFE2436C3665043EDEB15A3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626994800, "uuid": "9908dbf8-653d-499b-82c8-7147cf10078f", "value": "384:f3A4kyyPD21mC/5gGoIfDGHVjrP7RfMT35oJ/NqBAbC5/oFSe:f3qpiVmG7bqVyo5NQZoFSe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626994800, "uuid": "61eb4b8a-1b86-47db-9bbb-8e78ee56e8fd", "value": 24208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626994800, "uuid": "88003297-ce8a-4e8b-a535-c732c3939942", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626994800, "uuid": "c1d6af3c-08d7-4ba4-a314-be077faee88c", "value": "a34832e07b046b5a8236591c932d828c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4065f753-eb03-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1626968476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968476, "uuid": "42156f81-00e7-4daf-a92b-1b2772df92ed", "comment": "Malware payload (TrickBot)", "value": "a3376f41349a4e81b1bd5cb873063e44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rob110", "colour": "#4DA1FD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968476, "uuid": "cd07bf54-64b3-4664-9917-c889e7cc6f48", "comment": "Malware payload (TrickBot)", "value": "d9b9cbd9fd559edd3cf9e386bf6324be90c69902adfc7817d81a95fe4d18a8bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rob110", "colour": "#4DA1FD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968476, "uuid": "397d704e-a31c-4528-80a1-fab122ee7ba7", "comment": "Malware payload (TrickBot)", "value": "5ce0ed2571f6fbc246c050b6c0fbcdd31d244fa5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rob110", "colour": "#4DA1FD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968476, "uuid": "843ddca9-68ea-4a6e-877a-3a7459e21fab", "comment": "Malware payload (TrickBot)", "value": "15207808d3700fe558cbee3532aec663c7fe33f9d0e3e8be783e126ae7980f9fc53afdbfd71d9aff5089614a20196ffd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rob110", "colour": "#4DA1FD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968476, "uuid": "f82b90cf-c58c-4170-976f-6c2d64b6a958", "value": "T106A4E02C3480F4F6E0230175C9999665CAADB8247B2378E7E7C46EFA7F655C09A3431E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968476, "uuid": "3373f29a-a6ff-46c1-ab00-929820b58851", "value": "13012c7764c22db0eea00ae6b1458d85", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968476, "uuid": "e6e06a46-1404-4804-a668-65124d6865a9", "value": "6144:ybRfnjXFr2KML3bbHHjYXWOZcy8QGd37ci/fW6/gNXtlTF5yVNU5JhJDCyFE:UZr2hHHmjMd1W6/gNXtrkVQhJDrG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626968476, "uuid": "49bf4fcd-cb72-45c0-bf30-8fc6ccc3923f", "value": 465408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626968476, "uuid": "bbb60847-f813-4d97-9477-c4e6bd101839", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968476, "uuid": "2284f7bb-dcaa-4f96-9d63-1f9fcfe0e742", "value": "a3376f41349a4e81b1bd5cb873063e44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7f075e9-eaed-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626959254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626959254, "uuid": "2cd760d4-656f-4fed-b13d-58874c71ba5f", "comment": "Malware payload (AgentTesla)", "value": "2cc7d328527b05a048f9a8386102420c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626959254, "uuid": "cbaf5691-5175-46f9-8c47-ec287b4c7fe4", "comment": "Malware payload (AgentTesla)", "value": "d9c12ca57571d19bea0f509e1f3b02b4a6022b5e82f8241756ab12909009542a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626959254, "uuid": "a4e3de0e-c131-438e-b7e3-4855fe551709", "comment": "Malware payload (AgentTesla)", "value": "e02b77a99a315dcb7b7f961a2a7adb285f96a58c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626959254, "uuid": "bcf3d8f4-1d7a-4c4e-9b88-083c762329c0", "comment": "Malware payload (AgentTesla)", "value": "90d06bb2655347737ca1d53c77022f767969884747baba1e07e58b876819fd2d9dd137ed3dc9d9d57c6bb275df2ea1ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626959254, "uuid": "627130a2-cccb-4a61-b906-09dbc3d99335", "value": "T153159D124DCE866EC6694DB69731AC5682314CAA2948F3132EC174FDD93F3EDC99F602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626959254, "uuid": "aa7c4165-8f5d-4281-a46b-3ca0ad63501a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626959254, "uuid": "219ec3b4-59ec-4c2f-b138-9c7f433ddc6f", "value": "12288:EvzK4aoug3yvut646NymjiyUEDRSgcDeKCXSMPQipP5a:Q3lQNNo3g8BipA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626959254, "uuid": "be88ceac-7479-49f7-8b09-29bcd447fdb4", "value": 922624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626959254, "uuid": "6c205820-ce15-4200-945b-3d6176ab30e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626959254, "uuid": "5005d815-12f4-432d-abf5-4bd200b33e9d", "value": "shipping documents approval.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4322daf5-eac4-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626941422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626941422, "uuid": "6abb3cee-ad53-4ed2-bd13-f522476232e0", "comment": "Malware payload (AgentTesla)", "value": "545a001d325071a329dc49becbf9c5c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626941422, "uuid": "87e79079-42ca-4428-a653-67d43cc59ecf", "comment": "Malware payload (AgentTesla)", "value": "dc068269ba73ae7c96cae4f108ed356a66b1d8ba29ed1fd070ce31749c909bd9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626941422, "uuid": "c92d60f0-99ac-40ec-9c95-783b8088ecf5", "comment": "Malware payload (AgentTesla)", "value": "23f64db23c119c556f572e4750b10de4b204d012", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626941422, "uuid": "3bd9d432-9fa0-45c9-a8c6-4ccd8b1d3ed3", "comment": "Malware payload (AgentTesla)", "value": "ba7c7e2de9250826ba0f0d0de90905dfeb20522d90602c8cc7cbfc501abb6345a8331895a15d5c0dc3e4c1ca2066689d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626941422, "uuid": "83d58630-be53-44cb-8918-ed43a2e23d5a", "value": "T162257C9C7213B29ECC27CAB28D648C70EA517C7B531BC2176057396EBD7E46ADE500B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626941422, "uuid": "321b383b-9c75-4387-b893-4c9040e9c13d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626941422, "uuid": "4cd4d8d4-773a-43c6-b33e-470d11b4accf", "value": "12288:ZDtyiRj5pWnuDKoU6CrpFy+tU5tg1MTQ3qhp655SofdolIWsyaUVKnp2UpATnjpJ:iiRNIuDKoU6CG5tg1Ms6gdfd6zahpZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626941422, "uuid": "414816b9-8c1a-45f8-a913-0d5eefbc949a", "value": 1034240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626941422, "uuid": "d359813f-47df-4503-bf66-07aa01b7012e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626941422, "uuid": "8527b90e-7132-4d47-ac41-a9446bfdd531", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1150de81-eb10-11eb-875b-42010a9c0053", "comment": "Malware payload (QuasarRAT)", "timestamp": 1626973980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973980, "uuid": "71aeb26e-35a0-4f55-84b6-402fd4d038b9", "comment": "Malware payload (QuasarRAT)", "value": "a9588bbd8ff05e44d52fd22189d0a2a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973980, "uuid": "a980c03c-fc4e-4396-b233-09bdb2b16a13", "comment": "Malware payload (QuasarRAT)", "value": "dc41dffda57c47fa241b72c17458daa137025e6306d116adc65dddb245d45ef0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973980, "uuid": "62668f3e-a4a5-438f-8e86-96878d744e78", "comment": "Malware payload (QuasarRAT)", "value": "b4bf2dfa660fc53744b3949f80ef13cc6fa23a74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973980, "uuid": "fb93fae1-d6ff-4a75-b135-7ab0c8d362d6", "comment": "Malware payload (QuasarRAT)", "value": "a4d90adcb5a4e42da5938b7c592e0d1aff1060377b5b3b71ca9edfb5b319f4cf132e9ca5b4f68c4858d1e3abe70e2219", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973980, "uuid": "4b6de845-161a-4197-a84f-96de6f2fa809", "value": "T13C0417237784D93BD2AD0374E02B47198BB5C097B746F3ABAA9995F07C023865D815F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973980, "uuid": "555e6733-6deb-4db4-8920-2f874de7b8ae", "value": "3072:dAr9+jbqOXJmsLArVfpapyDcsvmN7mgHthGtrVnHWhXg2nGB3l:da6bPXhLApfpQ0sy3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626973980, "uuid": "5ddbb3df-80a0-4e36-abdb-695d1fd5767a", "value": 180224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626973980, "uuid": "f1187523-6923-4b7d-9334-6ccd1b7f6815", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973980, "uuid": "0109eb69-9b98-4450-b2eb-d04316575a39", "value": "a9588bbd8ff05e44d52fd22189d0a2a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cce5987-ea8c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626917494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626917494, "uuid": "b334627b-8899-4a2b-9236-f806d14331c3", "comment": "Malware payload", "value": "1351d0681137029f9b31d3d15e3b828f", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626917494, "uuid": "259366ec-d0c8-4017-9dca-5dd0675e6b10", "comment": "Malware payload", "value": "dc7aaaaaeb81239b4d180f704bc7f122e6bcc9293bf8fb4713b22f8c10a0002c", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626917494, "uuid": "b7f60c15-8cea-40e9-9114-9d6de32bb7a5", "comment": "Malware payload", "value": "337c808e19027b4e9a75d214059644b612421c93", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626917494, "uuid": "04a49baa-aeaa-4b47-843b-0d3abc43a672", "comment": "Malware payload", "value": "61ad12fc6d116e4f8db255557fdb6ec5d3c584a2b82514d5826e52cecc1950036b951e85bf66cbb325793fdbb0406e22", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626917494, "uuid": "66781b60-bed9-482e-9c9f-1b6e0511cf6d", "value": "T1DF03E9232D81EA7FC9EA57F957E798304923B83D1B136305B398BC79AB499D43E1D108", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626917494, "uuid": "55a15fd5-db6e-4101-83d1-a7273b4122fb", "value": "768:IpoMdyh4zNAePvOuM0SKLt8hg2gWuDpwAxW:YdLNAeOuHzhEg272pwAxW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626917494, "uuid": "c6731a4a-90b3-44d4-bbee-4464d0f7ac8e", "value": 37916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626917494, "uuid": "936eaf1b-8613-4565-bda9-2ff9a03b3a43", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626917494, "uuid": "5d4ea262-c210-47d7-90e4-550e895d174d", "value": "1351d0681137029f9b31d3d15e3b828f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a9c0830-eafb-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626965191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965191, "uuid": "a86264e9-95a2-4514-8853-db2d08a6eb19", "comment": "Malware payload (Loki)", "value": "6cc1182298faedff4123a01cd71f17f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965191, "uuid": "d7d65beb-03c7-4228-be15-2e05e2d99d1a", "comment": "Malware payload (Loki)", "value": "dcc83cdb07ca180562e8d60726bceae110348801e682c23d1b55d95d59ef0a52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965191, "uuid": "883de6a9-16a0-4832-92fb-fd9408aed191", "comment": "Malware payload (Loki)", "value": "136a4d7128eaef93b26eaa237aa1eaa85e07b755", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965191, "uuid": "c4dec1a2-4ee2-4ab6-b0df-7dfc67043cc4", "comment": "Malware payload (Loki)", "value": "6aaa7c1c0b0473eb947a6427c9bf0d97c2d6ca967b423fbd4f1214a31994e289c2154237bc018ca8595e5ad008d03708", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965191, "uuid": "fe1e892f-40fd-4744-8b15-6d44e677ed1c", "value": "T105058C525DCF865EC2684DBA5B319C5282314DAA2949F3123EC134EDD93F3EEC99F602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965191, "uuid": "9da03f37-4686-4895-880a-94dc9aaf9023", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965191, "uuid": "549b9cf3-4c01-446c-9401-5ef56e4018cb", "value": "12288:hVXiqtG8MJeN5MOz3QzAazY7eGkHSU5WxC5tHGESMPQipP5K:jhtRMYN5X8Ws9Q/ipw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626965191, "uuid": "39887a7b-bdc6-4c68-9cc8-2525e53e50ee", "value": 834560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626965191, "uuid": "7962096d-62b2-446f-b66f-c67f357ab610", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965191, "uuid": "eac6b7cc-1eb9-4255-9ecf-26907a6557df", "value": "RFQ Check-up item CS1528240.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3901bc1f-eaae-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626931956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931956, "uuid": "8df2cfe1-0fd3-4f05-9638-93f7b1da8156", "comment": "Malware payload (AgentTesla)", "value": "b6e7578868743fb3b695b388dcce06b2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931956, "uuid": "8a554d1d-c22d-4f6e-b8a6-30708ad1e246", "comment": "Malware payload (AgentTesla)", "value": "dd2262c470cbff3cef7f965e0c457de414eb71bb0ad94ffc2d64aef577462d14", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931956, "uuid": "8ee7219c-6c9d-4fa8-bf74-5044d4fac838", "comment": "Malware payload (AgentTesla)", "value": "1632882505f3f76b0962e767da08623357a59372", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931956, "uuid": "e9705f1e-c486-4431-a2c0-bf34ea89f36e", "comment": "Malware payload (AgentTesla)", "value": "d6dd277861bf284aa1ae7aae1b75cbd0d3974de972fb1a5688a385c7de81bb201b4a1bc397ebba907e2d3557ae0d5672", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931956, "uuid": "b82f2911-243d-4b49-8180-981f32d1a3f2", "value": "T1FA25BE125DCF866EC2694DB69B319C4682314DAA2949F3132EC134FDD93F2EDC99F602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931956, "uuid": "e8e14a2a-1219-4306-a49b-e267f140b71e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931956, "uuid": "7abb9bfd-c2d7-4be3-9f06-630e0429a6c6", "value": "12288:JGF0RfZuIQg9dH9aOQRW8zazoifw/jPzVpI89DSSPi7wSbgrSMPQipP56:sF0RxuILddadjrVzNnGipg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626931956, "uuid": "764982d5-dc51-4359-8f03-08653e3d3336", "value": 1057792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626931956, "uuid": "f17367f9-d581-4462-8ad6-9899be9d6e77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931956, "uuid": "4b43fcba-5de0-487b-a403-e28387c58610", "value": "Ref 10M-86776.