{ "Event": { "published": true, "date": "2023-06-27", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-06-27", "timestamp": 1687910581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "edbccfc6-9b29-4fbf-bb8a-2dc73d86f16a", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "531841c1-152c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687899061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687899061, "uuid": "88884490-e6fd-4796-9d77-a302d784d981", "comment": "Malware payload", "value": "e020edc99742f69861ad5d05ed447f2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687899061, "uuid": "141713ef-ee10-49c6-abfe-6b2c94e2bca3", "comment": "Malware payload", "value": "00bedb55d621e47153472c34561cf8e101bd3b2e70d7c21c6c91cbf29e460528", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687899061, "uuid": "937ea7ea-43ba-4b8a-aaaa-0792f29540a9", "comment": "Malware payload", "value": "b8fcac32ea878a9c71bb82dd06e2c9dc5c42d7a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687899061, "uuid": "056e3d29-0f3b-4595-b5c1-0b139f760457", "comment": "Malware payload", "value": "83f98ab0a775f87d51f2cf62f082e59303588e785149050527483e5b43e95a5a9453d5e8b614e8b12ce75300e540f09c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687899061, "uuid": "a616c2c0-45db-42fe-8862-a90ed8e43f85", "value": "T17ED47B8AEBC1DC6BC41503B04DDB9725273AF498A383DF4B27A495382C6376A7F8564C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687899061, "uuid": "bc0254ef-9f02-442c-a5b0-51d41cbb7c8f", "value": "e9ef9b3a65dd6bf58caf965b2eb31e2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687899061, "uuid": "92a99fbc-b173-4628-ae4d-be1dcd8108d2", "value": "6144:aQsPjChP/DWxDmFKP9VCUMrex0Ai/k8XFRFj75Gt39OXam:Bs7Rx6FKP9Vyp17549OXam", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687899061, "uuid": "ffce414d-eb48-4eb7-b7de-c25c17ff1578", "value": 605524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687899061, "uuid": "96c4c744-94e9-434a-a68c-d150fad0f4d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687899061, "uuid": "03b1e915-baff-4cca-84f1-927b1bbc67be", "value": "00bedb55d621e47153472c34561cf8e101bd3b2e70d7c21c6c91cbf29e460528", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6be3752-1481-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687825784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687825784, "uuid": "d934b453-0abf-4d15-a8dc-aec8e82257b5", "comment": "Malware payload (RedLineStealer)", "value": "e85378305f807653bd94efffc40675cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687825784, "uuid": "c339b2b5-4df2-4fb1-9719-f2b8c3a103ba", "comment": "Malware payload (RedLineStealer)", "value": "01df357140cab08154d7288fc1cde4829aee66ec02bcce8985506bf63961e024", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687825784, "uuid": "567d74ab-f691-40a9-bb48-73e38b130241", "comment": "Malware payload (RedLineStealer)", "value": "8cadda3b6e53ade5abff8edf6beb0342f3e6a25b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687825784, "uuid": "8ea3cda0-0aff-4429-8af4-7e4cb30af138", "comment": "Malware payload (RedLineStealer)", "value": "4830945cb4b6755cd454cf3855d1d2c62314dd0eeb906404bb34d56f221925a220d8606f6e74d41fe4e099dc7d4b1d72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687825784, "uuid": "fe159c29-7906-413a-80fb-6cadd6b59f9c", "value": "T12CB402323D40F32ADD99703196DBC11ADCFEB8321F97C1D3AB4C91691BA06C39A5E195", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687825784, "uuid": "2a732ecb-1e7b-4dd5-aa7b-ba09f8daae8e", "value": "a3a98f4b8bad628ffa25a9afc0275971", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687825784, "uuid": "2121fd4d-7097-409e-b52f-7bbdce16bc0b", "value": "6144:CD2eDBS0q6Zwh24HVvsrln4Uj6dHjlHZ5+g+yhiUOh3JZzrSDgE0Q9QHexFUCo/x:C1S03zk9jdiebONGKaQ5xO4DL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687825784, "uuid": "de533d3f-6d1f-47a4-bebc-a7b9fc8c6723", "value": 508176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687825784, "uuid": "8cfad08b-8d0f-44ca-a40e-512e7777d77e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687825784, "uuid": "cc4f1a95-a1e5-4c82-b711-551cd021a5e7", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80301efd-14a7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687842013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687842013, "uuid": "787fe0e8-5cc2-41f6-a3d6-a9e7c0be1d48", "comment": "Malware payload (RedLineStealer)", "value": "d60418a43374e93b8546d9a017364ba1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687842013, "uuid": "3cf047e8-5a53-4a27-91f5-7922de399ea1", "comment": "Malware payload (RedLineStealer)", "value": "030ee4d82518139a21800e8c6946f46cc251821e9a738a78cfca30a18f0e98a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687842013, "uuid": "6bd714a5-74b3-4b12-a09d-9001c159b288", "comment": "Malware payload (RedLineStealer)", "value": "9dd49dfe95e28167574179bf82fed2d0070303fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687842013, "uuid": "f56c8d6c-d05e-48a3-aa22-25ceac3088f0", "comment": "Malware payload (RedLineStealer)", "value": "8d9df6cd28e366584e758938ca20b29e5dac9aea25c1852e38e32a6bce1f3480af6d77f9cc09acec9941f76cf3fd53d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687842013, "uuid": "2b38b647-ed1e-4aee-a4cb-314a334fafba", "value": "T10C149D2C7B80F7B6DD201638055FC7DAA5E736310F369087FE9945660F902C5BB78A98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687842013, "uuid": "0b7a6669-c022-463a-be92-986df825a4cf", "value": "a3a98f4b8bad628ffa25a9afc0275971", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687842013, "uuid": "40c8bd9a-9319-459a-8cd6-c5ddc9695f3e", "value": "3072:V7Iyj3xe0zyoImHgMVGERF+pLqa0daMVlj7XvVLM:6yjBDgMVGQG94l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687842013, "uuid": "d45c5114-d99a-4536-b016-bb2b78c77f90", "value": 198656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687842013, "uuid": "665f83f7-ee86-4731-9f2d-d2672455bfa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687842013, "uuid": "4dde10b8-408d-40c6-8ed4-4c1a5c50dc89", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "898aa19b-14b2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687846753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846753, "uuid": "95cc5651-c587-4f52-b375-df1efad40e64", "comment": "Malware payload (AgentTesla)", "value": "9887bf1cb7c264dbeaf49381f8f773f5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846753, "uuid": "f2c4f33f-d71d-4f5a-af7d-8eaaac0f4521", "comment": "Malware payload (AgentTesla)", "value": "0362631ef275750195af2dc46a0ec7a714efd57ea7d7f95eb90a1a84a4ac6322", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846753, "uuid": "9d7ecc5b-6491-4d67-9b4b-79115a7448b4", "comment": "Malware payload (AgentTesla)", "value": "1e0a86fb1a6e6283c29480fdc2d49ad70a19e090", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846753, "uuid": "5e870082-4e13-4318-9b76-be11f507d6c4", "comment": "Malware payload (AgentTesla)", "value": "f2b9a2ed89dd9a9cf74cdbca9646211f262c038da07acae34711a9f1faccf0f8751f377e80f39ab20788b1e6db6407d3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846753, "uuid": "46a04eea-c6e5-4a97-a08c-935c880f81f2", "value": "T17AB4231811B2DC5C39C26507B6748680DB387CE5DE98CA5CC8FA8CF5B29D6DDEE682C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846753, "uuid": "efac0904-da4e-4bc7-9d8d-f2fa27841fb3", "value": "12288:EkahB3AwCfgJck0wzAfUmvaDWyl+zSrQTyK9uuIJmTD74Ov:4P3AwCfTkO8+pyl+QQjuBkTD74m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687846753, "uuid": "8f7c8516-e8d0-4241-b3cc-acb8c7ce7f82", "value": 503552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687846753, "uuid": "505fe333-ce53-4d4d-a9da-c262e7f99ceb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846753, "uuid": "6200d540-6b82-4804-afca-0c7e43af0652", "value": "Invoice-04884.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce3281ab-14da-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687864048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687864048, "uuid": "df290780-6a23-49dc-bed8-cefb6b0043e8", "comment": "Malware payload", "value": "0d8b46525656ee376856ef0d22559701", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687864048, "uuid": "06bfdce0-ae3d-4fc0-9dc9-fc4d20468392", "comment": "Malware payload", "value": "03a0d43bdbc0828e29918b46eb891e9622a710a430b48243afb2ccd87b7a6295", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687864048, "uuid": "9fd8acbc-2e05-4d1f-810c-6a86f1481af2", "comment": "Malware payload", "value": "84f2f4cbaa499620297fb7c85e3c76114446cc69", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687864048, "uuid": "9f96ff6b-0381-470b-afde-c6ae08cc5200", "comment": "Malware payload", "value": "4907380750df140b7a7ebffa9f316097ad5a8926a1d3c1b188e2b33e56378a842d3b1987830f57a34be0c7ab903dd142", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687864048, "uuid": "23006975-dc3f-41b2-acf4-ecba9680896c", "value": "T1B5044B0CB4AFC062DEAF6AB48DE495B18D2CB4830F614C57631C47280BB55A979B6C7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687864048, "uuid": "b8b68b62-a9a8-43e4-ae00-d8b8d2787271", "value": "7d9136e63096821b46a9500baaecb5c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687864048, "uuid": "bc20fad0-ec4f-40b7-b8f5-a578ba1e0cae", "value": "3072:6O9HqfSQ6VO47Nv9J5S70QZ/ntMAqfke35c9aYpId4bGzlqtzdbxY:6UbQCJlJsZ/t5qd3OkY/GqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687864048, "uuid": "bee8370b-7d8e-4896-99bf-5520b4f8d081", "value": 189579, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687864048, "uuid": "ace201a1-0fe5-4ad3-b134-c2c9babddae1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687864048, "uuid": "f1e30850-26bb-4070-b06b-0f88471dc40e", "value": "0d8b46525656ee376856ef0d22559701", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86847b4e-14b6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1687848466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848466, "uuid": "e0c51ccf-e4a0-492b-93bd-511138ad1c19", "comment": "Malware payload (STRRAT)", "value": "4c0dfb625ea03d5521ac7c1408e6740f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848466, "uuid": "c15ac8cc-a6f8-40bd-954e-8ae376fc7f97", "comment": "Malware payload (STRRAT)", "value": "0572e16f59a71839019733faeb4a7b2dbfa8f8c2566ee662b0d6d32f519bbac4", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848466, "uuid": "61485519-4426-45a4-933c-de2d884ef338", "comment": "Malware payload (STRRAT)", "value": "ade855385d1b003b56ac32b28c8b96339e30b16e", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848466, "uuid": "559f7c9d-8ba0-43c9-b434-d3b8c5cf40de", "comment": "Malware payload (STRRAT)", "value": "48ca22c9b833b94b7151b4bd76d07c7a7a2968a460838a1afdede4591fc2932224a1377645c3b609eec062d88a765874", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848466, "uuid": "439364f0-f3db-4868-baf3-7f7fb628c21d", "value": "T1CF24015BBE6FC8E8F01B5476984EE537DD490288C80A907BB5FC484D093AC7D5A46ACF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848466, "uuid": "c49fff34-0bce-4844-8194-768228d92bc5", "value": "6144:KDufG3+dGHFViEFzNQxNb2au88HOfqoLQecEgG:muf++dGHeEFNqKa6ATQecRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687848466, "uuid": "d2da96e3-3de9-438f-933b-1b7c01e48c80", "value": 224105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687848466, "uuid": "c197f9cf-5555-4cf2-9502-2f72d80aa3c6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848466, "uuid": "a7db5d3d-f5e5-41cd-987e-e4799690c0b3", "value": "Product Specification.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd31e73-14af-11ee-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1687845549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687845549, "uuid": "f0335ab5-1ffe-455c-b4d7-8c1092d75c7f", "comment": "Malware payload (NetSupport)", "value": "ad24182429cfc22b7505f15a7afe6641", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "savastijir1-com", "colour": "#C2673B", "exportable": true, "hide_tag": false }, { "name": "savastijir2-com", "colour": "#F97E62", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687845549, "uuid": "efc7d716-e1bd-4f73-a5f6-e9da23460d65", "comment": "Malware payload (NetSupport)", "value": "05a0c04953b876fa8735a92f12cd74e9d82731a57efc45b4aa80b326eda14fd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "savastijir1-com", "colour": "#C2673B", "exportable": true, "hide_tag": false }, { "name": "savastijir2-com", "colour": "#F97E62", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687845549, "uuid": "517dcb12-95ae-41ef-8f55-eb13f98eb11f", "comment": "Malware payload (NetSupport)", "value": "2cbc8915445f257150bd7fc9dd077696cd463de3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "savastijir1-com", "colour": "#C2673B", "exportable": true, "hide_tag": false }, { "name": "savastijir2-com", "colour": "#F97E62", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687845549, "uuid": "8b5ac165-0f10-4384-ad36-b90d91a8eafa", "comment": "Malware payload (NetSupport)", "value": "e4d366ddf8f18fed5d129353249b69297572921e240ed8cb556d2a57b564365b1c3a9e614d4ff6eec39eb325d9280208", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "savastijir1-com", "colour": "#C2673B", "exportable": true, "hide_tag": false }, { "name": "savastijir2-com", "colour": "#F97E62", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687845549, "uuid": "97e3302d-99c3-4437-8474-e14c2382f29d", "value": "T12CF48E37B1E09533D3732A3D8DDB5264982A7F022A28E94A6FE50C4C6F7978139253D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687845549, "uuid": "f114c266-af49-49c8-a713-fac88df13dbb", "value": "44b6bfdd6ffd5450ebd675c84f22b9c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687845549, "uuid": "f1aa51d8-2220-4fbc-9ff8-2065b3ca7a33", "value": "12288:uXCY50vo8hpf5s53tdIVOOBFP71p4pCAa++0x/gu7TH8TNBqrEHeph/q/Z:uyHo83Rs5sOsT4DHRMTN4rHph/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687845549, "uuid": "67e5d431-e7b2-47de-897e-e242bff6c29c", "value": 749048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687845549, "uuid": "fb5444fe-8cf0-4afd-b690-94df4f92c43a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687845549, "uuid": "cf885548-3fad-4def-a786-37980ad44824", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc1dff0-14eb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1687871426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687871426, "uuid": "da597237-867a-48eb-9653-304f8377cdb6", "comment": "Malware payload (AsyncRAT)", "value": "5f859ce795a09f858adc51815cc0faf8", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687871426, "uuid": "37682c32-01c1-45b2-97d7-49400838cf5a", "comment": "Malware payload (AsyncRAT)", "value": "05c2195aa671d62b3b47ff42630db25f39453375de9cffa92fc4a67fa5b6493b", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687871426, "uuid": "ee4a6961-2ea9-41b8-8ebe-5aef5da7253c", "comment": "Malware payload (AsyncRAT)", "value": "61504e701ef261b21cef7d824cb69255cd68aa9a", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687871426, "uuid": "e5746ea0-ce8c-4a48-a15a-25d0a7ab7fa9", "comment": "Malware payload (AsyncRAT)", "value": "e4364845a89ae5e77840f6e3aeee5d507e38d18f423249414f5ba128ca5e40c2ba3e70a64278ed55540febac6fb78d16", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687871426, "uuid": "44cb531a-e361-47ca-9fdd-401e54ef86a9", "value": "T174C4F7B472E0EA79D5E982B14A917C30D3F88C62D971E9469CECF8D18670FE35B91603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687871426, "uuid": "bdd959ec-b68b-4509-a527-20d39667cf87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687871426, "uuid": "17bf5203-5e02-462f-8604-ebc164973409", "value": "6144:sfHKclg4tx/RbMSx+XbZ3GFf0VKu9ouuJ0rYL5qH3vbkhdgmucPSrtrogLXax:TEx/lQXbYFfQKGvb4ocPSprTX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687871426, "uuid": "8f1c76b7-1dea-4065-8978-310734e7c08a", "value": 587776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687871426, "uuid": "da93ed97-d051-4fcd-877f-68b1e7813762", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687871426, "uuid": "00ec1e0e-acc8-4f25-9ce2-05e7d30eda8d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c850d5cb-14b6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687848577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848577, "uuid": "245fe119-b143-4599-a067-f1b1cba4b312", "comment": "Malware payload (AgentTesla)", "value": "807f7bceea62199decdc1818ba6f5871", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848577, "uuid": "b4dadc54-9344-4007-bcd8-5e9c45198dff", "comment": "Malware payload (AgentTesla)", "value": "0643798473696f97c20a9ee0f8937f7aef794366590fb0af315593b718709b69", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848577, "uuid": "30dd63f2-a424-4469-9847-93eba8bc70f1", "comment": "Malware payload (AgentTesla)", "value": "efbe8fda3d12a88a2b459ef822224e7bd6e3f86c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848577, "uuid": "c34f53bd-abd9-4889-bbfb-5d37f2e0215b", "comment": "Malware payload (AgentTesla)", "value": "567ad987e002d7e356740b5d2c1d4ca0ea228836f987f034519b9c0dacd1e76443b1be2676086074dcdfac2519c8d0b0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848577, "uuid": "af135c13-ba0d-42ee-8154-fa2a6bbde3c2", "value": "T13BB47D025EEF0008B1A3AA8F9BF654A84F37BD755939C55C518E190D0BEBD80B961FB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848577, "uuid": "6a4badda-44e8-41a2-9813-9a8ae8364fc0", "value": "3072:KRr+dxPr+9gr+Ejr+gMSlctO+Jxq3udcXaSO3TxHfOH5n5p5XNsn1+7HLDVZcMxz:blUSODxHfOWn+AMxzak5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687848577, "uuid": "332be717-dfeb-4175-928b-16855b092570", "value": 510276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687848577, "uuid": "c0d28ff6-fffc-4bf9-8c60-8f125d3d286f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848577, "uuid": "9d4b6932-38a9-4b67-9040-5f6e52925dd2", "value": "Azmac, Unipessoal, Lda..vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39b0830c-14c7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1687855639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687855639, "uuid": "ed12267a-ed8f-47a2-a5ed-e8af6a0c88aa", "comment": "Malware payload (ModiLoader)", "value": "4922ce036fdba7d1397d966e3825d821", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687855639, "uuid": "35ec1940-65b6-4b32-b6dc-5b9fcadc82f2", "comment": "Malware payload (ModiLoader)", "value": "0731a716141226c50ff7aeb827c009a5326b64a31336636548913834a9f791b1", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687855639, "uuid": "1458fe3b-a1ed-4cd7-b6c9-ddaa71c669ec", "comment": "Malware payload (ModiLoader)", "value": "506c7ccc149fe1e49332dba93b76ae631f3e30c8", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687855639, "uuid": "1ba5e179-59ee-473e-9aab-1a92341da068", "comment": "Malware payload (ModiLoader)", "value": "cf57b653f9810aef2db3fa99f32e3a08398decbe62b434a2b11024f4fbd5188deaa1ae397e06f45cdf1f1aa28cd35984", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687855639, "uuid": "24e0b337-575d-4acb-85de-27eeaf900d0a", "value": "T16A659E23F3A04976C4F32A7C4C47239A592A7E313D28A80A7BDB4E4C5B753D17B6518B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687855639, "uuid": "87b0cf6d-f008-42a8-9ff2-cfec8959e1ad", "value": "12288:P00zh1YnARzVrGgJoowTfehf/lHG6LbO3nQPIwuYmmJ/9zaxmx8MYSFD:P9YARzVpWW7/Pfbzaxmx8Fm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687855639, "uuid": "129bfaed-d9c0-4fa7-a691-ba81d55c7afb", "value": 1441792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687855639, "uuid": "b85deae5-531b-4922-a493-942e37ae0197", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687855639, "uuid": "578d4364-fb2c-4b52-be96-8024975bbec7", "value": "KNF.