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e399357d-eaec-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626958871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958871, "uuid": "241a8474-8230-4fe0-a98c-8bf1ba4bc847", "comment": "Malware payload (AgentTesla)", "value": "05faa69a6a3b27e38fd9cf62af7c7912", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958871, "uuid": "07cc121a-808d-4bc6-9cd4-9f082db9973b", "comment": "Malware payload (AgentTesla)", "value": "dd7c1c609857ba8705a55abc0e35b32837c3b31310eaa4a7d43ee1c585ddfb79", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958871, "uuid": "863a8113-9b31-4d26-98d2-ace4b4d86653", "comment": "Malware payload (AgentTesla)", "value": "deec4c6629877307a1ff83e45ec51b5cabe9f257", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958871, "uuid": "7ef79920-e95e-4f18-9bec-127a5371cf79", "comment": "Malware payload (AgentTesla)", "value": "8d2f43dd19caba4927a72de16139fc813ec21fe0ad40ed9a7f8cba291b219e91035a73a9a7e4c8c17eff25df9e78d328", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958871, "uuid": "2e40764e-3363-4bc0-990c-5460e0f8ebee", "value": "T1A0F4F1163B80AF8EC56B8E7AC4515C10D7F1E126670BE3876DC316EC598E3DE8A13396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958871, "uuid": "0c8ea97c-9fab-483f-adb5-db13bb3bea3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958871, "uuid": "9be2dabd-ce68-41e9-8f28-e48e96556163", "value": "12288:u2VINh6W5OrJquWoY/87Ui6CKnXR1sDXal9UJXOY8cpXnrzsgNSR5dmtTHSgjEdk:u2V2QnWhUAIKXLsDql9UJXTnrBo4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626958871, "uuid": "f62e60f1-3624-497e-b397-342626b3aa2c", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626958871, "uuid": "4b916dea-084a-4758-abf3-3e9e2423e487", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958871, "uuid": "a3b4cfa1-e5ff-4832-a912-9f6f90c73e3f", "value": "Confirmation of Proforma Invoice payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "888f2d48-eae4-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626955282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955282, "uuid": "68976684-c125-4c18-b708-cec01f4c8d17", "comment": "Malware payload (AgentTesla)", "value": "b5b2779d4fbbac3dcfbd03397782e528", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955282, "uuid": "e9baf0bf-89e5-4bcb-aa3a-cb5d49ea3e9e", "comment": "Malware payload (AgentTesla)", "value": "ddade50a00b5a1e9b4c41b2d8f79be151b55e52a240378e2e2a10f4fca67d03f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955282, "uuid": "0c3cc243-84c6-4783-a0f8-46e69d2cf995", "comment": "Malware payload (AgentTesla)", "value": "e658ec29b3e04ea153eb469b4621f1576ce38dd2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955282, "uuid": "062ac2c6-382d-43ea-b350-859c7fec4dd8", "comment": "Malware payload (AgentTesla)", "value": "d045b8061143bd14f9a426004edea23f2b670f1d1e23f5504d8233fcdcf161065c114a597ca9478ae0480056d123dfd7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955282, "uuid": "54a8f04f-306b-4ae0-bc1e-8b9ab8dc96af", "value": "T134C423DE9D802349676E997BCD09EAC6ED581EF5538823F1DA01953248E07EC62D8E33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955282, "uuid": "b561eb8c-c2e6-447c-850b-c85e5c4bdb8f", "value": "12288:J1qyaOBa4hYkpsXkBH17/ucReZm0gI3wxgRki+YfBwAE/kEMRUzs/XUKW:vFfx6kKXILDReSEMgo0zLEY9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626955282, "uuid": "de4ee7df-1338-44ec-a6e4-22d7e6b2e5e5", "value": 560515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626955282, "uuid": "d20e0ac0-4f8c-46b1-bcc4-e73b4d069d53", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955282, "uuid": "fb05d8fd-d2b7-4006-9135-e506ef341b6f", "value": "Payment slip.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acc84163-eae5-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626955773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955773, "uuid": "9d5356f7-db96-4655-aaa9-401523cc2d01", "comment": "Malware payload (AgentTesla)", "value": "81afa08f1a1acfa3fd9f52ecadda2f55", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955773, "uuid": "a64f52c5-86e6-47ee-a028-80089218d6a3", "comment": "Malware payload (AgentTesla)", "value": "de49258994a651e41ea2b519ae39eb815b8d26cb3097fab2dd0e1ee5c9ea37b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955773, "uuid": "ae49ae71-b5c0-49d6-9ecc-5ebd7872ae02", "comment": "Malware payload (AgentTesla)", "value": "dd5d7f7638848ef8ae9d682d821a003b00bba6af", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955773, "uuid": "c868ea60-17b5-4e29-adb9-f62385e9e294", "comment": "Malware payload (AgentTesla)", "value": "56212d4a2a67cdda2e457feba526d92b8ddb8b8c35cc73eaae6559ee3ecf023f0b93fe9ee1c47ff829cd8186a9a51c27", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955773, "uuid": "64eca786-a673-4e32-9e58-d42c0f095cf0", "value": "T10552296273D8563CD4FA1B3668B7CA612770B669A911FF1D20C0014D9E2774C4BA3F6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955773, "uuid": "0f7a7cc7-98e8-4a27-af2e-599edb21dce7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955773, "uuid": "2de46b64-07fb-4c9d-935b-3596fde4882f", "value": "384:ap7KEXvKPle25xDatPj20+drfvLouBuvO8QKZ8hGfthUXrG6X:GMe25EclcO8QKZtthUbG6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626955773, "uuid": "ff425e57-4183-4557-91a8-e1fd4e6ad754", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626955773, "uuid": "20a6d0c7-1917-43ec-ac56-11aa8277f11d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955773, "uuid": "020967ec-28d0-4b0e-89a0-c7ffd6dce2e5", "value": "Swift-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddce0d36-eacb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626944688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944688, "uuid": "173b4142-0b38-47a5-94d1-f8103dcac46f", "comment": "Malware payload (Mirai)", "value": "5f2b063b3423065cc1c6ea63979c6f46", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944688, "uuid": "d43215d3-16bb-4bca-8f97-f71bd8848137", "comment": "Malware payload (Mirai)", "value": "dfd80dcc5c2b9f51fcd45bc6e4b494aa777500ef769c17e7aa9d63287adb92b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944688, "uuid": "1cd4fd79-2c49-4a0f-8ab9-ab4980e45565", "comment": "Malware payload (Mirai)", "value": "bca27e6bc1806e26a0f547d275e06e5d6c39b5dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944688, "uuid": "91a7fc72-bd59-4b6d-a4da-5f0b3f9ee4c0", "comment": "Malware payload (Mirai)", "value": "4355f4e22e637f76daa8345c8da64d9a000010b5c3c6881dd00875009f6311cbf19af8c162c7ede4cc55f9b0aa6b369e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626944688, "uuid": "2ac0f88b-29ff-4e2f-a22c-2dd4aa0f5060", "value": "T111B2F195D6EF17C3D3919332D0BC9A4DE2B36AC10346451A2209B24F92A770A97FB3E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626944688, "uuid": "cd2d6346-aa02-46d8-a33d-daccda480e54", "value": "384:MvDKKQOcRpmYLdn6RBOFRFt5rUF81uiSSlCo3AnupVFNqnrrd1NEZgO8UXWozPLb:i/QOC0Yhn6ROHWF09cwNPFCnNBxcWCcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626944688, "uuid": "98eefa7d-a983-4484-be40-046dc9f224c7", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626944688, "uuid": "97f3b24d-9d46-4472-af9d-4fa7f1bcf987", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626944688, "uuid": "dbf5deec-d960-415c-92a5-120145f8bdb0", "value": "5f2b063b3423065cc1c6ea63979c6f46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a614cf-eacb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626944679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944679, "uuid": "58fd2ed2-0555-4505-b875-38aaa7d40e0b", "comment": "Malware payload (Mirai)", "value": "28ae443f54fdb93adc756778ad76ef90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944679, "uuid": "69d4c79f-7d44-458d-ac32-731ebc04bd65", "comment": "Malware payload (Mirai)", "value": "e00e03516a774d45197cbeac2e89b5d9a4df7849b6fd19e360ee72619ab6311d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944679, "uuid": "d9f951ef-6da6-419a-a969-6b76bcb1a408", "comment": "Malware payload (Mirai)", "value": "61c196c94b176f71a5748e5910c9db9c03927e9e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944679, "uuid": "45999fdb-5e8d-48bf-8b40-86a3f5c55418", "comment": "Malware payload (Mirai)", "value": "d59cfb48348085162343a9a0bd7e0aec8f29c7dd860c93a7ab0cafe94d870ac6a5e436483aa7505372489862c0cdf800", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626944679, "uuid": "808ba64f-37bf-4b42-8798-09643893ab1c", "value": "T15DA2DF1825CCEE72D1B0903BE13CC34BAEDB47B652FE713E1E180798A45191AD7BE985", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626944679, "uuid": "bbeb7edc-be54-4616-9426-17a677ac1211", "value": "384:YAmog4c6L5i4+stIW01vhQIE2TQKMpI8QwxZVFjfPnSb9khymdGUop5hX0:Ypoh/DxCvhdR4IjWVFbSKs3UozJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626944679, "uuid": "0a5baae9-d8ce-48cb-954c-fdda31cf6e35", "value": 22132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626944679, "uuid": "c7847be7-972f-4a19-80e8-64fccf78b093", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626944679, "uuid": "f256e920-58dd-4697-ba64-0bd96fd61f3c", "value": "28ae443f54fdb93adc756778ad76ef90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d20602a1-ea86-11eb-875b-42010a9c0053", "comment": "Malware payload (Dridex)", "timestamp": 1626915033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626915033, "uuid": "22c32f3a-c255-470a-90fb-a99266342a14", "comment": "Malware payload (Dridex)", "value": "c6f2239754469a59c8f97e30df2e0950", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626915033, "uuid": "615a18d1-396d-4065-8bc6-5979d2d3158a", "comment": "Malware payload (Dridex)", "value": "e028f271461ba72f91934ada56064d0eab66b4ad3066d653632fad04351efb00", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626915033, "uuid": "c2573a31-5b7a-43ce-9543-1c0b398c93e0", "comment": "Malware payload (Dridex)", "value": "4310f7e6baaf4f86defd9c052ea40649f6b04e9e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626915033, "uuid": "e47b6824-d22a-44aa-ade4-d476b36f6198", "comment": "Malware payload (Dridex)", "value": "406288d3e2069a18980e4f615ab644cbb9f61edf6af4ec73b561cce75c2bafb32bc13e8fbae780979fbb019582c799e8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626915033, "uuid": "38538cc8-a6c4-4899-b1a1-4a5e8096851c", "value": "T1AB645FD5EBE1C92FEBD0A53A0C561730527CCC4499900B977259F33AB72BA3C8E852D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626915033, "uuid": "13efa9c8-095d-41f2-8ad3-c0974d2568eb", "value": "6144:j0Y35qAOJl/YrLYz+WrNhZF+E+W2RGtqPjKBbA2G0VeU+fMGMKMAGPw5iMS7:RjwbA2EfKfEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626915033, "uuid": "7b4fcb25-b5ce-47df-b4f2-db6cafe8d570", "value": 323072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626915033, "uuid": "c65d41e8-485e-4147-b95f-46f323e56400", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626915033, "uuid": "2f851333-2f5f-43e4-95a2-d7a1ad652f3b", "value": "c6f2239754469a59c8f97e30df2e0950", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "523c797e-eb00-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1626967217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626967217, "uuid": "9225297f-5cf6-40e5-8f5d-5ca03cb62dc3", "comment": "Malware payload (TrickBot)", "value": "d24fe7e4e78520c4fc930c5dc4e330f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626967217, "uuid": "480e0e54-4d08-411a-b7a9-64037617a5dc", "comment": "Malware payload (TrickBot)", "value": "e02ec4de6280d08990fa9171ab6cea14be9042af8768645f19823fbab87f68d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626967217, "uuid": "fa635446-989d-4496-b699-9f6e174f4ca7", "comment": "Malware payload (TrickBot)", "value": "65cac5306e3a3c88df92a547f67845dadfc6bae9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626967217, "uuid": "83fc3dec-68e3-488c-b855-b4385bcbfe0a", "comment": "Malware payload (TrickBot)", "value": "9ed0f5888cdd461cf4c8145d4e37d6b84ffddfb04f9b14a00d4fef68f9fb108c63f039581ae396c20c7758abc16581fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626967217, "uuid": "5bd5ac48-a576-4bbc-80de-fe9f8fcf69ea", "value": "T16CA4F11131C5C873E47316788DAADAA94639FCB00B30A5CB7BD91A7F8F791E1993424B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626967217, "uuid": "31ee84c0-a0bd-47df-9ef6-b2516d31b14d", "value": "c025ffad7909d4943993f12c9b0e98ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626967217, "uuid": "0cfc9053-cabf-439e-ba02-ae4e95ec2628", "value": "6144:c7D7F1DbW6JmX6as1xyOTqQ8WpPLCMjUwTqjVgQv6ZVojMawmq1tk1A:u5bWdX6P1xLNLCiUxJ/v6Zla9q/k1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626967217, "uuid": "2d92b6a5-0112-4195-a5d9-695a05d6a3a0", "value": 464384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626967217, "uuid": "a9339150-3d9f-40da-971b-7887da010ce4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626967217, "uuid": "7d48e0be-171c-4f5f-98fb-f4cd40b751fd", "value": "d24fe7e4e78520c4fc930c5dc4e330f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce04235e-eae4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626955399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955399, "uuid": "cc432e9b-2ab4-41e3-b02b-536396cb65cc", "comment": "Malware payload", "value": "bf6840f282a788c22d47afa80c9f850a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955399, "uuid": "778a2a63-37be-4e9b-ac08-3f8c50de1235", "comment": "Malware payload", "value": "e03772203fb29e8893bf4e0664c4bdd16b36177ee694cf9047e5d8251edeec40", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955399, "uuid": "1fedbd37-5b90-4cd7-8f74-bf03977e42bb", "comment": "Malware payload", "value": "0c08d334de5e329755be5c5ef903bf1b1d30c481", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955399, "uuid": "14338948-5c2a-441d-84c9-0ccec06c8c53", "comment": "Malware payload", "value": "360aab1911c1f5c97d24d0e3fa32ae49d42fa3f6d6b29a7b34266ec49b94604aae2e64f2213b11c01e4a7997da0b1d0f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955399, "uuid": "051bbcb7-de7d-4135-94ec-1820dcf4a24f", "value": "T12E630208D8442369CA68393EF34548BBFA4E6A05EB804BE97D234B9A759D7F14B8941C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955399, "uuid": "35b0948f-8462-4470-8844-fc579f96de1f", "value": "1536:vXuRHLiTZfvMZUrKf7VCWuIKrxFVhBGvZWc+yMZoFhf0I5l2ASGfG:IHokZVr4c825uGfG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626955399, "uuid": "9d2e43be-1ca0-43ce-a22d-8e30de8bc934", "value": 67511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626955399, "uuid": "85b6d3ae-daa9-4933-bc7e-782a637a18fd", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955399, "uuid": "cf8e6c93-4f92-4c70-95c8-3a5dd00d7372", "value": "Remise.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e566bf9-eb03-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1626968553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968553, "uuid": "c566a214-c58d-45b2-841b-be3b71d4284d", "comment": "Malware payload (TrickBot)", "value": "48db6a8160708b9b1c29e2f480e8c5ca", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob109", "colour": "#78B843", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968553, "uuid": "cc442969-7e58-40c3-b19b-665640a1dec9", "comment": "Malware payload (TrickBot)", "value": "e07cef58aa29455209f32ef23249c9dbfc14dcb79b129dcef040f84aec0253fb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob109", "colour": "#78B843", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968553, "uuid": "8ca4218b-04ca-4a61-b667-f76848235ae8", "comment": "Malware payload (TrickBot)", "value": "bada0322219a1c14b5caec2c3d23fa3c7e1219c6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob109", "colour": "#78B843", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626968553, "uuid": "fb071c20-ead5-4ee5-9850-7b24530929b2", "comment": "Malware payload (TrickBot)", "value": "d828ecc9960b32a6f5d994f877c49e2f47edde8614dfebb812163669b5ba406d258830e4382e7e4713b8e52d9bc737d8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob109", "colour": "#78B843", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968553, "uuid": "6cce4230-bb81-46d5-9b32-b0eff929fd25", "value": "T135C4CF2235E08577C4EF16345E667778A3FBBD942BF2C147679A890C6D339128B22327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968553, "uuid": "ecd79582-ace9-4723-b6c7-501251e2aa95", "value": "f3deb6209dc9c95daaecc9f849af840f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968553, "uuid": "a3fe8359-8352-49d9-baaf-c7bde459eaf9", "value": "6144:6nhWubOStZ6AbgmgwLp3gUhWeGtSOPc/woVPHma1MXohuPATdTpNSTrbkYW412ph:6nTltgBNwxgUXv/DGaXhu45pI3rep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626968553, "uuid": "9c03ce58-3456-4882-ab9b-010413fedf5f", "value": 557056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626968553, "uuid": "bd6dc665-1e2a-458b-8923-081fca43a3cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626968553, "uuid": "afdd9ece-9243-4086-a696-4d0a9c782f59", "value": "48db6a8160708b9b1c29e2f480e8c5ca.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff5185ba-eb0f-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1626973950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973950, "uuid": "967c6a3f-a2ef-4cd4-9aac-4c93b967bd8d", "comment": "Malware payload (DanaBot)", "value": "1f2c7f22f62d5b1159e5ace9da02d76e", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973950, "uuid": "1b2afa0b-eea3-4b07-9cce-3d51ca38cd6d", "comment": "Malware payload (DanaBot)", "value": "e1abaa8900615ec20e15dd6fc3b646171efd9dd7c124f1faedecbbc852b29891", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973950, "uuid": "ed3fa3b8-493c-4f2e-8284-52b6f8a29c57", "comment": "Malware payload (DanaBot)", "value": "b7f6f61fb9f94815eaa0e8840898d59982d96145", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973950, "uuid": "8c3172f1-e6fa-4830-a6eb-e30d9fc25304", "comment": "Malware payload (DanaBot)", "value": "940b28768b0e198f221302c0529b6f5b8e2d631f0392968c915c749304f54dadf2ea60301034abbbfe06d69c85d03871", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973950, "uuid": "7e6a1ffb-ac23-464c-8586-5b008042a02e", "value": "T1D1352350BAC48C31C2858D3A64E7CA94673C7C2A2DFE45676B45B6CB6E7128213FD70B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973950, "uuid": "b8bea140-c353-4048-ac04-20fda67973f5", "value": "7780eb9cc098185992365509d7637fd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973950, "uuid": "91f683ae-b105-4822-9ace-73881927af45", "value": "24576:lc497RTtCwZRn+KmBbrphrlJSm+xeiuywBZu1V70VtCpyy6Lz:lc49hESnOXfdPtuVMz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626973950, "uuid": "a7056a34-7e28-4911-a20a-e1f7b4e8c29c", "value": 1146368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626973950, "uuid": "d217c273-84f0-43bb-ad18-1d991d88ed85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973950, "uuid": "0fc02a27-1f43-4b75-8fd6-9b1f9764aa80", "value": "1f2c7f22f62d5b1159e5ace9da02d76e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52123ae5-eb3f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626994275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994275, "uuid": "bfa5cf74-c5d9-4d15-b1d5-d5223a76a632", "comment": "Malware payload", "value": "95bbbc35c87225eba59eed3033ca37d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994275, "uuid": "797e4b31-44b7-420f-97eb-65f1cbd97d5f", "comment": "Malware payload", "value": "e1d12c1022e57748f7d05ef18c2d9f44b12e63b348537bd2cb8c70a647e54144", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994275, "uuid": "2faa9a35-5e2b-4a75-bff6-aa341767c4ad", "comment": "Malware payload", "value": "61d1008504b334a879ccddb217aa3bd0db227b49", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994275, "uuid": "aff6be78-023d-4b2d-95bb-da8e1443d0ee", "comment": "Malware payload", "value": "e4e83d9e2fee8d88e01eba6ee0b85e5cb860e32750930997680ddd98ab8a96f416be33176fbeb7827b3f00d7657302f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626994275, "uuid": "510b9066-92c2-4442-9db8-e7643b048a26", "value": "T16BF296462A365FEDF729C6358BB34A30A75833C566E0E184D36CD9004FB034E686F7A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626994275, "uuid": "3ef6b3bc-8324-4a78-b493-c5e9c82833a0", "value": "768:gpoNymYqc+44htCpAfWcLgEXgZMnMN9xMFNMVRL2rXdWvZaSSp2W:TomFS+lGSi1CXdWvZ3Sp2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626994275, "uuid": "5f2867a9-456d-4652-8fdc-446f8ae98a6c", "value": 34660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626994275, "uuid": "84dad875-9587-40b8-bd8f-57f63314e847", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626994275, "uuid": "af1c93b0-dbe3-43b4-aef5-fd7d2cdae2d9", "value": "95bbbc35c87225eba59eed3033ca37d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702591b9-eaf8-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626963831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626963831, "uuid": "f322fdc0-2aa0-4c02-b07e-30c8497540d0", "comment": "Malware payload (Loki)", "value": "7fd6bff5fc36687c58d1ac8f9f3a0c0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626963831, "uuid": "d992ba8f-2364-44d2-9507-b8256c76cbfc", "comment": "Malware payload (Loki)", "value": "e2665788c67fe4f9ecf963e7894858a519d40b5416d1e57fc3249f34c4316942", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626963831, "uuid": "3b296893-bdc8-4dbe-8a4e-d38eac76d432", "comment": "Malware payload (Loki)", "value": "5db1a4a5610ca166c597ff409a1a85ad54c79651", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626963831, "uuid": "99ed546e-7fe3-44df-876b-2363ff2134f1", "comment": "Malware payload (Loki)", "value": "db0cd05cc1932ff68fdbf8ffbf22608d8b20c8f109c5d8386eff062b1b39bdb0ed4901c364b36a7c508668470534abc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626963831, "uuid": "f1983c39-8c8e-453c-b860-3a6b9d2ae15a", "value": "T1C2E4D0357317EA04DE39C3BA8C9ED15857FDB026A12EC7393EE461BD786273859E0488", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626963831, "uuid": "4fbfae7d-9397-4683-b46b-3be7247c0cad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626963831, "uuid": "3afa8ee6-467c-448d-9b31-ae5291125188", "value": "12288:qB0mBHW/pD1I6mJRXcRbabBw0emSNXRrT7eMMOB8sGsyaUVKnpu:2FJ2paarnhMRzahpu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626963831, "uuid": "a83ce908-62a7-43ba-b37d-827a0d08a6a6", "value": 694784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626963831, "uuid": "54b106fb-352b-42d4-b660-f5117445e8d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626963831, "uuid": "6975cd5c-6939-4fe5-9f88-b78ba28bf501", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f28e9a-eb1b-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1626978847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978847, "uuid": "27e9e506-eeaf-4b6a-85c0-51e208fd348d", "comment": "Malware payload (Smoke Loader)", "value": "d5efb3fa1e49790e1ab38141b089e379", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978847, "uuid": "0f86aaa7-2a84-4b31-9e8b-ded75e51c0c6", "comment": "Malware payload (Smoke Loader)", "value": "e43b4c22c80cef8222b4c80656a6ba5df323742d23cc4845de27de2866b84d28", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978847, "uuid": "b415223c-0985-418c-b33f-c9efd9aa8147", "comment": "Malware payload (Smoke Loader)", "value": "6f01357687282ede544fa8163f067729f6b38899", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978847, "uuid": "19c01ff8-a8f4-414c-9ff4-6f9e34685230", "comment": "Malware payload (Smoke Loader)", "value": "e756c3604adfd2e59d5884114d0060185d7ceb196cd121bfe17350f724cbd550a2b746e7a90bc50bc5be7d429cfc455b", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626978847, "uuid": "c4a45c00-f5c6-44ce-a653-64b903fb66ec", "value": "T15304C0207580C472D7A10931D8FAC6A52A3EBC256E78554B77853BCF6F723C1A6BE702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626978847, "uuid": "68891a5b-91f0-4861-9b31-95007deaefd6", "value": "4d4fdfb7fcb2254a31ad850df30aced5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626978847, "uuid": "00e9346d-3f52-499e-a3be-c3a35d43ac14", "value": "3072:K01jnUKsyXLCDopUHOiLJDwXCRkTllRs6bL:TrUKsgLCDoudLyXCillx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626978847, "uuid": "53f52161-e847-4b04-9b30-654d732b2e4f", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626978847, "uuid": "f3f14ed8-ae80-4fd5-ab9b-0280f5bd619d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626978847, "uuid": "539fdd74-f3e7-4bdb-a971-a7792df89775", "value": "d5efb3fa1e49790e1ab38141b089e379.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "818d582a-eaeb-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1626958277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958277, "uuid": "a41cf4e1-06fe-49c0-b68f-0702c634e9c0", "comment": "Malware payload (TrickBot)", "value": "e2e034dfa6cc9e5dae4121a0b3fa6d56", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958277, "uuid": "f6a5315a-6067-41fc-9d3d-d89c71ef4384", "comment": "Malware payload (TrickBot)", "value": "e4d2675a178319609e0b022d9dfed2b6e68d1d269b0b4e25ed63cc24f7296841", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958277, "uuid": "a45c1f9a-457f-4ccf-b4d8-abb99c514086", "comment": "Malware payload (TrickBot)", "value": "210eeadcffea02e7e7376423b818833af6a909b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958277, "uuid": "14d2be29-20f6-4a1c-8504-a19914b24b0f", "comment": "Malware payload (TrickBot)", "value": "ec666baac176f52067bd0593ed3f36bb21ae656212f685b4f472461c4acab7412bf4ae068ae2c6ea5594a10c56633407", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958277, "uuid": "e83b70a0-1b12-4bd7-8ce0-1702c70cb261", "value": "T11CA4E02C3480F4F6E0230175C9999665CAADB8247B2378E7E7C46EFA7F655C09A3431E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958277, "uuid": "ff97317d-96ba-4733-9f56-eb5299d576af", "value": "13012c7764c22db0eea00ae6b1458d85", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958277, "uuid": "ed6ce4ed-31e9-4689-8f2c-e055b9292fdf", "value": "6144:ybRfnjXFr2KmL3bbHHjYXWOZcy8QGd37ci/fW6/gNXtlTF5yVNU5JhJDCyFE:UZr2XHHmjMd1W6/gNXtrkVQhJDrG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626958277, "uuid": "e8bb8407-7598-430c-ad6e-d507a2d2a408", "value": 465408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626958277, "uuid": "cd1570f5-533d-4727-a796-5d4db654c3cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958277, "uuid": "a9a48e84-93b1-46d0-8c01-ad730cf91dc9", "value": "e2e034dfa6cc9e5dae4121a0b3fa6d56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b09eb7-eb10-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626974224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626974224, "uuid": "ce7d804c-2a7b-472d-9d5e-59444bc2a65d", "comment": "Malware payload (AgentTesla)", "value": "699e56ea4da0b0865fc33308a8b09df9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626974224, "uuid": "9ec00ce4-1a6c-4677-93d2-bdaa38a1f6ff", "comment": "Malware payload (AgentTesla)", "value": "e5805ba9f9119986eb49be00972cb30d5249f8c19c872c4daacb2ad67a157bb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626974224, "uuid": "0700802e-6876-4812-8453-45bd61597203", "comment": "Malware payload (AgentTesla)", "value": "c32dff686616f747f808a5c0bc67484d4755f568", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626974224, "uuid": "f6e158c9-70e8-4e21-a2e9-cbf615d28e06", "comment": "Malware payload (AgentTesla)", "value": "9e34522544aa48dd4e4bbce352d77e4627995ffb848f91d362322605f6a8f2ed7cdb58469cfeb615b6f59f53bd050017", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626974224, "uuid": "20d869b2-ac62-4b8a-8f64-97ec2afdeb31", "value": "T19B82B7E46F9885F2C1BCF631A0E32D85A37265F7B421CE1F968E325318437856ED129E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626974224, "uuid": "b535930d-2463-4daa-b28e-ca5a07fed6e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626974224, "uuid": "0b1d89cc-f8c6-4b55-9231-0398669aefbc", "value": "384:r/9hScRkXl+0Ii1QKYwaCZU6w2mtTAEhVLU6oLUJflQDrbP:rXScRkjl/mv6SNhVPoGfl+bP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626974224, "uuid": "62f946ae-eeb8-44c2-917c-e723a8c04ef1", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626974224, "uuid": "5db975ab-8ee6-4b58-bf57-795280db6137", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626974224, "uuid": "e243822f-2f6f-4cc8-94a0-3914ed8853b5", "value": "699e56ea4da0b0865fc33308a8b09df9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d35b4b-eafe-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1626966285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626966285, "uuid": "8f55cd6c-0f98-4898-b8fe-3a7faf94cc25", "comment": "Malware payload (Formbook)", "value": "f683a8eb2e17866a194af9b23efda095", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626966285, "uuid": "fb47de51-038f-48fd-831c-1c4a5b02c564", "comment": "Malware payload (Formbook)", "value": "e6de55ef568521e22566496d9df49eb1a4cf2ea94082d8d0bcd357f41d2962ef", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626966285, "uuid": "7a292170-8b75-4bd5-8cc5-76c5108bcc58", "comment": "Malware payload (Formbook)", "value": "b3002f93d24336a9af003a7a3da36217a7d7b8db", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626966285, "uuid": "8929ce82-851c-4926-82f8-14f7140c49fb", "comment": "Malware payload (Formbook)", "value": "1c7ea2a4423d04f2f1f799c4dfe5763c344054e201b24b480e6359334a9235da9ae1787e48b71c8d3b8861f2ec41c60e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626966285, "uuid": "ece67f3e-a1bc-461b-8855-b6911d367bfd", "value": "T184451202719FA7F2FB636433D288DA114539FDB26E13D73E8515BBD3117AC6083A2686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626966285, "uuid": "a1a56a7f-99b4-4886-a0cc-9079b1f654f9", "value": "24576:8eZrCoZjO0Z3LTlr6QoKZavurFhXI7EUMYcSNk5TIwrgm80Wa4+W3xBK8Gom9KvE:VZrCf0Z3d2e0urFhbpYBNk5T9q0bohBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626966285, "uuid": "6c2b2d32-7185-48ad-ba8e-978024e3dea2", "value": 1277440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626966285, "uuid": "cb765b67-f4f0-4d6b-8ad2-1ca6d7d9cd99", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626966285, "uuid": "004fdce9-5703-4734-93b0-cc0753f7d755", "value": "Form BA.