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b0f2475-14b3-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687847078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687847078, "uuid": "01336fa0-1a9c-4f11-aec5-ea383eb54ee1", "comment": "Malware payload", "value": "9b66210b4f0d164a27a27a3755719e5c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687847078, "uuid": "fdff84e0-ecf7-4b80-9e01-f6029e135c4d", "comment": "Malware payload", "value": "08d6f756102ff50e4ae9d3af76e01599fca9c79de4f09fedb996687ef4b0dd3f", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687847078, "uuid": "93125b52-ed59-4ea0-8c06-8ebbcb57c892", "comment": "Malware payload", "value": "f9e5255c76cb9b2010fb80fe4ff4a04380f116ac", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687847078, "uuid": "c0fd1133-9b83-4d9e-93d3-8e4c50992762", "comment": "Malware payload", "value": "a3084608d724faf01c66f61cbd88a3a71b3fa2d0b1c98ee4204ef3f95b79c9788526f7a2e9d31fdda63dd735a73fefc9", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687847078, "uuid": "96cc47f9-35c0-451f-885f-49af3b3d4b37", "value": "T198852228EA82A91EF85E42711686855A871CBDB279C8DC43368C3B1F5773FA0DD73609", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687847078, "uuid": "00b2e989-cf46-4228-9785-76eb2610a36e", "value": "49152:W13Qg5xElIPwdHY4paqOU491dxNpF6Os4U:W14IUCo4n/NnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687847078, "uuid": "886782ae-d2d5-4225-a7c1-dcddefe42c15", "value": 1725952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687847078, "uuid": "3a05b50d-395a-4794-84cf-1e3df967eebb", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687847078, "uuid": "047361f0-bdba-4673-a737-063eeeb7abbe", "value": "STATEMENT OF ACCOUNT.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96d6f4bf-14b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687846346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846346, "uuid": "8fa5e6c8-103c-44c9-9487-f85af7778544", "comment": "Malware payload (Formbook)", "value": "47862a6458cffe335a6950673530fe88", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846346, "uuid": "909848e0-fe7c-45ac-8eda-9bbb1a54f41c", "comment": "Malware payload (Formbook)", "value": "096dc9d1c1b50a5dfb5dcec64183b2901441b43343308c890b4a82293eb18f39", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846346, "uuid": "c7905452-01f3-4f31-bda6-7d60647d55ac", "comment": "Malware payload (Formbook)", "value": "7c10333ca76400df2368baa11134821d5cd735cc", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846346, "uuid": "272aa7fe-490c-4be2-8cc6-97bc909f12d4", "comment": "Malware payload (Formbook)", "value": "feaf7d44cc50409b344dd4116f5150a420660b6855b6c14289044a944de6524b8a7b61a5a24851736ac3a693baaf54b7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846346, "uuid": "9fdaa365-5c8e-49af-88c8-d5f1dd4ec62b", "value": "T1B3C43360976A4810E219D10CA15BF3EB6CABDE9F7E71FB30CB72F894059C3665A32354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846346, "uuid": "fe15d0a1-895c-4bc4-a925-f6f3fb249a6e", "value": "12288:/76FMeJtbo4DeqDKR3ygBslOa+5Wwt+Ht0RGrT8fnEFFBLFz4Mp8bLS:TOdorqA14sUwt+Ht0Rm8vuFBLFLp8be", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687846346, "uuid": "37d09f8c-03da-48c1-9f89-7a73af674d5c", "value": 565339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687846346, "uuid": "d51548de-4c59-4858-b844-a5c0c61c7196", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846346, "uuid": "9ae10b65-c7a5-4ab7-8579-445d410f8d7a", "value": "Confirm revised invoice to proceed with payment ASAP.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29dc6f34-14ec-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687871504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687871504, "uuid": "9772b494-736e-473b-a872-32a8e434eefb", "comment": "Malware payload", "value": "614a31f01a52c3c9a5819a7962e45c12", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687871504, "uuid": "e57f3734-553c-43cb-ada8-6344855a779f", "comment": "Malware payload", "value": "0b19cf5539a01f2726205aa1e54d0ccfffddf89e64646ea497259f97379117e9", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687871504, "uuid": "538d6554-b923-4cd6-b133-193fcb1865bd", "comment": "Malware payload", "value": "6963479d582314dec49afdfaac5025338afbb9cc", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687871504, "uuid": "c0412482-ff4d-4aea-951c-63b2cc0b7157", "comment": "Malware payload", "value": "ba28d262c00b5e6a2d6196f561a3d262b824ee8f172306f62509d6dc825af8a0ec67c84ca2af06e8956eaf8484e2dc08", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687871504, "uuid": "7bc9749e-74a2-49ce-8d18-3b9847dd1281", "value": "T1DC240243374A9F5BD113163690DA696293F3AF413415938C3ABCEE4FFB227118E42B99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687871504, "uuid": "6155c4f4-4942-4fc3-9f28-f9c839bc14c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687871504, "uuid": "3a218a36-884e-479e-8505-2527eaaf8ee8", "value": "6144:df2LhlbEyEXoFLq1qrSOyoVkeL5T+pwe8watWUjtWU:dfMhd5Zq1qrXyoPL5TQUYU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687871504, "uuid": "ff1c08d3-968e-4100-b199-efc124aee7f7", "value": 220160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687871504, "uuid": "0d988550-cc7b-4c6c-a0a3-5f477d5fa3b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687871504, "uuid": "efc32bb2-fa14-4c2c-abea-f0e290fbe7ad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3b179c8-150a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687884674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687884674, "uuid": "61f276c1-2225-46d7-b9f4-f22754dd4a57", "comment": "Malware payload (AgentTesla)", "value": "ba7bda1cdae0c9fb1d2ab26c20a7ecdf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687884674, "uuid": "b624e73f-b6c4-4ba7-b958-d1bb8cb08def", "comment": "Malware payload (AgentTesla)", "value": "0b4d7a81cb8f89e34562cd756540d3dd62176c0fa829d7dba9db2c727b92aef0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687884674, "uuid": "1fea47a8-8e20-4101-bd8f-ea82416cb450", "comment": "Malware payload (AgentTesla)", "value": "9aea55f1b50787ab704f408146eb076973804ba8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687884674, "uuid": "cd6338ff-cebb-4c1f-87e0-a63f08cbe4e4", "comment": "Malware payload (AgentTesla)", "value": "892935388f1ed79496da3b21ea926ae950d2e7837c13556f7a1a2cc183019112098899d01e6af8ba66caabade7592be0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687884674, "uuid": "e3190d28-2b14-4b82-a349-73b9fdbccf77", "value": "T17BD4CFAC721076DFC817CD76CAA86C74AA51247B431BD243902315EDAA1EAE7CF151F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687884674, "uuid": "6254a7ac-3a4f-48c8-88e7-fd11529e5d65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687884674, "uuid": "18104f3c-a49d-4edd-b398-c1e6ed006b52", "value": "12288:7b/DTqFh03+MA+MIhvKCTagRVuiOHjnIsz+IbLM4Pyw0lpDRNcD8:TG0OMAm/TJaHjIoU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687884674, "uuid": "a2c71de1-a27f-45fd-b85b-6c4069ee0037", "value": 