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe15fa9-ead0-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626946886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626946886, "uuid": "5174bba6-b3cb-4a64-995b-dbdac0573e8e", "comment": "Malware payload (RedLineStealer)", "value": "888ab99280a081717ec5c5749266d1bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626946886, "uuid": "12b77d3c-7760-48ac-b1c7-5cd6d447bc20", "comment": "Malware payload (RedLineStealer)", "value": "e726f2014db779e3605f60499f84676ceb45160c6d092bedfa115f7e09d693e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626946886, "uuid": "46803cb1-a576-4d23-9f77-01a360dd6b6c", "comment": "Malware payload (RedLineStealer)", "value": "3a071aeadd42c1232ff2878d2adf7f1e4a629180", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626946886, "uuid": "fa7293fd-e69c-4df3-8f4c-b9909bc47262", "comment": "Malware payload (RedLineStealer)", "value": "3d5b0459bdb1882a1eaddfb3d47a9df6445e4f7e3b3641dd83f6962150ee1da3ef663fab361c8536db838deed6db99d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626946886, "uuid": "34ad601d-f124-4f8c-bdeb-c5a15159021b", "value": "T1A1D4247281169BCEF43AA93371049DBAE230D944183894A1DBE773BA1B70F4DDD89DB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626946886, "uuid": "d6d25db9-c26b-4fd7-a502-15387d89a33e", "value": "caa5e6a2892587c2324418efee31c648", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626946886, "uuid": "1707419c-fb6e-4bce-b07d-f9bcc5206d07", "value": "12288:67iuUvUF2JURoyPa5UA5/zfqb3HtwQG99:67iuUv8Paz/2ZwJ99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626946886, "uuid": "aaf79ed3-0942-4c0f-bfd7-2f6f84302a47", "value": 598944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626946886, "uuid": "9dc0bc6c-5617-439e-9806-de0b11ff6c04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626946886, "uuid": "ba9079fa-902a-4ba9-b73e-487b8575a75b", "value": "888ab99280a081717ec5c5749266d1bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc48d73-eae9-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626957576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626957576, "uuid": "cc8c9615-98f0-48f4-8af1-ab32a4773629", "comment": "Malware payload (SnakeKeylogger)", "value": "facd1c07ffcfb16de518d0c977814d92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626957576, "uuid": "56e35aa5-a37c-44cf-8623-4c6e1b251e78", "comment": "Malware payload (SnakeKeylogger)", "value": "e7488c44d2b9f78f7c5e96126798220cbc3a7faf749beab4b8545207a73ce0d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626957576, "uuid": "a6a80dc8-4d0a-4b3b-8d29-aec2f0547405", "comment": "Malware payload (SnakeKeylogger)", "value": "27aa313a64ff37d6c31bd1a0a9953f00a48b3408", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626957576, "uuid": "4a131df9-a637-41b7-8813-39f11c60b2e5", "comment": "Malware payload (SnakeKeylogger)", "value": "60f5bf5da931868cb6e231654701acc45d8e88e23dfae7f0a95b02e51065394517603f418845e5c60e61b14f29175d28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626957576, "uuid": "ab9c20c0-751a-452f-8261-5e85cbe7864e", "value": "T102F4CE35F227A708DCB4C3FB1858925167B9BCE8B219C7396E58B1F878736782AD1710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626957576, "uuid": "01a9087e-2315-48be-9493-1e1cc8785517", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626957576, "uuid": "3f6ba475-4efe-4210-a6c9-cab85455b32a", "value": "12288:JIZRPc5/wTDrYpFibSlbUVU1tBvzDAo2Sq1oXsxyaUVKnp:75ITDYFimlm+tBbMo2SqPMahp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626957576, "uuid": "17ab77ca-7af5-4f07-818e-4aed4532c301", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626957576, "uuid": "70c6f935-d42a-4530-8316-82c832755371", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626957576, "uuid": "9c4ec7d4-6fcc-4dae-a9b4-a1c6a2042e36", "value": "whesilox.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eaed3b7-eb10-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626974056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626974056, "uuid": "91add174-93d9-4f4b-86fe-d3d4a0563df3", "comment": "Malware payload (RedLineStealer)", "value": "6d21a98f7b329aebc671db3660058116", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626974056, "uuid": "8bd3276b-8194-4461-bba9-97f40414df5c", "comment": "Malware payload (RedLineStealer)", "value": "e783a160e4e6176026efefb1ca4e6185e2df856f96f822d99b1862d022d0f303", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626974056, "uuid": "bbbc60f9-d8fb-4e8e-9446-10f96c260dd8", "comment": "Malware payload (RedLineStealer)", "value": "e8b01aabf39508303ffefb25a0b868f5d9a4870f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626974056, "uuid": "af9f2cca-6206-42af-9f08-cbe4e58ac246", "comment": "Malware payload (RedLineStealer)", "value": "d090e82967e38ea3ae0f4f5fde34697aa606accb5da96e857785ff0c673566fb8b6d9497b4c55bfaf8aaaae60379d863", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626974056, "uuid": "d5268eac-9a45-4289-a625-646e3390874c", "value": "T1C754F120B9C0CC77C4271A7148D6C7E17A6EBC325B798A87378427EE9F702D2662F215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626974056, "uuid": "1c6eda65-fda6-45a7-8d12-dbbd58d641b2", "value": "1cd2cdaf0d3244745bbba0ea35647dc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626974056, "uuid": "4234835c-edf1-455f-9c57-5335280dde7e", "value": "3072:XWxwS5e6xQGkGR91lELXmIFbvYmb+/kz2hDuqzWP0VVNk5Lewl5lELJDwX3j5OOg:rGZxQGkwGL2abbpz2Y6yLeQELyXz4Ol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626974056, "uuid": "bab5bdfa-1a4e-4899-84ee-a270b918b4cc", "value": 283136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626974056, "uuid": "e42f1cdd-9d75-4256-86e8-602e4e3b9188", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626974056, "uuid": "5f23ee44-b8ee-457e-a604-4df1e8367a5a", "value": "6d21a98f7b329aebc671db3660058116.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5659b72-ea85-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626914555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626914555, "uuid": "3dc1e908-92e9-4dde-a79e-e3472d15ef99", "comment": "Malware payload (RaccoonStealer)", "value": "7033117dc3ecbb319aec9d5d66e4297f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626914555, "uuid": "0014f2ef-3824-4a8c-95cf-b76aa695c55e", "comment": "Malware payload (RaccoonStealer)", "value": "e7c889e1a0979d946b83eadf8b53326d4711d142ec8f6e5c2aa42f3ac0263303", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626914555, "uuid": "1ef8d7aa-814c-4f89-bb6b-97d0fb907c09", "comment": "Malware payload (RaccoonStealer)", "value": "e652b5898b1c3395ca136509d171d86458d11cba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626914555, "uuid": "dda86867-31eb-4d4c-8b32-6a7444d5fd25", "comment": "Malware payload (RaccoonStealer)", "value": "ba0faaa22f4744e2c2635a42fb1d43a139a243e0892d3ad3810b5264be23a296474adab34c17ac7e4cae88e79776e77f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626914555, "uuid": "789f71e2-a558-42f8-9cdd-9f500b2c2aa7", "value": "T1ABB40150B681EC32C1A6093258EBC7942EBEBC656D7D89873B497BCF2D712C1627D306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626914555, "uuid": "7dc385d1-43d1-455a-ac25-312bedf97d3c", "value": "7780eb9cc098185992365509d7637fd7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626914555, "uuid": "ff61ca76-5460-407e-b561-bca390414900", "value": "12288:65RNVSseRhMOW0CSElsqnOS36P07WwO5RnVolo7yDgLhm2ld:qRNPeIOzesqO8t71O5RVosyMLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626914555, "uuid": "07c8b481-6219-4c3d-8178-0f130e1f5886", "value": 517632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626914555, "uuid": "07f792b9-64fa-4611-b17f-e1bce8800db3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626914555, "uuid": "a907b76e-210f-410c-bda0-32c86b2fb049", "value": "7033117dc3ecbb319aec9d5d66e4297f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c064f42f-eb17-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626977280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626977280, "uuid": "d2b164cc-957d-44d0-9065-af35ac229432", "comment": "Malware payload", "value": "7ceecb14777497d950fef12be23cb30d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626977280, "uuid": "06a575fb-a08d-44bd-9d84-6809d370755f", "comment": "Malware payload", "value": "e7fa638aceedeb8dbe7baeb928d639a6a1498a6fb2385f06c9ce40e01e7b9e16", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626977280, "uuid": "c9d51920-6058-4984-a79c-9263857080c0", "comment": "Malware payload", "value": "a0ad7d5adb5cf2ddc4aa993988ce48dde92c2e5e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626977280, "uuid": "87938fce-ab97-46ab-93aa-440982b6b5ac", "comment": "Malware payload", "value": "d4fe4fc19fca48810bf3a3b6c31df7dfbb171a50d43b28beadbffeff64f22da13eb45a2852ff9dbe1d4329eba5930f2d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626977280, "uuid": "61f94c90-00e2-436f-8855-b71a6638c0ed", "value": "T148E4E074631F9704ED3887FD2C29915167FEA01E932EDA382F9890BC7C72BB816E1651", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626977280, "uuid": "6c8dbdbe-82c6-4a39-95b0-bd922730bc0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626977280, "uuid": "87cf245d-e099-4a14-b62e-07f9795020db", "value": "12288:aFLllUNK9To9TC9sVWaIE/iZ0FVUufehosyaUVKnp:aFLljo0a0aRiiFVZeSzahp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626977280, "uuid": "8cc56f93-cf00-468a-b80c-23811d58bf8f", "value": 703488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626977280, "uuid": "fae623b8-e065-4a68-8e13-c67df2d306b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626977280, "uuid": "83a82ef0-6dde-48ea-bd57-9b9d59a07e48", "value": "7ceecb14777497d950fef12be23cb30d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afeb2788-eaca-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626944182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944182, "uuid": "c10c7cba-2dea-4738-98bb-00e47ea4a611", "comment": "Malware payload (Mirai)", "value": "8eb94b78afaf9133e68eb9291d58bf9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944182, "uuid": "91a58797-3f5b-4773-b396-2275aa9defb0", "comment": "Malware payload (Mirai)", "value": "e80c77edf8d05dfd7211fdcbe5f8e67a96b5c567430de9c48e9a94c30ec16d3c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944182, "uuid": "c32a5e99-2844-45c5-8719-2329207ad6c8", "comment": "Malware payload (Mirai)", "value": "86f0205b362ff2262302169c85cb4f4c41468da5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944182, "uuid": "1faf7583-d115-4d42-9d2c-d0f311cf4119", "comment": "Malware payload (Mirai)", "value": "506664096c6b45180fb36538c5b73c7d0fd8a9e62f66ae1773542fa27246c2d9af154a5a86e9b1b10be0d0cdbb7dc56a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626944182, "uuid": "fa731f40-e273-47ba-87ee-6a21c367bd8d", "value": "T11FB2D01EC0AE7EB4FE9BBE385D45E2817F619BDF3A61CDC016C15B110622D281F886D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626944182, "uuid": "f9813904-6d5b-444d-8568-16404cf5f61f", "value": "384:XA0AeimAzNCdvw1PwIWWtKfz9VuBFoeIoA8FXw2t7tTmojIomM4uVcqgw05VxJG:DApCdvwJr69VJoA8FZtxCo8g4uVcqgw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626944182, "uuid": "782f7e85-4830-4697-81fa-dd0fa6f6d903", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626944182, "uuid": "d80f2d6d-6cb8-4b18-8911-607ebb692821", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626944182, "uuid": "09431ad6-fe88-47c3-b803-5a24d738d81f", "value": "8eb94b78afaf9133e68eb9291d58bf9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96df10fa-eae5-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626955736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955736, "uuid": "7d306b3c-d5f7-4262-816a-8dd3eeaba21e", "comment": "Malware payload (SnakeKeylogger)", "value": "88fba5ee75304db402d27f5528bbadc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955736, "uuid": "a149ab4b-6e30-4848-af3b-77880d5c6e81", "comment": "Malware payload (SnakeKeylogger)", "value": "e85b47fdc03f66a6fe5f7c46240c0a1d441715dd99a5f4b12053b3c7e1329359", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955736, "uuid": "c10deb9f-a51d-4e7d-8356-1221390d77e6", "comment": "Malware payload (SnakeKeylogger)", "value": "f236266e0adc847c9b8cbd5e3fd5855557fcaef3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626955736, "uuid": "8bfa4927-dd56-415f-9605-0c103a13ebdd", "comment": "Malware payload (SnakeKeylogger)", "value": "2e8f5a707eff880c05741362df6b271ef698b0e9ed1dfe86ed31eed5866fc09d5a0d7e4a2b44dbd25e99b8065e3a0f0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955736, "uuid": "32a82b91-63fb-42c2-a540-4a9e6d81448a", "value": "T1B6B4E0047990A98FC52E8EBA49931C1047709D7F964BF3472C8B36ECA96E7C54E037A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955736, "uuid": "2f68fd7e-61f5-40de-b209-d7782bc3291a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955736, "uuid": "6a107f9b-f55c-4c84-bec8-06083cb94da4", "value": "12288:RUzXG97zntFW+cnA1wM+6ptcBg1OlU1rdI1kfgjdlA1:+zeXrW+1wM+Utcq9gjU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626955736, "uuid": "99b68c00-bed3-4380-9829-3be8ea8c4b85", "value": 534528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626955736, "uuid": "478c6a9f-a235-4776-af6a-f92f5d53d559", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626955736, "uuid": "408b77f9-5520-4cef-a4d2-a2985a2d4f73", "value": "Scan003000494 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c371edc1-eaf2-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1626961394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961394, "uuid": "add399e2-6d76-4067-b134-9335c1e21791", "comment": "Malware payload (Gafgyt)", "value": "1c4572d224249c0c2b0e02fc6424e136", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961394, "uuid": "078f555a-bed1-4baf-a6dd-7686a72fe7e7", "comment": "Malware payload (Gafgyt)", "value": "e93f538792474d1f37881188edd57bd48cd65efd04a4020b145cdd5db7f85b9b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961394, "uuid": "59ffe0f2-43d4-4d8f-a532-4b9695ca506e", "comment": "Malware payload (Gafgyt)", "value": "0b20c5056446a13395ab9e26471a7bcafd8a5b25", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961394, "uuid": "3d918aaf-f81c-44c2-aa30-530dfa767aaf", "comment": "Malware payload (Gafgyt)", "value": "1b5204c61028b56e5a546ae3c9de43c4a3115d6e005dc232d9334cbce3ee6d226db7e5a73df653f464e05a8186758c9a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626961394, "uuid": "26d407be-1037-4637-aa0e-44813a89a406", "value": "T19BC32805D5508767C2D3237AE79F825D37325BA4A3DB33215A34BFB82BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626961394, "uuid": "b702244e-e9fe-4bbc-adfe-4b1a2203de6c", "value": "3072:ekYPUfsgnsb0J2ag/VfNkDN0dn+mTQOY5NX3cn:9YPUfsgEo2a0NkDy+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626961394, "uuid": "45ae3fe0-ad08-48c0-9437-9d114cccc86b", "value": 121007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626961394, "uuid": "cfd0cd94-5fae-4339-95cc-17d941b9495f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626961394, "uuid": "26d325cd-fcdd-40fb-8d89-89ce80e7dbb6", "value": "1c4572d224249c0c2b0e02fc6424e136", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae9468fa-eb0f-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626973815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973815, "uuid": "0e01fe14-c071-435a-ade7-bad36f0d2f82", "comment": "Malware payload (SnakeKeylogger)", "value": "25d3fd3e9875042fc87c2ff0b917e816", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973815, "uuid": "f9838327-cfca-4784-a7c0-78e7cbeb44a6", "comment": "Malware payload (SnakeKeylogger)", "value": "ecb062995c11f3d1aed8d3d4b569c13b2b5cae1f4f0eed78728971ecb551536e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973815, "uuid": "fa4d65f7-f112-477c-8d4e-634039c7b576", "comment": "Malware payload (SnakeKeylogger)", "value": "b08539c7ccd832d27657fceaa36d6105b7d9b168", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973815, "uuid": "22d70fad-8310-4954-a852-d554b06598ad", "comment": "Malware payload (SnakeKeylogger)", "value": "12b7140556bc2e515e23e6dc4edd06099fa6f192396ce4e282a48fd78b764ba6cd01a19cb2346fd3c23c71025f451672", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973815, "uuid": "ab6532ab-468c-439f-b02d-b48d5dbe17d8", "value": "T1C3D4D074631FA704DD3887FC2C59D1612BFAA02E925DDA383F9890BD7C72BB846E0651", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973815, "uuid": "e2049854-0d56-431a-842d-a2b89e34a9cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973815, "uuid": "e7dc18c5-ef91-4e7a-a75b-ecf4eb0fae7b", "value": "12288:z7kFX3xcSbfaQlhcLuQKWMsCBBR3dQlrNHsyaUVKnp:z7kh3q8yQQjlpyr3Kl5Hzahp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626973815, "uuid": "24cd0049-576a-4941-a81b-57d041687299", "value": 644096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626973815, "uuid": "59c83d2a-caa2-4082-a973-75ffb7339566", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973815, "uuid": "c0b6a118-6d2a-434c-9b7f-aadb3d98c682", "value": "Urgent Qutation.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e312f1e6-eb01-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1626967890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626967890, "uuid": "411197d8-6119-4665-a1cd-ce526e497197", "comment": "Malware payload (RaccoonStealer)", "value": "773a332bcc9011dfdd701d4b556732d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626967890, "uuid": "051343a7-450f-46a7-b108-27fadda94027", "comment": "Malware payload (RaccoonStealer)", "value": "ee22929b148bbbc5527e628d58085c517b34f546f6d06625a6e81f030f8e5d89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626967890, "uuid": "41236905-dbbc-4256-a20a-d80ed96e5065", "comment": "Malware payload (RaccoonStealer)", "value": "274b63f1d44f805ead66718a8e237c0fb2458681", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626967890, "uuid": "f65a40cb-dde2-441f-bf93-dce133eac711", "comment": "Malware payload (RaccoonStealer)", "value": "3cc788b8073da49b3e009d55ec22dd12ea93f1c10b3fdc36744c287171e000a23cd09fc676d5867d307c9f29a0f01098", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626967890, "uuid": "8f91431e-9c4e-4dd3-878e-d70b80888c10", "value": "T145A41218B451C832D4165B309CE3CAA1B72DAC315D695A3B33C52FEF1F762C1562E2AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626967890, "uuid": "b5b078d2-fb74-42f3-bb21-2ca1ce389658", "value": "f8220ac65423f0267d42ab4cbda2e1d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626967890, "uuid": "276653d7-26c4-4da0-ac26-a966e41f2bc7", "value": "12288:OftLuN10dqmLyHEP5g201YoFnAShhGxDwZymA:OfE1mLyHEP5vu3hsxsyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626967890, "uuid": "e4f2c180-4317-4672-8190-1edb7211d469", "value": 477184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626967890, "uuid": "75974a20-1d87-472e-8afc-353e7bac5650", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626967890, "uuid": "4b5a5994-87bf-41dc-9fe9-da5ed6d856ff", "value": "773a332bcc9011dfdd701d4b556732d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5891c28-eaea-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1626958042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958042, "uuid": "f2b16fb4-f491-45fb-81f0-eb5538025ede", "comment": "Malware payload (Loki)", "value": "a0339a15a2f219b54b3c1a6b4afbc6be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958042, "uuid": "9cf3e2d4-c626-45ca-815b-17bddb70d858", "comment": "Malware payload (Loki)", "value": "eef89bbd9fcfb6e1b095b5302af5c176ed593bf9c6ce26d0be6ebeddc7fa0e6a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958042, "uuid": "1d858e95-9212-4212-9bb9-fc6e3f77c03f", "comment": "Malware payload (Loki)", "value": "7df7a7515715283591582974eb47197c9369efe3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626958042, "uuid": "c94c1d29-3702-4081-a25a-f4d43eda4158", "comment": "Malware payload (Loki)", "value": "2e5266e0d196550cd8750015ed4b0a3f52e9da9da78e47eba723bfa20d1166861818dcb72fe95fb1d1e3c3a68d091552", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958042, "uuid": "00a64bae-f51d-48a1-a4e9-29fa85b56a0b", "value": "T1FFD4E1197B80BF0EC57B8E7684405C10EBF2E12A670BF3876CC316EC598E7999B57192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958042, "uuid": "7b243640-a073-4582-8be8-babcf1a6b6c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958042, "uuid": "9306220a-bd99-4eb1-a955-bc9c1bcb188f", "value": "12288:6bt7gGl3TPGb13SK03HyLumD5iKajjpfMNrLoFfkTUOu9EZKdqd6ZorVuEGpqy:kgqT+b1iK03Hf/h2rLoFfvORG1UU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626958042, "uuid": "96018002-bb8e-44fb-8a06-37ef4eb0f115", "value": 647680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626958042, "uuid": "3baad3a1-acce-4be3-a1ca-d2725c635b4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626958042, "uuid": "110d8c1d-5b54-401b-8745-6f90a2f6a589", "value": "a0339a15a2f219b54b3c1a6b4afbc6be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df283e74-eb05-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626969601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626969601, "uuid": "d8ab6e3a-3fe1-4b93-82fe-2866c700fef0", "comment": "Malware payload (AgentTesla)", "value": "7848697a2cff990710c69e8d97e55c13", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626969601, "uuid": "3aa177ab-f66f-40b4-be5d-76859cd22539", "comment": "Malware payload (AgentTesla)", "value": "ef17f47bcdb067d712661ddadff8ebee2924282c7fe21edd237e8094cc4ebdb0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626969601, "uuid": "291470b2-bcde-4e94-83ae-f7b950598d91", "comment": "Malware payload (AgentTesla)", "value": "9af272f7dedd808c48b03d98d7eb75356b74f6ee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626969601, "uuid": "0b3b623f-bf3d-4661-87bf-004749054831", "comment": "Malware payload (AgentTesla)", "value": "789c9f80426d26ef4a265bfb4a21fde76b4e5e6c698d90bd9452ff44004caed9702a4167611359f184660dd58dc2e7b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626969601, "uuid": "86678774-386c-488b-843e-117e0cda7961", "value": "T1B04512C76480FF6ED6E80E3D95C10B185937CE862EEA82136125FA8D74F693B125B43D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626969601, "uuid": "41e9ba32-7afc-4746-9108-092357cbc532", "value": "24576:552SgH474uoQ5xCHB+kXRPewR/LK9TevVGPYQuboKULGA:55us4hQS+khvRDKdGVG6kKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626969601, "uuid": "d031db8c-4589-4d16-a426-26aca9f1d848", "value": 1239552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626969601, "uuid": "1dacfec4-2f61-48a0-98d3-35d1ea83b115", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626969601, "uuid": "4e9bdada-7af9-4ed6-9699-05eeb9efba8d", "value": "Doc2.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ccd471-eac2-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626940781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940781, "uuid": "af68f0d3-6f0e-41f0-8215-2f2c4e650f55", "comment": "Malware payload (AgentTesla)", "value": "a5da6bea30981185e9dadaaa06ccf45b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940781, "uuid": "865770fd-197b-48e4-8d87-2d94e1fac0c4", "comment": "Malware payload (AgentTesla)", "value": "efb3cc17330b519d970353a2f8da8ab9a10abbed7fb5ac099bd4ed575ba21fa5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940781, "uuid": "c8f9750d-2562-4d14-b00b-782a55f0f65f", "comment": "Malware payload (AgentTesla)", "value": "3166d96dc5c719df87abc726ee1b8785ef8ee7d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940781, "uuid": "182f745d-031a-4a3d-9675-af214f360663", "comment": "Malware payload (AgentTesla)", "value": "23f60392c895d300772667de8fb391dc4acd334accc47d817ecdc7976f26a6fc57a4750c585f06d13bf2ba78916fe6d8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940781, "uuid": "80f5805e-a98c-435c-8edb-b1b3ab656bf4", "value": "T12CB422702E86FDE3DB3E9B32626731427F3461836A52EA4DD9D110DD4A5B746AA03333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940781, "uuid": "37a27288-f7f4-4b5f-8516-fa09e28c3878", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940781, "uuid": "58620ffb-5299-4e2d-9706-7e93724b51b4", "value": "6144:dFhiZ9ZM3qZ7871dHdnVjcNX/J6oj/2V7BNHipLIyLBmDMx399GSyjp:PAo71dHd966w/2VtNCpIjKrG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626940781, "uuid": "755b3cbf-21f9-4d9e-9679-1b0040e7bc98", "value": 505344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626940781, "uuid": "3fa66913-37ce-48e7-a430-18d6333bc6f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940781, "uuid": "6d137bd1-b6e6-4db9-852e-cc97e6df7570", "value": "a5da6bea30981185e9dadaaa06ccf45b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "062903c3-eac3-11eb-875b-42010a9c0053", "comment": "Malware payload (TeamBot)", "timestamp": 1626940890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940890, "uuid": "ff1df853-2ab5-4ffd-bbd5-a9f17a78fafa", "comment": "Malware payload (TeamBot)", "value": "38911964dcd075508c459254ad27517d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940890, "uuid": "a3ed2746-eea1-44bf-90b1-3cdfdae42552", "comment": "Malware payload (TeamBot)", "value": "efd055ee7d3d09c7211dd6aceef64f42ff62d01edf0105d06d77d0b92411bedc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940890, "uuid": "adae1a87-ecb4-4039-bc0e-36dea3117a3d", "comment": "Malware payload (TeamBot)", "value": "22c468c8d5efd3a5950ff1b28dbfa47b0a42f842", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940890, "uuid": "bf4081bb-3bed-445c-9296-e58eea97e79b", "comment": "Malware payload (TeamBot)", "value": "4ed2c64ab85eb5b059b8b98ce056bb0cb9d219120cdcb46c8928ddd4bd41ecaa3cbf47a04150730928746f62db196983", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940890, "uuid": "c245b7c1-8f6b-47a9-a3ca-77c68bba070c", "value": "T1FFF412007580CD71D490083168E7D7F056BFBC17AB6D49476B48BBEFEDB218AA66E306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940890, "uuid": "bca015c4-8002-46df-b360-060959922d96", "value": "010b99662693ba25ba201961c31754d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940890, "uuid": "d9588ffd-0e12-4ebb-8dc4-be09f24428d5", "value": "12288:ofDdju6BZrUIqbO6PJ+0RqoTV9B56B7qdlsI8OYOB36XqEnm1B42g1y0Lhm2ld:oBjgO2J+0ZT/z61Wd8e3ynIuy0Lz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626940890, "uuid": "5c8be9c3-3510-4c14-be45-93aa3d70b0d5", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626940890, "uuid": "ee997b81-2dac-4595-a4f8-3217acb51f79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940890, "uuid": "231873b8-c736-44bc-b7b7-c7033534c878", "value": "38911964dcd075508c459254ad27517d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb2d7e7-eade-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626952605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626952605, "uuid": "e8105b2c-e23a-4672-a19c-19b433df6345", "comment": "Malware payload", "value": "79f6a7543d65577041b6e60db871487e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626952605, "uuid": "55327ee2-a3d7-4ebe-aa9b-f0d7661df625", "comment": "Malware payload", "value": "f044c02fa90549daa3544371c7e003b424db14944c4ca34d9f78170755a69809", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626952605, "uuid": "d49432b1-4b8f-45c5-b694-c372453eb3ca", "comment": "Malware payload", "value": "79f9bfc7211f680bb2b1390e72f2700904c9c37f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626952605, "uuid": "a2b7baaf-2ba5-4841-875a-4bd2b04d7dbb", "comment": "Malware payload", "value": "036602ee180927bd313720995d513f934571ffa13cdd8db0cab18322eb040248210843ac4e405933272b91e119c01ee3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626952605, "uuid": "161436dc-50b8-4bdc-898e-594373c30105", "value": "T1CB7119B4B03C3C82DF2484EAE436FE8989C0F2A545C75E4C319DDC760BB3352692588B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626952605, "uuid": "b251cc17-97c1-46a8-a2c1-f52c8a5d123b", "value": "96:emiFXHAxGWzA3lM7BDcHGVz8/qLC0t3Yc:ePF3AMIAV2BLz8/qLC09X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626952605, "uuid": "e4e39ba1-c8c5-4ab7-b5ed-112ed0973d86", "value": 3592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626952605, "uuid": "c771dc43-5091-4a7d-82f5-88759ce7d412", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626952605, "uuid": "30257202-a046-4012-898b-32671bbd6768", "value": "RFQ - 4 SCH 160 EQUAL TEE.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63094c56-eae0-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1626953502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626953502, "uuid": "9c99bb4c-52a8-46ab-ab84-63ca2bf45615", "comment": "Malware payload (SnakeKeylogger)", "value": "432dafd9a9d895a6be98225d93533bc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626953502, "uuid": "a2225375-8e82-424d-b4f6-a247393a0adb", "comment": "Malware payload (SnakeKeylogger)", "value": "f21588a5a2118f8b06488d6ee22be10c90016e672c40e20ea92572fd955edde3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626953502, "uuid": "af826308-4bdb-4d26-ba47-ef0f4a28e4c1", "comment": "Malware payload (SnakeKeylogger)", "value": "f8372831247316dad9651f0f7dc8c94adfcc26bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626953502, "uuid": "62072977-26ea-468d-8b0c-8b150a3fa265", "comment": "Malware payload (SnakeKeylogger)", "value": "3d4df7596df44ce0b9351c77b7fa3a1f2ea7b88135ab9b8102ee14b7a51a2249dbfebbd78058fe6098306885aff5c94b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626953502, "uuid": "4f26dd57-8b25-437c-81fe-147adc6595a6", "value": "T17FB40131A810AC71C75B65B269A7E9000FB1DD53DB41E28967883EBF34767F182CA93D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626953502, "uuid": "ab10dc98-2fe3-475a-be90-54acde4a1b73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626953502, "uuid": "47bce011-4bbb-4949-9955-c894499b1d56", "value": "12288:uSQ/Nqlqn3cbReqAora+i9er+ji0TjD2yrkMxz:UNBn3cFSUlSjBkM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626953502, "uuid": "71ee679d-fbfc-4fa1-824f-236a4b5304dc", "value": 515072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626953502, "uuid": "d6df68fc-46aa-4d03-82f9-1e54e98a6130", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626953502, "uuid": "8bd61f5e-319a-441a-a732-3fe0c888a9f3", "value": "Specifications_Details_20337_FLQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c14cc5-eaad-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626931734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931734, "uuid": "bb112409-18a1-45a6-a053-488c1e22b6e3", "comment": "Malware payload (AgentTesla)", "value": "4b9bca84a76b99a378984a901448e5aa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931734, "uuid": "b05877e2-e181-424d-89d0-54caf3ca48f6", "comment": "Malware payload (AgentTesla)", "value": "f3d652a1de146b29816ecbd82b3e3f012244c350f245f52bb0954ece786ad4dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931734, "uuid": "c8a38c4b-f0e5-4678-acae-d988f0480bb3", "comment": "Malware payload (AgentTesla)", "value": "c725306bef0147ede5692525a8136530e134e1f3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931734, "uuid": "05cea9fd-a68b-415e-948f-e310aa385955", "comment": "Malware payload (AgentTesla)", "value": "3d36d84f1dba57fd84a4995bcddaedcdfa966c549e5e84f5d9f14650bc93fe50e7a2950a9d0076d08e82febeba9214d7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931734, "uuid": "4fea1667-ca64-4aff-80b6-ef2d409c0c51", "value": "T1D952CFAD7CB958BAD92E0DE2D21671C0838F096D96BBF811A433928C784052F366F74D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931734, "uuid": "72441d6d-19ae-4d04-88c1-08090c340397", "value": "384:4s7wnzPEpaGU8bdsmGPwVQZ7R7tH0B11Rg2qveU:hA1G13GdoJ6r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626931734, "uuid": "ce977e96-d80d-4e2d-9a5b-eb34b7a271d9", "value": 14359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626931734, "uuid": "78e1d88a-b097-4e9e-ac76-bed84554743d", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931734, "uuid": "7f74bb3e-d454-4533-99e4-17c1af518873", "value": "391SXF-pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a884fab3-eaad-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626931714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931714, "uuid": "efbbad50-fda1-4e71-a9fe-ea57f352ee0d", "comment": "Malware payload (AgentTesla)", "value": "7ca4655dff0318fa097429f12c5f5c5a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931714, "uuid": "a7ba8c6f-e374-4ea3-b965-8acc348addc4", "comment": "Malware