598528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687884674, "uuid": "cd0c92f9-317f-4415-a95c-f51be1f47757", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687884674, "uuid": "ab104291-a16e-4ef1-a5ec-6e946ac6735b", "value": "SOA FREIGHT SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa33fe8-14bd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687851542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687851542, "uuid": "36c8791c-1bb1-43a2-a306-16c5fa58a9eb", "comment": "Malware payload (AgentTesla)", "value": "0fb245812c9774df19a6d4d111758f82", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687851542, "uuid": "5c8ca618-2298-4209-bcfb-eaf51dfc401c", "comment": "Malware payload (AgentTesla)", "value": "0c4fbc2a7b532485b65e5046e3bc7191f479df3fa9d401f3f78cb3d6b47429a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687851542, "uuid": "da405eb8-7680-4c30-ad5c-484da2de7264", "comment": "Malware payload (AgentTesla)", "value": "bbfd5854f15d42fd108e88b9771ad5c4d06c9795", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687851542, "uuid": "a66a6124-8322-4a0a-a751-f51625cd97a7", "comment": "Malware payload (AgentTesla)", "value": "15b89164e28527c0a582844f5613cacc98dd59053880ce59078293df6d7e9a3f6af7cddcd3edb00d86770297581c92ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687851542, "uuid": "04ca29bc-3516-45ce-915b-e3490447ef20", "value": "T127D4693C1CBE1A3BC074DAAACFE58463F440947F39225932A5DB9B558746EA325C323D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687851542, "uuid": "a302215b-37e0-49cc-970b-bd02bc0d3a5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687851542, "uuid": "bc23e14c-f150-417b-ad05-6055aa8a7780", "value": "12288:N2iNds3YEhC4SQyt6A0XOYiRGydz/dMKchKjXMrIvHo5x:N13s3YEhCzRkeYidzlTchKj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687851542, "uuid": "99fe7102-4816-4b9f-ad35-958c270d02fb", "value": 608256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687851542, "uuid": "1ec147f6-eb78-48ab-9ae2-2513ac049679", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687851542, "uuid": "bd584f7f-345a-4d29-91a4-1c574aa6f8d0", "value": "quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87cb6394-14d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687860494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860494, "uuid": "bb30ae01-c3f2-43fb-b669-7bd3b9291083", "comment": "Malware payload (AgentTesla)", "value": "5be6d2efd3d0247e15a728804a5f7be6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860494, "uuid": "6648865d-2a7d-4932-9d37-9e751337eb4f", "comment": "Malware payload (AgentTesla)", "value": "0cdc888b409ace4adadffe371676679ca0e410cf952eb7cbef09945ba83df461", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860494, "uuid": "a4532c2b-8143-4b9b-9109-4db9a639212c", "comment": "Malware payload (AgentTesla)", "value": "44301e12bdb8cfe46aa13e3cf07fbf0d42d0f855", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860494, "uuid": "370cc72a-f0a0-4d92-91a2-37947a404f55", "comment": "Malware payload (AgentTesla)", "value": "cb20627cd5ecf8651757fd16bcae24bc7c9506de1e85c5d67bd8b9e543db227cd95e0364defdff0fed4dba5bdf41d585", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687860494, "uuid": "2419be6d-a5a3-4f79-9353-9c812303b82f", "value": "T1BBC423A809EEC461386863F3A6837BE587D7D00382D58DEA65073BA85EF1D3D1243D9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687860494, "uuid": "0453f506-1d70-4b2d-bcbf-79c06abb18ab", "value": "12288:tRuOrPwzNboEejq3jAksdjFnLo80GS81is/og27ArJh+dqE0YDM+APKn:WvzaJG3jKhF3d1Bf27ANhKn0YDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687860494, "uuid": "9eec3315-60fb-4cbb-b9aa-05d6d4496c08", "value": 545530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687860494, "uuid": "40b9e91e-577e-479a-9cfd-44f617d97b59", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687860494, "uuid": "b6913913-7e88-4584-b596-1eb8d4c9ea02", "value": "PAYMENT SLIP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bfa567a-14fe-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687879319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687879319, "uuid": "b759648e-7c62-47d6-8e77-5fb881531462", "comment": "Malware payload (AgentTesla)", "value": "f84bc707ce518d047488525009d2e2e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687879319, "uuid": "3d362e43-23b3-491c-beb3-f369307eedc9", "comment": "Malware payload (AgentTesla)", "value": "0dabfa3e227b527384975c264952b5b0e532800f87648a31179f2b6841cd8f46", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687879319, "uuid": "73e6ff0a-73c9-4120-96ec-0cbeded521b4", "comment": "Malware payload (AgentTesla)", "value": "f5762a504174bc15b43bf200f1b185b59e700aaf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687879319, "uuid": "712bb8c0-2c40-4f02-b42b-96d3278f0d5e", "comment": "Malware payload (AgentTesla)", "value": "797aa60756817a91a427a89644c0324ff8533a0323196b37840da9d44b1fd9fc69253654f9b5359c0d178c22eea4925a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687879319, "uuid": "749dbae7-67bc-4012-a070-67d92c6b82ef", "value": "T1ADC4F12A32A95E67C2B811FA9051600577F4933B3463F7C95EC1A0EE39C2F8C5B96793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687879319, "uuid": "b194c5f5-5b15-47f4-8b1a-e6c82c2398fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687879319, "uuid": "cb3942c0-96f5-4b0f-ae8c-765c1091ff25", "value": "12288:ft3vyahY7SWDKKWCUULapk4euT6ER4U7saEwRD8CpMc+k/x8IdS:fMahY7ZIhyuT6soaLt8Cyh6x8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687879319, "uuid": "e764c6d5-18de-44fb-b2fc-b9f73ce810f2", "value": 586240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687879319, "uuid": "00164e49-6531-4808-8862-3ca8f8a73da9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687879319, "uuid": "18710038-276a-49e7-a50a-4a2e15eb9bca", "value": "oV49m5sU45Ew5Q9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b628289-14df-11ee-b3cf-42010a9c0076", "comment": "Malware payload (QuasarRAT)", "timestamp": 1687865896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687865896, "uuid": "f2990382-463a-4d86-857f-7ac5b0388cd2", "comment": "Malware payload (QuasarRAT)", "value": "ba9783ffc741e2c9f8318bbb020f4140", "object_relation": "md5", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687865896, "uuid": "905766dd-759e-4782-a7c1-b39d424a7fc8", "comment": "Malware payload (QuasarRAT)", "value": "0eb70a7488f69f9968ef86c6cb29a208bf5e72f1db19197a26457ea343e15fad", "object_relation": "sha256", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687865896, "uuid": "03e15d9a-1c4e-4061-97a0-a2ee764079c7", "comment": "Malware payload (QuasarRAT)", "value": "752a2d2feffe7cf0eca7c2b95a685ab9520e5f0c", "object_relation": "sha1", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687865896, "uuid": "0faef24b-9891-458b-869c-c316109a2043", "comment": "Malware payload (QuasarRAT)", "value": "77d31694861e64d1320378da9858478c938e4765e7ea24ef19367c82435774c71c103e93ecf8efa088fda41fecf9d88e", "object_relation": "sha3-384", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687865896, "uuid": "88955eaf-9776-4488-a704-3fe8db6d069d", "value": "T1AC551202BFC547B3D5B2CA315839A650F23DB0293F269E4E73E8D11C5B36040E6BEA65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687865896, "uuid": "60afa30d-ccd1-494f-a036-6f6fabece921", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687865896, "uuid": "502eb221-5e91-4c46-aafe-bc99902904a0", "value": "24576:wNA3R5drXypaDvpVDv/YIJCV96aVmAA2KS01+fCT5hvfcvXwMsC68qE8:p5yp4htndJCkAAy0ofGvksC/m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687865896, "uuid": "97500559-6a22-4682-8a98-d631dc6e6919", "value": 1318257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687865896, "uuid": "9ff258d7-47b6-42c3-8f20-3eb4061e3067", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687865896, "uuid": "58bacb4b-61ac-42c1-ad5b-8b27743b9b67", "value": "z0Informacion_del_Documento.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d4a3558-14d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1687862114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862114, "uuid": "606818e8-ab47-4446-88cc-5b4f16b465bc", "comment": "Malware payload (STRRAT)", "value": "0a257f1b297660ebf8f981550c5bfcfe", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862114, "uuid": "56dc2baa-f937-4422-aecf-50f8c2ffad25", "comment": "Malware payload (STRRAT)", "value": "10eaa98e8643cf303011d5305ea11337e90fa86dd5ce017c970d0f368465c70b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862114, "uuid": "48c3303f-dd6a-4e2f-b190-8b70cd6b996e", "comment": "Malware payload (STRRAT)", "value": "7b65e7feb8dde2b10c2ba4978df6951cd2c40225", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862114, "uuid": "b31d50f7-ac8c-4417-b455-96b53d3b0f68", "comment": "Malware payload (STRRAT)", "value": "1f1ee976d0172b09bbbfc638fbfd0d2e80f7c073bad8e0b08e27ba26067193fbdbd92a08fe66d5249cba7c508c291b90", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862114, "uuid": "4409e4be-f47e-4f80-a7cc-7b9fd04a0de6", "value": "T15563F14D3FAAD82CD967CC34D058D05B921A6A8FE097E16B0BE0CD6094F0D5B6CB53C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862114, "uuid": "2f67c832-5544-4fba-bf42-3f0a96b83a8c", "value": "768:sfZEarPi5ZQ7IT1yhV9JO8BUIm5UljMSfUZ0vTHFjpnfGu6n5rbEaH33kH/:P0Iq77hVc5ojMPZYlj9GPn5d33e/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687862114, "uuid": "3b3685c4-9e8f-4886-bf77-15fdd5b96fdc", "value": 72298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687862114, "uuid": "16aa6694-bd24-461a-ac55-4a00f095ae96", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862114, "uuid": "a4df45ed-19ef-4d83-a95c-6106ab4f07b7", "value": "Payment 06-27.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d54d42c-14b6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1687848451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848451, "uuid": "bc447fc7-e36e-4023-91d6-a97e644451b3", "comment": "Malware payload (STRRAT)", "value": "42a84baaf9025e866598df4bc433edd6", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848451, "uuid": "4dd29e9e-361d-4608-817b-0e9b13b63d5c", "comment": "Malware payload (STRRAT)", "value": "1144ef0b85c23b61c1258d07cb3778500f071b491cd7b33f1675221983d44e88", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848451, "uuid": "da08e317-26b0-461b-9b4c-f14e2b2c1ea1", "comment": "Malware payload (STRRAT)", "value": "c37488ccc7c7689a139b7975b68f81e159e3aeda", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848451, "uuid": "aa76e12c-8241-443e-b7cf-1ba704962db6", "comment": "Malware payload (STRRAT)", "value": "40984b4a2c75c562d4eac1ef34888712334647d9c36d5a689a1dd93662acf6dcb6012e969ffc6f49cfe04eedd6af0c80", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848451, "uuid": "a2e873b8-d511-457a-a898-6ccea970b3be", "value": "T18D24020E7BE6819AD53B623B410996B7FB3E42E9D461D12F05FC08691D75C6E0B03A8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848451, "uuid": "ea589aa4-e4f4-446f-b5b8-2b4022182899", "value": "6144:KyEqnTq4iv3d9nfLx81V6LTHs+tEFkU0Q0Rs8Oq9LJn+H3:dESmRN9ntaV6Ps+KFWQ0R9Oq9LxW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687848451, "uuid": "97063972-e46b-469f-b28c-3fd752c2950d", "value": 223992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687848451, "uuid": "7aa0f98b-68a8-4293-834a-9162220060d1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848451, "uuid": "4770a843-d008-4068-a51a-225542c291a2", "value": "QUOTATION OFFER REQUEST 1034783_pdf_pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c81f13d-14b3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687847081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687847081, "uuid": "af859c22-91db-47fb-8457-983660b0ede1", "comment": "Malware payload (Loki)", "value": "5b98afae18b7cec16c6c80eb51e083b6", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687847081, "uuid": "1cd0641f-20e2-4e24-9500-0bdc9a7d0202", "comment": "Malware payload (Loki)", "value": "114c218fb3f7751042ddec8ed2f8b711afefd27037a992c30167931197bd56ab", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687847081, "uuid": "13d17204-a1de-43be-a16f-e8227452fb8c", "comment": "Malware payload (Loki)", "value": "b02747cd9e0c160759a9fbcd124f02f901a5a46f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687847081, "uuid": "8b3b5f39-18b4-4f3d-adfa-ce8e8a74201a", "comment": "Malware payload (Loki)", "value": "7c503baff267c6b914b6acdc6774b9dec7eb88ce48e1894882312935deaa4065cae1c4fe09b34fccbf1ffbbb911946a8", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687847081, "uuid": "b21d0083-da79-4f8e-8c51-02f9ccba3857", "value": "T12C852224EA86582EF46A027526878587862DBD727D89DD8235DC3B4F6733FB09D33608", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687847081, "uuid": "3ddc1b18-1933-4b54-9cc6-431f3cef336d", "value": "49152:KR80ANIPA73kAqkycSlF4YvbrPhI2HdKP:y8IeYky3V5LHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687847081, "uuid": "f88eca19-6ca0-43ea-a6f2-1639815b708c", "value": 