payload (AgentTesla)", "value": "f3f681c71b259b83868bf64d9cbd877ddef4b78fb67b91e899e0d970e5e5de66", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931714, "uuid": "d8b03611-bf09-4425-b463-13439987ea8a", "comment": "Malware payload (AgentTesla)", "value": "d48404a0bed433fdec9868e57ef561c53e74a9e7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931714, "uuid": "b01bf6bb-ee84-43e5-b99e-97a52cb47338", "comment": "Malware payload (AgentTesla)", "value": "36286a5d3154807b82a7005cf9066c5d486e7e7f4639a164bfb77bef155ac8abf9660866aea83a69d78ab31705f12a5d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931714, "uuid": "5a6b57c7-ab52-4631-9cc1-fe70dfa00f5f", "value": "T1D9D2F8E47B9648E2E27DF33549939088E37152B32865C91FAADE71B3540B3497EC12CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931714, "uuid": "746e29c2-9255-430b-b66d-8cf2678f4599", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931714, "uuid": "067b7784-dc17-4be5-ab16-897662db1516", "value": "768:DFdkH02zgEbQiecrMqDzejvSYP2GflBR:JdwhQ/crXsvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626931714, "uuid": "e2d00f3c-3ba1-4eb0-9484-737ee570ed72", "value": 30208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626931714, "uuid": "08132b0d-aa4f-4ee7-a2be-a8bf5640b121", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931714, "uuid": "cd93ca75-9bc8-41d0-aca6-bc9afeffd79c", "value": "MPU702734-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b58b460b-eb3b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626992724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626992724, "uuid": "ab544462-f8ad-4529-b0e1-a646b2726157", "comment": "Malware payload (Mirai)", "value": "bd951c0e094589f8d3a0b745bfbbabdb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626992724, "uuid": "c21e3ff3-bfcb-418c-bf4b-e2158e4d2761", "comment": "Malware payload (Mirai)", "value": "f567e42afb43c5cdc199a428c276328637001c42daa67f749a46907f2ea01b7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626992724, "uuid": "42c39336-28f4-4902-b61f-b89119254042", "comment": "Malware payload (Mirai)", "value": "fb41f9d0db795f7be2dbd54270a34311af46004b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626992724, "uuid": "8d661a4e-10d1-40d8-ad14-01bf615bb87c", "comment": "Malware payload (Mirai)", "value": "b750d827cf272fca46e0e69ae6bd196ccb03cd1c14efff01bde54d91f0b234c415756e7f44f2db4845baac50c3b02af5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626992724, "uuid": "df9bea91-9bb1-47bb-bf82-3d10e35027e5", "value": "T14EE2E1A08E9F969ADECC63F345CD71142C92F6752BEEDB1519161DA202333D4C380C99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626992724, "uuid": "03a0cfea-d31f-46c8-9e7a-24ac0b0ce3d0", "value": "768:Dq3yhi2rg98FdmvPyQw7NABkcczKAdepnj6cIo6dbxEDRKM:oiFdmvPgACcczORoWVv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626992724, "uuid": "c13c49b6-2944-4fbe-a121-fc5cbd7f695f", "value": 31328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626992724, "uuid": "ca6bf19f-0835-4886-a6cf-0deb7c9c4baf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626992724, "uuid": "65b3ed77-93be-48f4-864e-7ba55ffb7305", "value": "bd951c0e094589f8d3a0b745bfbbabdb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04619bcc-eace-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626945612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626945612, "uuid": "c194b3f1-261d-4887-8641-972d60c1dd87", "comment": "Malware payload (RedLineStealer)", "value": "a4f4b5daa83bb6dc85ede588ffbfdb34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626945612, "uuid": "cde08eb1-a338-4b01-901f-c30407dc278c", "comment": "Malware payload (RedLineStealer)", "value": "f61201b7b85a410a62c1f1946095b3feabb6e672fb8ddc0c64789a02ae9a06f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626945612, "uuid": "b7372f63-35ba-4049-89e8-6458ccd50c21", "comment": "Malware payload (RedLineStealer)", "value": "9bbaac140fa643d30bf25af71561f5ee35874898", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626945612, "uuid": "e4f6a02d-007c-4c25-9728-d1ee28cd261f", "comment": "Malware payload (RedLineStealer)", "value": "886523e789ae9039a702d19bbfa6f34adbab47ffdef63acc598935ea7858456f3949cef023076e8de490ba82030422d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626945612, "uuid": "e52087aa-8cca-49be-a146-1106820968db", "value": "T12C24A277F3315357C54C1E34E461FA0F3768A62B0B4071B8F87BA29A8D18E4D89BB265", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626945612, "uuid": "5ff34052-3101-40f9-8843-f0eb1f5282b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626945612, "uuid": "05b5c9b9-0bd0-40c1-9325-54775e890d48", "value": "3072:pz8qhaE6aGrhZWm3Rku9BAz6lmU308gLwYCaZaOnC7+r:p8eaExG7BLLEUkXwP7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626945612, "uuid": "b603cf94-d37f-42d8-834b-28c3ae58c511", "value": 217088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626945612, "uuid": "f9e1977b-15dd-41d7-bd4f-55a07ceaf530", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626945612, "uuid": "6f6cdad8-9358-4b80-86bd-d66f8e5db3e4", "value": "a4f4b5daa83bb6dc85ede588ffbfdb34.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a74e4a2e-eac2-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626940731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940731, "uuid": "232b0c0c-33a3-46aa-8920-ab3e9f2ac674", "comment": "Malware payload (RedLineStealer)", "value": "63f1959b30ea4591bb0b2f5961b36850", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940731, "uuid": "e59b86af-401b-49cc-ad67-b632eb5052ac", "comment": "Malware payload (RedLineStealer)", "value": "f6ae1e90093fda0271db6d607a78af61c437253c3edd42019daf274c5369b8cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940731, "uuid": "b62f6f32-405a-4478-9b14-364845cf0c7c", "comment": "Malware payload (RedLineStealer)", "value": "26c0c9c14a48b61971d528c98906cb79c68936c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940731, "uuid": "21a45ea2-b8d7-41c9-af50-06ac120ba7ac", "comment": "Malware payload (RedLineStealer)", "value": "ae41faf3c50519df822fd848adac67da00b7dd1087dd0b2c97499c5d169448ef5d04d73b635568849796e01cc512486f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940731, "uuid": "6688f504-4bad-42fb-a754-fe8d8e789aa7", "value": "T1C864E0507290DC33E3A6093154EBC3942A7EBC756F6D8A037A447BDF6E742D162AE306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940731, "uuid": "10c59405-63b9-4942-a472-635cf821d3d7", "value": "010b99662693ba25ba201961c31754d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940731, "uuid": "f71eaa5c-8318-4769-bd0e-ec1103aae80c", "value": "6144:ty0SS0ghn9LwY+yGEQo2zPLoaLyXTflrFzBnmytldWg:g80gh9Lc7E2yjfLhm2ld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626940731, "uuid": "8398f596-8f45-4ee4-be2d-74ac64e85dfe", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626940731, "uuid": "a62a4807-23ef-470e-bcb1-56eb9a86a27b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940731, "uuid": "e332f38d-331a-4515-95c1-d81d513d1da7", "value": "63f1959b30ea4591bb0b2f5961b36850.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7843a79-eb0f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626973830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973830, "uuid": "58ff9e63-8826-433c-9cf5-8d0e2dc0030b", "comment": "Malware payload (AgentTesla)", "value": "5b14a7366cf5dbea3386c6afbd25f012", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973830, "uuid": "36262931-b5ea-4c28-bf7e-8cf2bc81eebc", "comment": "Malware payload (AgentTesla)", "value": "f6ef92f6911bb14f5b8905f3964d21a9569c41c4e5367d0ee8aec59d54eb7024", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973830, "uuid": "32ff9f7e-0feb-43a8-b6fa-1964979cd169", "comment": "Malware payload (AgentTesla)", "value": "2a39f1d215a739ddf4e2daf87fb42e26f12f72ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973830, "uuid": "498d0bf3-81e6-4717-9cca-8f27e1887559", "comment": "Malware payload (AgentTesla)", "value": "21b7673c6725d8eea611d65272f05c1c4408eb3cd7f4ad07515e21d4435305976cdad2a69fbdfc9327205c246406cf3c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973830, "uuid": "6f510142-bc04-4f60-85c7-10df08f21f05", "value": "T133F4F1153BC0BB8FC56E4E7BC4111D10EFE1DA265607F7872CD216EC698E3998B13296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973830, "uuid": "aefc2f2c-7a18-47b1-8780-8a1976158053", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973830, "uuid": "e9685fc2-1761-4136-8165-186a6e09e387", "value": "12288:NCKE0cM4fvJZx2wzrO+kaA6i0NrJhVFo4actOTj1xcoPGniqEW5zh1Sly:NCKEZM4ZHNzrOlaA7u9S4jtOooenio", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626973830, "uuid": "91ae5edf-ecbd-4cc2-8ff5-7caec308bda7", "value": 747008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626973830, "uuid": "7a1e1815-4e4e-4a0f-8ab6-17e511db3580", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973830, "uuid": "cf24bb1c-1475-4e1e-b24b-379a6abc3dc3", "value": "ENQUIRY_101.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e1ee708-eb12-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1626974834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626974834, "uuid": "b5fbde12-2356-4624-900a-66970ae94e88", "comment": "Malware payload (TrickBot)", "value": "e967fa01c9bad22ae3d23d76ed61bc78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "zev4", "colour": "#9BE5E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626974834, "uuid": "ec78770d-4cc8-47ab-b74e-87fd1b378bf1", "comment": "Malware payload (TrickBot)", "value": "f7594160c8df5c19d329c27fd3f49cb557afb36f5e34949eaf9ba575de8b9a93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "zev4", "colour": "#9BE5E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626974834, "uuid": "85e4c937-2ddb-4641-afc5-32e7596da80e", "comment": "Malware payload (TrickBot)", "value": "dc39453bb75f8ebab049e2d875d51853603c43b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "zev4", "colour": "#9BE5E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626974834, "uuid": "f099ddb9-81e9-4ee8-94a2-cba456c6dcdb", "comment": "Malware payload (TrickBot)", "value": "c064e2c8d66610d723712ecdcdd9e5c53e0158e4c1ab93f160e1754152bfa93ce58eda075410755b7bc67c9d52478fd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "zev4", "colour": "#9BE5E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626974834, "uuid": "74fa3e9b-39ca-4e3a-9c38-90873fa5d0a4", "value": "T12794BF00F896ECF6F7260FB55842B647B3153502096C9BDF5298C6AF1E1DB9093AC3B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626974834, "uuid": "2c2f8de6-1c8f-4012-bc3c-02ce724c1534", "value": "5d02bb9eaf349ef82aebf45925117831", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626974834, "uuid": "eebbcb2b-3e18-4b38-9d64-a73a6fe798cf", "value": "12288:dCQXHfmzl5O43PLKOWVaLuox94QsbcG0CZg3:lOrO2PLKlVFox94QswTCe3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626974834, "uuid": "1b0db157-dace-4cbe-afa2-45481c543f06", "value": 439426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626974834, "uuid": "a97cbd6a-2ac0-46fa-8d37-593f457f6bd1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626974834, "uuid": "3d515581-ecda-46e9-820b-0a6642b952e9", "value": "nete5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cd66528-eaed-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626959048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626959048, "uuid": "0ce7a75c-a838-43f1-9572-bf742d75cb66", "comment": "Malware payload (AgentTesla)", "value": "436f3797fc4c39d1a2319196bc15c1c3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626959048, "uuid": "b400db7e-8f5f-4381-a9b5-4e84fffebec1", "comment": "Malware payload (AgentTesla)", "value": "f7b11103bbd791d5c2452275ff23fe51eff41ba5071ba015ef50672138c9b459", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626959048, "uuid": "5d5b89e8-037c-4b34-b908-f8db381f0fcb", "comment": "Malware payload (AgentTesla)", "value": "1a93b32908c5def6129f192fd096f129ea575220", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626959048, "uuid": "a40928e9-17fa-4da5-be5f-66f1ce04bfcb", "comment": "Malware payload (AgentTesla)", "value": "c52b27005014fa99991d210c504bdb6e4bfc14dc684d24bd4e22965779109cabd0db3fc1b052548e1f1c3cc23275c4d0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626959048, "uuid": "f07220fc-40c2-4b7f-80df-1512d1535e21", "value": "T114F4E178632FA714ED3887FD1C24D15127FAA01EA35EC6383F9890BC6CB27B856E1651", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626959048, "uuid": "a288b4eb-f813-471b-b69b-63170403e050", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626959048, "uuid": "bd8273ce-47c4-4907-80b9-7f224c99fae1", "value": "12288:fj1iM6WqpSH5vdGGmEKhJmrNX1xZ7/VY606/S0shF7XsyaUVKnp:fj1lV4SHvJmEKhKlL7K606Hshpzahp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626959048, "uuid": "fe4e580a-d292-4c64-8a34-6ed4920389d8", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626959048, "uuid": "5079edc5-4c4c-4f52-adb0-4e664ca16539", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626959048, "uuid": "96980848-208f-48cb-8e68-715d42ed2ff9", "value": "URGENT REQUEST FOR QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5984bbb-eac2-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626940862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940862, "uuid": "9280d1ef-bbef-4fbf-a712-dfa693ee500b", "comment": "Malware payload (RedLineStealer)", "value": "400ee0714dd95e2444a1242483027271", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940862, "uuid": "b62b0805-8842-4254-967c-4aa02d293bf0", "comment": "Malware payload (RedLineStealer)", "value": "f80044762635fc93a0b1f612664bd9b0b21fa0e88fd473b8f298d9726c43f9a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940862, "uuid": "cfb825dd-1064-4e22-ba85-be86a31aed55", "comment": "Malware payload (RedLineStealer)", "value": "2eba3d61e364e8a40f187556c337809b92e06914", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940862, "uuid": "d837bb34-4c07-4268-a7a7-9b9dd1870e00", "comment": "Malware payload (RedLineStealer)", "value": "ee522ca805a8afb7a245370b4ac81f9a43f156ccaaeb2b34d53623441cfad4c73ffd8279fb8742bfa28b809e5ddddf29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940862, "uuid": "2a305c6a-a0c4-48ab-b33e-ef353c30fcf5", "value": "T1C3D4128036A1D932E1790A7148F3C7961BBFBC126979950B7B8437DF2E702C192AD367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940862, "uuid": "412b2335-ba86-40ba-9b1e-d5f56bd34851", "value": "f1287ea8340d83d7c6e292a6b7d8dbf5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940862, "uuid": "af367124-f453-4526-91ec-aec6774f415d", "value": "12288:ysds94MIKf4aiYSh1IP4ZD0cw1eyPi1iM2T:I46f4uSXIP+Dx/ya1iM2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626940862, "uuid": "fd76fc5b-4b9a-4c94-a64f-a54381e2ad32", "value": 608768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626940862, "uuid": "21a57e16-4c8f-431d-8e6d-28163654cfdc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940862, "uuid": "47c228b2-6991-4a99-9a5a-3f5d4326a214", "value": "400ee0714dd95e2444a1242483027271.