1704448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687847081, "uuid": "17f81891-ccfd-496c-bc71-68061d90b6fc", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687847081, "uuid": "9135ba65-f926-4b66-a955-70fd2b44ed05", "value": "Payment Advice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b40d3063-14e2-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687867441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687867441, "uuid": "34b9f3c1-20c4-484d-b7f2-1ca3c2ea250d", "comment": "Malware payload", "value": "e10774184cc0b4698bc15d407dbb9059", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687867441, "uuid": "a63f0c18-1d4b-4f08-ae5a-e84aed709b78", "comment": "Malware payload", "value": "115cd2d1057a43285bca372fc1956a9ecdf8419382d96379eb64e1a13a78957e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687867441, "uuid": "17313728-b7f3-4081-b18d-46e5376a711a", "comment": "Malware payload", "value": "19613b75d9d7518faaa51286f1bc4a97a386d7a8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687867441, "uuid": "50de32e5-a5a4-4237-bb66-529ba9b9ec48", "comment": "Malware payload", "value": "8a584a53a6338fac3967d286424c233c5fc4d263201d08a0285eaad2f5340df172c6f206b97ec7251b429b8775e0719b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687867441, "uuid": "e6e3b1f6-eb5e-4958-9f34-5cb40c76a831", "value": "T193D47B8AEBC1DC6BC41503B04DDB9725273AF498A383DF4B27A495382C6376A7F8564C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687867441, "uuid": "7b219117-fef4-47db-9c03-3a42f49447d4", "value": "e9ef9b3a65dd6bf58caf965b2eb31e2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687867441, "uuid": "244faa64-f360-47d6-b774-96534fa2af63", "value": "6144:aQsPjChP/DWxDmFKP9VCUMrex0Ai/k8XFRFj75G/39OXam:Bs7Rx6FKP9Vyp175O9OXam", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687867441, "uuid": "3b0fb4e1-ce2a-4f67-b237-885d2386eddb", "value": 605520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687867441, "uuid": "2d380a12-9255-4f22-ad29-23fb16e8f2f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687867441, "uuid": "ea0faea8-f587-4ea4-9241-4c5abfbe434b", "value": "04993758883(1).dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61993a33-14df-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1687866014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687866014, "uuid": "b94924f3-e8ad-4328-9f67-660b34093964", "comment": "Malware payload (Stealc)", "value": "b6202ee4a70ca4aa8206c60cd667f6ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687866014, "uuid": "526f5c30-a447-417b-b59a-01f0483d80f1", "comment": "Malware payload (Stealc)", "value": "11b25f3ab726bb4d4ba1f692e7e996857323aa55d6f1f017380cd43ab0cc2055", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687866014, "uuid": "6837f515-6cb0-4f95-bc2e-e329a0228b67", "comment": "Malware payload (Stealc)", "value": "c056a0e94991b885e8e14cdf87088a5ad0088024", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687866014, "uuid": "c8c56f3f-b2f6-4a11-bfd8-1df62c92ff57", "comment": "Malware payload (Stealc)", "value": "6da99d880f572dcc58fffddbd8edf4b1f52a7203e125f39a47297b11fcd57616f437f3fb205da03f1559a19690fbaae5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687866014, "uuid": "2d916370-6b90-4000-8791-d369c92208fc", "value": "T1FBB4B5515CC06BB2D30616327C49F628F710A4E6CB997FE2A06A696142DF4F70982FFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687866014, "uuid": "fce2ae9e-5ea4-4947-a690-b57e7db56843", "value": "d71677af3ef3621c6cfc37dd495823e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687866014, "uuid": "4ab02111-4df5-4294-ab44-7022006aa287", "value": "3072:9t8QSF0XCe6GhHzaSR/sTJXbzRUbdY2nFxVRvpthySn/+TPto:9yFOtzaU/s1bzR18FtJy0/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687866014, "uuid": "4baa2082-ad42-40ee-af62-7bf501b0f17c", "value": 500233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687866014, "uuid": "35ff7527-da4a-44e1-8652-7d697186c46f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687866014, "uuid": "96c00704-19b9-4d13-bcd2-95fe44273b65", "value": "b6202ee4a70ca4aa8206c60cd667f6ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e56cd2c2-14c6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Chaos)", "timestamp": 1687855498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687855498, "uuid": "df53662a-80b4-4551-a4e5-66bf6e09bee1", "comment": "Malware payload (Chaos)", "value": "d26b2c8fc07cb5c72bfc40779f09d491", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wagner", "colour": "#9B7AF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687855498, "uuid": "9ae60fae-0ac7-4e7e-8898-6a859c119f73", "comment": "Malware payload (Chaos)", "value": "1238ab3dd3ed620536969ee438e99a33a418ba20f5e691962ed07904e075b2a4", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wagner", "colour": "#9B7AF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687855498, "uuid": "dfe29ed1-c09d-495e-b310-d3b6961aeddd", "comment": "Malware payload (Chaos)", "value": "8ee7fc0171b980aa93b687e334d1e29a8d634085", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wagner", "colour": "#9B7AF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687855498, "uuid": "443cce08-2af2-410a-9e1f-c2564b1f1b3c", "comment": "Malware payload (Chaos)", "value": "16a755544b2ee97b4eb8392dd188f52d4e969877e8c1fcb26e0ef2663f100fdc3bf001a550cb4dd918c7dde7772e2477", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wagner", "colour": "#9B7AF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687855498, "uuid": "26950c68-bda2-4854-8145-e2f12f7a533e", "value": "T1F1643C243DEB9029B273BF665FE8749B9E5EBB333707A4592051034A8723E81DD8163D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687855498, "uuid": "c1d60dc5-cd8e-4e14-92ce-ffb77fe3162d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687855498, "uuid": "15d6e889-d5c6-4af9-a318-15e74eb70c9f", "value": "6144:6r90F/rW+jyJ8ce0fASQFe4HNq4nJI2YPkuUDItcv7FL0pv:d/rxjyJNe0fAfe4HN1nJITPzUDItq7F4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687855498, "uuid": "d029e4d0-a5e8-4bb0-ae51-0556ff2c8d28", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687855498, "uuid": "7aa20674-e982-43ea-aaac-155d5d891b1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687855498, "uuid": "4b8f85c8-0eda-4f91-ae0e-0b882c8326c9", "value": "WAGNER.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b8ee2de-14bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687850542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850542, "uuid": "8c7e8706-20c0-4fe9-bd06-de5c314d4158", "comment": "Malware payload (GCleaner)", "value": "1b34dddb3b17173cafc2f89676881afb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850542, "uuid": "93272c79-bee6-4f0a-9ac3-d76de809e5b0", "comment": "Malware payload (GCleaner)", "value": "126309b4dfe718dc824c160742c36a02c1d47bc1fbb8e002249fe3a3c64f06f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850542, "uuid": "62463bb7-d72a-43f4-8d15-d609440caf54", "comment": "Malware payload (GCleaner)", "value": "59184c76af7a99e20628b513fefe01b68156edd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850542, "uuid": "56845b0a-587b-4e39-8163-c55ecb6c233a", "comment": "Malware payload (GCleaner)", "value": "c21e71764babfa44f8ad2add9c9b440e2ae03a3aed454861d22ad2e5dcab0ec1a302c547ee6db8254258e64180ef3cc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850542, "uuid": "3be70954-4e21-4480-996b-84ec0c5cdc71", "value": "T10E44F1223990CC72E469B134C831CBB55B7F79225B60D6C777B8237A6E213D16A3439B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850542, "uuid": "78bea605-1c23-4b2c-b3f9-7fed5930b925", "value": "376377f5a15a805427033df7a4283189", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850542, "uuid": "ca750eb0-94e2-4a00-bd12-fc46915c3377", "value": "6144:edP0IAnzsLJNks1GGi/DSv++KBbzSwa8ehJR:wP0WpbR2+WoZvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687850542, "uuid": "4d52e2d9-1538-4fd1-9e9b-3bb83a3ce252", "value": 275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687850542, "uuid": "0d6a77e1-2473-4a30-9351-aa9a319b23d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850542, "uuid": "ea194253-4fb0-4248-9122-c168e7aa3f27", "value": "1b34dddb3b17173cafc2f89676881afb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c73ab21-14b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687846302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846302, "uuid": "deb143d6-0d06-4b6e-84fe-247ffe033352", "comment": "Malware payload (Formbook)", "value": "17e115f8b79b890d94db681eaf06c6da", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846302, "uuid": "fdb5982a-24b8-4953-bddc-5d0f5839b9d9", "comment": "Malware payload (Formbook)", "value": "12d89792f1be2fbe23ef1bbd8056a71aa251ed0e3b77291b26a0f8f1f7e4f12d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846302, "uuid": "60b42b9d-9f55-4dce-9cbe-745a991ba3d9", "comment": "Malware payload (Formbook)", "value": "75aea71a0f1a18bb8990f295284712d955e2e403", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846302, "uuid": "d75464b1-fff9-4492-b65f-4d37f3d6270b", "comment": "Malware payload (Formbook)", "value": "530190062fdcf725a3cd7901b21d0cbac627104d6e2c8dde2e3e327b8e98ddb3c7774d5ec468a97c799122574f2c27db", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846302, "uuid": "b6e52d34-d8c7-4fd4-b812-b64363244c34", "value": "T1BCC43360976A4810E219D10CA15BF3EB6CABDE9F7E71FB30CB72F894059C3665A32354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846302, "uuid": "b1dbafce-0f8d-416f-a6fb-350252531ca0", "value": "12288:l76FMeJtbo4DeqDKR3ygBslOa+5Wwt+Ht0RGrT8fnEFFBLFz4Mp8bLS:5OdorqA14sUwt+Ht0Rm8vuFBLFLp8be", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687846302, "uuid": "59460f86-0ff7-4c86-81c9-f6350dbcb2b1", "value": 565322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687846302, "uuid": "be838bd0-bbe3-4c6f-a56d-6461445ace02", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846302, "uuid": "ed2ca521-bb2b-48ef-b3c6-6fb5b6a919eb", "value": "Mirus Packaging GmbH Purchase Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5abb0170-14d8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687862996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862996, "uuid": "6ee4bc31-54f9-422b-95c6-177b7adb54a5", "comment": "Malware payload (Formbook)", "value": "b50509471fed91aa953562847d830eec", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862996, "uuid": "8fa19297-de0f-46b3-bb6c-611d176275e9", "comment": "Malware payload (Formbook)", "value": "132c5242bb6815196b6fba93d32a22735d406b98b0fce6d17e618f3aac192645", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862996, "uuid": "f8241f12-82c4-4256-9de9-5fa91d1f4a2b", "comment": "Malware payload (Formbook)", "value": "3566e4a2937ab0c765edce2eb59d23d5f384673e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862996, "uuid": "10cea1cd-0726-427a-a6a3-0272a03c11a5", "comment": "Malware payload (Formbook)", "value": "c4f1699c0b90854107bc1720acb05147ebe9c99448d49a5f13ef6ae5c164ed3df1bb3b77fc5fc11e25e1fa01a46ee105", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862996, "uuid": "4262b352-0e14-443b-9b12-ca6501011896", "value": "T19BD2A35AE79F03B84B910272671E1AC9AB3DB13D735055A134AC933433A9C3D46B6AFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862996, "uuid": "5b35a699-2cfa-4916-8b39-b22bcda96782", "value": "768:kFx0XaIsnPRIa4fwJM4X7V5UA+Ea+qPnAFV:kf0Xvx3EMQR5UhEeAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687862996, "uuid": "2668e967-0d0e-403c-b8a9-7c363a2bb254", "value": 30059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687862996, "uuid": "da6bc812-6199-4565-97c5-6ec4a175ecad", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862996, "uuid": "1c3f044c-7bd2-40df-b0ed-2e1e4ec52893", "value": "PO#28730.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "710b748d-14b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687846283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846283, "uuid": "8802bf31-9715-49c0-ac9c-cc6a978a1d73", "comment": "Malware payload (AgentTesla)", "value": "60b6f95fe769ad4b6b5f107d74a1be83", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846283, "uuid": "2681cce1-505f-4f59-9ee3-b298335f1694", "comment": "Malware payload (AgentTesla)", "value": "13f9323c1d2add546dd6475467ddafa78ba1cb86c6d6c590b9b0e1ab5da9e203", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846283, "uuid": "2f6e10e9-2337-4750-ba65-ca11fdc45190", "comment": "Malware payload (AgentTesla)", "value": "63b371b3128989fec27709c98ca9e2b34b6b37b9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846283, "uuid": "4f0105ac-2893-421a-bc51-8be82614c8a3", "comment": "Malware payload (AgentTesla)", "value": "691f4540e4435a068fe100ae222bfceb75e1fcd42e8abdd9883b695221da4d83996cf0f0012c5502137011c6a1594b61", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846283, "uuid": "90688efb-2875-404f-a477-6881ac47590b", "value": "T15DB42378B924C8167818F5E8598ACB78F06347447B74DD8C29341B1C3E9FA76EB3A364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846283, "uuid": "db2f9257-faff-4d77-b49e-de386b54166f", "value": "12288:8E0E54qr7cC/hBCpJxW7B2BGRf+qNG3S9nVF9:80vV/hYHxsB2Bm+qHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687846283, "uuid": "cc325fa2-787e-4825-a4b6-2c4