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37f68a9e-eafb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626965026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965026, "uuid": "317a8b6f-6fac-4525-bfc9-de438fad8b1f", "comment": "Malware payload (Mirai)", "value": "95625a98722e84cb840ecc57c39bbaf6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965026, "uuid": "8e7168c0-280f-409e-8ea2-4b4b73a965aa", "comment": "Malware payload (Mirai)", "value": "f8ea050a2e1402e5dbbe525715325ac341b5bf924727e56efbbdcd29a785f731", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965026, "uuid": "e74e0cd2-5ed9-4b42-b397-f299b413bf15", "comment": "Malware payload (Mirai)", "value": "b795699d9ecb657b6edf4d4821379aca378ffee1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626965026, "uuid": "1544e3be-e8bf-4011-b922-7e08b0663fad", "comment": "Malware payload (Mirai)", "value": "a9ccdc3f6d16c6db2a4ddf9212050f322da10b2fe59825dd83966040e75b92f35101f1b557f3f6f1ec13740b60be30be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965026, "uuid": "25bad91d-2d71-4452-81bc-3ede3571ac4c", "value": "T12C4308C17881A626C7D05777FA6F018E37199798E0EA33538C295FA07B8AC1F0D6774A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965026, "uuid": "bda6bbac-7968-4744-800d-a38350f7e234", "value": "768:N1c82KhvRRTdj7tsq5sebD07B8drbonjxDdSYGSq/EanRP89UapvTLwCVy/rCxH1:Nb24Th7ttujxynRP4U8ShW+15RL+Sr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626965026, "uuid": "0e02e59a-9a0f-4902-bd92-d47c4087a6a7", "value": 56584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626965026, "uuid": "ce0ad96e-b56f-4892-8c63-ae5ffd113cea", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626965026, "uuid": "57d10961-bb8f-4b41-ac7a-d3889da745a7", "value": "95625a98722e84cb840ecc57c39bbaf6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1604e7fe-eb1b-11eb-875b-42010a9c0053", "comment": "Malware payload (DanaBot)", "timestamp": 1626978713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978713, "uuid": "d58b83e6-ebdd-4bfb-8e42-c3bf02f3b44c", "comment": "Malware payload (DanaBot)", "value": "fcd553efcfbf422f478f67eda4282a26", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978713, "uuid": "f296e5ac-e08d-4ea6-83c1-c7871b2e5ec9", "comment": "Malware payload (DanaBot)", "value": "f92f72da7a4e502d51d03fb7d690c743618d5b4e81266344d79e4b210b19599a", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978713, "uuid": "73fa46d7-6cc3-4375-ae5a-572313b3bd59", "comment": "Malware payload (DanaBot)", "value": "81b5eb5c096473aaa92aa67fca732daaf8197646", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626978713, "uuid": "81913835-56f2-4e89-bf67-af26129ed467", "comment": "Malware payload (DanaBot)", "value": "ab9596a189bd1f64476f5ae6b45afe4e974e5f3dd2f9d76fc4b27b59c7dc78acdc48a5a7bc7ac3cabf9c419b7104e6f8", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626978713, "uuid": "8edf893a-8e5b-40a7-9b5d-6626adfe67b6", "value": "T19335235134A188BAC1690D3148E2C2A17B7FB4B37A7CA85F778476EF0D346B295DC389", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626978713, "uuid": "11f2cb28-684c-4954-92e3-7a63540de72e", "value": "ed31136d7e99c845aef2cc9c35374011", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626978713, "uuid": "322d37de-f48f-4775-82e2-9d3bc2328fe9", "value": "24576:Eu/fS2KKDL+H2fRR2nmErGcXKRbrwj9sUHZys:7S2FmW6nzrGcXKFr0syR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626978713, "uuid": "3082b324-6e92-4eb6-8db1-9577fafbecd8", "value": 1115648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626978713, "uuid": "84e9c592-eaf1-47af-ac69-0b62f7bb3d70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626978713, "uuid": "d50f93a8-9ef8-4953-af6d-f7ce5866bf4a", "value": "fcd553efcfbf422f478f67eda4282a26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ffc1c4d-ead0-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1626946598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626946598, "uuid": "6bc56064-86c9-4a67-a639-b4d3ae58c766", "comment": "Malware payload (RedLineStealer)", "value": "b8371590264db62ecbba4b7f481a21a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626946598, "uuid": "68762e7c-6fd9-49e8-a839-8146432a0c04", "comment": "Malware payload (RedLineStealer)", "value": "fa3e22734ccb01da24364b65793ca5d2fafc53fbe6cef3eab8d76b158d1e0d7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626946598, "uuid": "53034f61-543a-4390-ab69-bb204f6b90fb", "comment": "Malware payload (RedLineStealer)", "value": "837bfd10d70113330b2e00a1f12e99c4b0065d38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626946598, "uuid": "1cb07cc7-6cdb-4603-9b23-f304f3fcaa6b", "comment": "Malware payload (RedLineStealer)", "value": "7b489c7bf5bf7cbf940dcf238ab5bb9ea37336f182709650ff8438e5528a50fe4afc0d79767420f55595db3e43a055be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626946598, "uuid": "19f1895b-6b19-4f13-b591-27430fb2b7a4", "value": "T111D4F15B43934FCAD0827FF866A9D37B4B3DADB0F8A259AD5174ECAE296C4C506C0113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626946598, "uuid": "f2e9bfa8-f674-4a01-9fa7-d458901a9403", "value": "caa5e6a2892587c2324418efee31c648", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626946598, "uuid": "a22762a5-a752-4d7a-87e5-f90e55eac38a", "value": "12288:37iuUvUF2JxjnxXAHbcbzlarx98lR1omCAIEwQbbC+3q99:37iuUvFjxXjgM4mCbEwQbbC+3q99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626946598, "uuid": "b27f7ba2-9294-428c-94a4-a1ff8c96273d", "value": 627616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626946598, "uuid": "97079247-fede-4ccd-9dbb-d19c013f6429", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626946598, "uuid": "ee7c2fd3-9f9b-41cb-8bb8-630f1f11034c", "value": "b8371590264db62ecbba4b7f481a21a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a562b7a-eb34-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626989511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626989511, "uuid": "ff34dc0e-d3ef-4e78-b8b3-a7fba110dd59", "comment": "Malware payload", "value": "530b4f4d139f3ef987d661b2a9f74f5f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Pegasus", "colour": "#15B0C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626989511, "uuid": "86adb9bc-7d94-4c99-9f77-7d8cf19b6e85", "comment": "Malware payload", "value": "fa538fc20af8aa198db5e932b2afaf9710633a49cf3e19b7465175520e3e8b47", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Pegasus", "colour": "#15B0C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626989511, "uuid": "0ca5232d-88cc-46fe-a100-e6c6ca00372f", "comment": "Malware payload", "value": "cf1267119890c3b663fbffe5fbf4d8116316d88c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Pegasus", "colour": "#15B0C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626989511, "uuid": "a8c34615-8411-4e62-8fa6-ad5107ee5652", "comment": "Malware payload", "value": "7bb7967ae4a35c59cf04fdae9049b7ceb5747febc7edbc52cecd45eac7737886c20df9b07a55523ad1ec588b8da0587c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Pegasus", "colour": "#15B0C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626989511, "uuid": "d89e18c8-ab97-4370-8088-4994db8a6a13", "value": "T1D6C2544432E8A701F9BD2B758EA9D6D5422A7E90DF51432B3016371D8B726828F73B73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626989511, "uuid": "72b31878-3fd3-4803-b147-7a57c227667f", "value": "768:20gSC730q3+QRzjuBR8zlZtkDd1BKgTeawda6I6X6l64vfiobQTbv3yHtAN8a1LY:2Be/c/ShUWaRW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626989511, "uuid": "dfe74cf3-5d55-4308-bef4-66b5ef4aeddc", "value": 28184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626989511, "uuid": "e3b12c4f-2ec7-445f-9f23-2c819d8e9cff", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626989511, "uuid": "4cfa4d17-e0ad-40d6-bd07-bf290e89a7ef", "value": "fa538fc20af8aa198db5e932b2afaf9710633a49cf3e19b7465175520e3e8b47.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce04c79-eb3f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626994267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994267, "uuid": "a2288e9c-8758-40a4-b73d-eba00b078d78", "comment": "Malware payload", "value": "4d2ae993747867cac3c82db3408afd37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994267, "uuid": "2f9840b6-2fcb-4a03-9e1f-8f1f6d4db2b8", "comment": "Malware payload", "value": "fa64f562a8cc8a53c8ef0a98b483aa4b9f3ea4ae08e01f846456594a5e3159ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994267, "uuid": "00e4e2b7-4f37-4907-b922-c1435067bc49", "comment": "Malware payload", "value": "406148c783b52183092fae169f78ab13b4b69bd0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626994267, "uuid": "3f85d540-2e10-4330-8a40-521c9e5efb52", "comment": "Malware payload", "value": "ce5f7384eb21f977a5f2794630740cb72a1718c00fb674fac3aa9afd9533d16539c7b5139cd94857e6d2a7020899ea40", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626994267, "uuid": "4f5b2bbe-aa54-41b6-ac4f-b7d0a4a532ad", "value": "T1A003064AB9C19B05C5D112BAFE1E124E7313576CE3EFB3225E246B24678B57B0F3A805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626994267, "uuid": "3ce45e2a-7ddc-4e72-bae5-97da8df55431", "value": "768:UAnaKAAppS3NKuPkWx79U6miXt4+w1oo24YVTm6mhyqe/GB:UAnaupA0EV7Dmid4r1oo4ewq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626994267, "uuid": "265196c6-9ae2-4c63-a430-a29efa03b3c9", "value": 38252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626994267, "uuid": "6aee70d0-bec2-426c-b636-13ef132cedb8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626994267, "uuid": "062f2d8d-3abf-4506-b958-d957a4677b3a", "value": "4d2ae993747867cac3c82db3408afd37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d94095c-eac2-11eb-875b-42010a9c0053", "comment": "Malware payload (TrickBot)", "timestamp": 1626940554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940554, "uuid": "b1b373b7-e0d7-4b1d-b185-ff6280ef92aa", "comment": "Malware payload (TrickBot)", "value": "72d61074196aab2e16028265c40c0281", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob109", "colour": "#78B843", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940554, "uuid": "a2f9971f-0206-4ab1-92cd-8a5f995260f4", "comment": "Malware payload (TrickBot)", "value": "faba77692acd1b52614d6379b4f197af178119baef932ee3157098e3bbcceef7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob109", "colour": "#78B843", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940554, "uuid": "522ed7c7-db27-4a01-af1e-4c4b699dd2f7", "comment": "Malware payload (TrickBot)", "value": "c3510285d5212885fd892623c769339239487065", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob109", "colour": "#78B843", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626940554, "uuid": "7cad7cd7-30bb-49c3-8d14-f41878785f1c", "comment": "Malware payload (TrickBot)", "value": "999ed88eedec49ea750952220fc39163b36d9c1ec37f0e79273ef9f6073c51e3c4d49a31315fe95dbc94926c8d8540db", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "rob109", "colour": "#78B843", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940554, "uuid": "6dfef2cd-2a83-410d-9344-f9de57548610", "value": "T1A0C4CF2235E08577C4EF16345E667778A3FBBD942BF2C147679A891C6D339028B22327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940554, "uuid": "611a0b38-c7c1-4d0d-bed4-d0078fe237c5", "value": "f3deb6209dc9c95daaecc9f849af840f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940554, "uuid": "2f889dda-0efd-496a-b1e2-836e572df264", "value": "6144:6nhWubOStZ6AbgmgwLp3gUhWeGtphOPc/woVPHma1MXohuPATdTpNSTrbkYW412v:6nTltgBNwxgUX4/DGaXhu45pI3rep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626940554, "uuid": "9e0ef24c-4cc0-4bfc-85ed-da06aee6fc99", "value": 557056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626940554, "uuid": "fd19e68e-0694-47de-a58f-255b3010149b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626940554, "uuid": "7415ccba-50f3-4218-aa54-63cac3105f86", "value": "72d61074196aab2e16028265c40c0281.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "792db84c-eb2f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626987469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626987469, "uuid": "b1e95202-817c-41d7-b6fa-bf47f8f345d3", "comment": "Malware payload", "value": "fe28dcde723703dbadf136d0c64b23dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626987469, "uuid": "445040a8-6fbb-4e5d-8583-a8627c2b350c", "comment": "Malware payload", "value": "fadd1988e54ba84991ce75367f9b72213563ab9316bc93df7aaa988cc61d6298", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626987469, "uuid": "49fa7347-0b83-46e2-99be-4be7716ab0c0", "comment": "Malware payload", "value": "f36dad938ebe09c41c154d10edb04f18a2e74a7c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626987469, "uuid": "01af8c18-9d9b-4226-bf25-9dcbf304949c", "comment": "Malware payload", "value": "ddbbeabccaf3da548ba8e89cb95c5cfeed9eaab40855852bcab34105a05a366de9c80a9a19c0810a47e794281e686ffd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626987469, "uuid": "d7a82d2b-4053-40e9-b6d9-75b75c8cbc26", "value": "T1E61538233E97DA0CFCE08A7E48FD81123FABD882550E8FE669D7736D1491625F5A0943", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626987469, "uuid": "d39058a7-2725-42b8-8f52-819e31168369", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626987469, "uuid": "e60081f2-05a8-4690-8f9e-11436c29326d", "value": "12288:+JCYyI3ka5QxJnxkOdREOdiHLpvmU0Azu1ka/IXXkwsyaUVKnpw:+J/S2kREvACi1ksw0wzahpw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626987469, "uuid": "b42fd53b-a483-42a7-a0ec-3ebb0789735f", "value": 879104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626987469, "uuid": "1b33bcb3-7c74-46c5-a28f-25fc5bf9cb71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626987469, "uuid": "380ec0de-5d94-4c03-b7fc-b88717cae5f9", "value": "RFQ 21012110 415081 OP 00004.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f49d7436-eb0f-11eb-875b-42010a9c0053", "comment": "Malware payload (Smoke Loader)", "timestamp": 1626973932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973932, "uuid": "3da5e3e5-ee06-4888-a610-2068f0a07ffc", "comment": "Malware payload (Smoke Loader)", "value": "66a2a7f0d83b797068895f9fcd2c886c", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973932, "uuid": "b220f04a-6385-4383-85a2-e0a79fb7eb9f", "comment": "Malware payload (Smoke Loader)", "value": "fb37334a0f31e9cac09d245e3ca86b08ca8df4a57ef9ec4b228bdb9869ed847b", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973932, "uuid": "dc63e7e7-9d28-4a33-bfc1-d5997fd7505b", "comment": "Malware payload (Smoke Loader)", "value": "e345ce2ab871e58610450b09320305c9ff046e66", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626973932, "uuid": "a098169c-47cc-4f6a-bea2-e46335c0fdf5", "comment": "Malware payload (Smoke Loader)", "value": "3d21b74c4a64ea3bb494d0311c7c909402ebff26baf21052e4956d1ec8dfc82618f612502beca9e4b3b19222a1d5a2bc", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973932, "uuid": "a63a956b-29d8-4e41-a52f-b6a76eb83d54", "value": "T13604BE207994C832D4E50931DCFAD6E6273EBC221A7849877B853BCF6E722C1657E316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973932, "uuid": "fa4f94b9-b938-4189-bd4e-aa52c7e67d3e", "value": "6acba419afd0f4919c1c58d62b0b66c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973932, "uuid": "c3f6f675-bf1c-419e-818c-d18a0e00b74b", "value": "3072:/07GSemgq0aJaHr5wkTfCXLtAcd0+Uz/72XLJDwXMbPwAFfIlRsMbL:XSkZLl6XLtJGzQLyXiPwA+l7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626973932, "uuid": "3fc8f0d6-c3ae-450e-a1fb-e4120623e14d", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626973932, "uuid": "df834a40-85a2-4279-bb03-b0d5d8175c72", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626973932, "uuid": "df944e83-f660-4951-9555-ad76181ac975", "value": "66a2a7f0d83b797068895f9fcd2c886c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "985a7ff3-eaf4-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626962181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626962181, "uuid": "bd0f9d10-ce1e-47fb-abf7-a7bc0e7fac38", "comment": "Malware payload", "value": "8edf0aa789d976df0c80fd8d62734ded", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626962181, "uuid": "61eb0d97-bc17-44ca-a766-75d0064d77af", "comment": "Malware payload", "value": "fb80dab592c5b2a1dcaaf69981c6d4ee7dbf6c1f25247e2ab648d4d0dc115a97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626962181, "uuid": "8fc1e232-9f14-4d8c-aa2b-c67e20872b58", "comment": "Malware payload", "value": "54a8b718fda1ea749df17271d3f897c947004483", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626962181, "uuid": "4e197f67-6022-48d7-b4f5-4d4dee31aac6", "comment": "Malware payload", "value": "abba3b709b73e1f4cd2e45703043a06a0d64e90c0251a8edd9790fda2122348fd88f0edd640005f6c59d68b25d05fc92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626962181, "uuid": "d92384ff-ff58-4f01-9f68-67d92ed521e6", "value": "T1A7C4E080B349C8D6F52A59F15C2A97701442FEBCA469844D64DBB61E4EF234220AFFDF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626962181, "uuid": "59f11b3a-9bf8-4a12-8462-ee861b899e44", "value": "b7373c4e4b3b995daa8d1068e812ff00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626962181, "uuid": "5c418d72-3b62-4c03-81d5-20df7025afcb", "value": "3072:ApJs5aBFWosyzhIXj4Ix0RBZbAi4BGijv4Li+gFUm0ZJgRlLPwKIhyWcMyHSZbqv:ApJoKzhIXj4Ix0rZbZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626962181, "uuid": "588f09c3-c852-47fc-b4d1-61230804e804", "value": 571904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626962181, "uuid": "c82d70c2-1848-4ae9-b5f3-7c9902a1c91a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626962181, "uuid": "9bb9115f-2f46-43ca-b56a-bd5d71f3a5d8", "value": "fb80dab592c5b2a1dcaaf69981c6d4ee7dbf6c1f25247e2ab648d4d0dc115a97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "263df7c0-eaf2-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1626961130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961130, "uuid": "cca840c0-3209-49c3-9075-343f4efcd2f6", "comment": "Malware payload (Gafgyt)", "value": "04877c5d79df37e33c0e238712f377e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961130, "uuid": "a8e3c4d8-a6da-4fca-9767-62c6cc98ca93", "comment": "Malware payload (Gafgyt)", "value": "fbaafdd070c20de4b0da48a37b950f968ffca16c354b9416b40e0727b854fd8d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961130, "uuid": "0d3ff6f2-9abc-4b6c-becf-eda908bc69bf", "comment": "Malware payload (Gafgyt)", "value": "2ae307ee2dad90e4fc93d35fe770aac1fc99b3b4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626961130, "uuid": "f96b62bb-4f62-4b96-9520-ebdaa74aae6e", "comment": "Malware payload (Gafgyt)", "value": "9e453b15a3beac6c5f002a7415bcb7624070a8f3d89ac7998f8940706df164f36e0a7c8640fcda881802ad16dd8a4636", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626961130, "uuid": "ae499972-e91f-4a27-bf80-7b00445942d4", "value": "T1AF933A47B71C0B53C59B5AF12DAB3BF08B69B9E113D76185A10AEFD00372EB12412FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626961130, "uuid": "2728d3ab-a60a-47b3-939a-113acd679400", "value": "1536:QQK1n7bzX9jajzvxRq57wBRcGCMCZDxeBk+8el4umXxVqDrstKfz9e:Q97vk51RcG7Acl4umXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626961130, "uuid": "1e966bda-2d2b-40b6-9b1e-7509f2c438d5", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626961130, "uuid": "8f9bbbab-b075-4e05-80dc-30ea09165681", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626961130, "uuid": "2618720e-6113-40b7-ae52-f8b3711d3bb7", "value": "04877c5d79df37e33c0e238712f377e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a78813e7-eac3-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626941161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626941161, "uuid": "83585c70-11cc-415d-907b-6d83ccb78a89", "comment": "Malware payload (AgentTesla)", "value": "2e21013d8666ba1eaf72238befc4889c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626941161, "uuid": "19922c71-bcb9-4814-a671-6e3d1143b063", "comment": "Malware payload (AgentTesla)", "value": "fbadf252eb04bc791373500dd2b28c45ef60bf5f34c711c4bff61fe5230c056c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626941161, "uuid": "236d6dc3-b56a-4600-a343-f630899d8795", "comment": "Malware payload (AgentTesla)", "value": "f5052e76d0dd47411987d4a4de27fc849e1c9a55", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626941161, "uuid": "d1b6c671-e644-439d-99a6-cb1b3f8ea054", "comment": "Malware payload (AgentTesla)", "value": "80e4b56655763fe2298679777b4e3470369faa2bc242ae65ca2701906e8e08c1230a096030802f19aece088d26cd7b54", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626941161, "uuid": "94f29dde-9ac4-419a-9fbc-3ff3072a716a", "value": "T1F9F401047B806F4EC5AF8E7A84114C50EBF1E966670BF7C76CD723EC548E7998A13292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626941161, "uuid": "e6ebeaae-982d-456f-8a14-5496d839dd4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626941161, "uuid": "2aebc110-190b-41b8-b149-543b2b95e287", "value": "12288:330XffCGma1uGU0sBYqFDMRwM3JCJI0povbFyf41/gzUXE1C1c4I7y:UXHCGSGU9gRX+I0kF+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626941161, "uuid": "cda10b7d-a0b7-49db-bada-ed33e78ffec3", "value": 752128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626941161, "uuid": "e61057ac-c375-4eb6-8f8c-8b9bd776ccc1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626941161, "uuid": "4b8d54af-7024-49fd-b81d-0f2d40128058", "value": "RFQ#000002720212207.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e225cd3b-eacb-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1626944695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944695, "uuid": "8348f20a-1589-4131-b962-15c664839fd3", "comment": "Malware payload (Mirai)", "value": "7c8ff25ee476a1cd89bbf529e0ac6af4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944695, "uuid": "456bc35f-6961-46ac-a2e3-c621e0fd9527", "comment": "Malware payload (Mirai)", "value": "fcafcefe3e66e811cdf3362820d2a7a6f6ae6005374b535357bad4ff349fd4ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944695, "uuid": "e0932a8f-d9d4-454e-a2d2-5c71da9da4f5", "comment": "Malware payload (Mirai)", "value": "71e15a4c42d920302925c7d5ba05ca9f0c27a998", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626944695, "uuid": "8438654f-a2ac-4bd4-9278-b4bbe5acdc58", "comment": "Malware payload (Mirai)", "value": "1474428c0f7d64ea00259030d8fa6a1d2fd33c5ac5d5fe444b6f0bd37eeb8e71c9259cda0430e9a6ec9de9a8a3f3e5a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626944695, "uuid": "6f0a4910-bbf6-426a-9125-97a72bdaa1f3", "value": "T190432925AD792E26C0D8B57E11F78724F2F2620E25B8C65E3C721E4EEF04740A5537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626944695, "uuid": "847d3b28-68e3-447e-9d20-ff74dedc15c0", "value": "768:eLobAxU6q9Hfymp0xginuYvCkLB6WsTwIC1DQdszoDaS0O+DCDm:eL0AxvSHfymp0xgunvCkV6vTMDaul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626944695, "uuid": "8daee418-d1c5-4666-b6de-30e43325f98a", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626944695, "uuid": "c3014df3-77a1-4632-8247-ab2ef2d904ab", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626944695, "uuid": "8c9bfea6-a843-4ba1-93f0-29c0b712a889", "value": "7c8ff25ee476a1cd89bbf529e0ac6af4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418a7ddc-eaee-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626959458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626959458, "uuid": "2a5d4cfa-e402-415c-ae27-1efef03f1db7", "comment": "Malware payload", "value": "1d74c5d9e3ccc302ab98d22fe84e2f03", "object_relation": "md5", "Tag": [ { "name": "wbk", "colour": "#09CA42", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626959458, "uuid": "9b7afb65-8fc6-4db4-a50e-290deb2be31b", "comment": "Malware payload", "value": "fccff2b436faf6e84c2412b2353a7fc7eaaff2eb818bb14ce0cd9eece4f80534", "object_relation": "sha256", "Tag": [ { "name": "wbk", "colour": "#09CA42", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626959458, "uuid": "0f9b971c-213d-4808-80c6-35777079275a", "comment": "Malware payload", "value": "d52239135a4be34f4c647efe6d703f2613eeb763", "object_relation": "sha1", "Tag": [ { "name": "wbk", "colour": "#09CA42", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626959458, "uuid": "a63e5f95-6dc5-4a9e-9de6-75a9b8f92d20", "comment": "Malware payload", "value": "1c6bf82b0e18b9953f9803d9a8b5f4584992c3dd45cf73a9ff1556bce210afd2169a34cd030c246a98c8b82a80ebfdc9", "object_relation": "sha3-384", "Tag": [ { "name": "wbk", "colour": "#09CA42", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626959458, "uuid": "daf5d73a-377a-48e0-acbe-df6a4137d229", "value": "T10A222BACEA6B4369CF89D260A076DF8C43997A7CE3489152392CB3313F87F254E154B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626959458, "uuid": "eea41f5a-18d3-4495-8eeb-e72402080c70", "value": "192:gZFZuEHeyxfoPVIWfVHCKIbOhCtqBJzx2qREXihlZVXdBp8IvE:gDey1oPXIXtWhJhbHJvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626959458, "uuid": "61d3f21d-31cc-41ee-9a1e-bd3eda0bd4ed", "value": 10639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626959458, "uuid": "90603360-93b0-4b74-a2c9-f3e7410bdcc6", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626959458, "uuid": "1d3cbcda-b518-485b-8489-cdd34a696828", "value": "sww.wbk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "699229d5-eb00-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626967256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626967256, "uuid": "1502c682-5374-4c76-a96c-c78075413fef", "comment": "Malware payload (AgentTesla)", "value": "71af183490ef5c747eb3b6a1417c8f33", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626967256, "uuid": "16d6828f-57ed-4c7c-91c1-c2bdc4124434", "comment": "Malware payload (AgentTesla)", "value": "fd1d1d4f70fb3b258e798ba9ac66abd6ad9d9de16b4b2204f55519ea59eb7d12", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626967256, "uuid": "e5ea1385-a4b6-45dd-82c9-e3618e8d60ce", "comment": "Malware payload (AgentTesla)", "value": "cbf5c744909fb1978d8bbadb3b1377e7b364f90d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626967256, "uuid": "fa1c5fac-fe24-4e52-936e-8c0274ce0cf3", "comment": "Malware payload (AgentTesla)", "value": "f605a748c923f8d693e144c978a9ffc6f793b386572fccec00cbdf200033787efb984cc2fb819819408ba6c7566df70b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626967256, "uuid": "4d5124c9-9a04-4888-b5f0-88d2f74e08ff", "value": "T1E691935827380D53DE6A81F1C4B9FEAB14D1F62B85CF2989376CF9B0075733A8725485", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626967256, "uuid": "4fee2159-d142-46d9-9ebc-775485bcfe4b", "value": "96:pyfv7sySj/d6PsRfPkElCaGjc9OqzL5ud9YPm2KJbe:pyfvoySDgPsR3VlCbjEOWud60be", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626967256, "uuid": "1128398e-efc8-4cce-9b02-7dabc82eb0e6", "value": 4547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626967256, "uuid": "5b71d1ce-6396-463a-b316-499a7a29479a", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626967256, "uuid": "8b004c71-d9be-4ec1-bcbf-d3a7584e49c4", "value": "PAYMENT ADVICE.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc9bc23e-eaf9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1626964497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626964497, "uuid": "9d3240a1-e668-4b29-907f-fd1d071d4c65", "comment": "Malware payload", "value": "fbbefa2bf51016a540da3b67d0da5120", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626964497, "uuid": "f04e5729-21d0-440a-b44d-cd137ebe4807", "comment": "Malware payload", "value": "fdec06df5406c4ce7396704a8160927a2bdceeac0bb111b702ec310498e9a5ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626964497, "uuid": "0b77399f-4eb2-4412-8ac3-709876216f35", "comment": "Malware payload", "value": "7241b889fd834b483aa1f597213eb53632b2d94d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626964497, "uuid": "5a8dde55-74e8-4a0e-935e-99b1d44be9e1", "comment": "Malware payload", "value": "e738459c6bd728a64d4ca7aed6ad1326eb7062bdda70f3be8eeba7528eb98248b36f82ce055ab9313716296b76f7d939", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626964497, "uuid": "f27672ff-74cc-450a-8424-470a607cb2c3", "value": "T1DCF3E155BAB0C8B3C2300A74DD39D7B58ABA7A226C61069377F55F8EFCBA7C1190D142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1626964497, "uuid": "3754ec0b-9590-4679-9612-9699f5dbcc71", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626964497, "uuid": "b4dd9362-cb6a-4172-a879-6fd66d1835ac", "value": "3072:sr85Cl1UVu2viHUjyrrMiIdFcpALdqaaA0jRGxmBkfJpRXATwMdFCcGbY+i:k9lWu2viHIy/QFcpfaaJtGMqjIKY+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626964497, "uuid": "6758ffc0-0ab8-4d6e-9cc7-267d69dbb7c7", "value": 169150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626964497, "uuid": "5f81c448-0d22-416c-8c6e-da1369960193", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626964497, "uuid": "aaca856b-a93e-4cb4-928d-72a04be22f7e", "value": "fbbefa2bf51016a540da3b67d0da5120", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17980c09-eaae-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1626931900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931900, "uuid": "44387fd5-7492-4db2-a331-37651ebf5676", "comment": "Malware payload (AgentTesla)", "value": "d96806deb211163cce64cb6d8bfe76e1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931900, "uuid": "ae3d308a-2b7c-42c5-bac3-d7121284ef31", "comment": "Malware payload (AgentTesla)", "value": "fe9a3933128b2954090c969682e654f1349ed093f45d4bd2e8546beff5497654", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931900, "uuid": "6716e1a3-c8a8-411c-aa82-fa204591e81e", "comment": "Malware payload (AgentTesla)", "value": "c0d8526c8b8f50023a91eaba2e2a9d50f89ae01f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1626931900, "uuid": "f801d584-3f3c-47fa-94bd-bbd5ae31b1d5", "comment": "Malware payload (AgentTesla)", "value": "2e5da2c920b2e2135351a18df0af160e06025b6d5b7612edfbd43e0fe6cbad663dfdc2b91492b6f625aeca7ee72723e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931900, "uuid": "bfda110b-2387-41cc-b567-aa39f4278729", "value": "T1D4B42338C1793969B34122F34C3918D1122C9F49894F6D96D31FC5393AA6A7F04AEDA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931900, "uuid": "4bc56b30-ba8c-428f-a18f-77428fb17725", "value": "12288:VPck+A5nFfzJSCdjpm2g7TlLSricCzgrW4NfMlFA+Q6M:Vt+ATtSYjpgJXcCNTTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1626931900, "uuid": "def3b4e3-2353-45be-b1c0-567c9977f801", "value": 518540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1626931900, "uuid": "fccad299-8304-49bc-96a8-36cfbc27e7cd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1626931900, "uuid": "5ac99e47-469a-4139-90e2-bfb8e8f6f969", "value": "BANK DETAILS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }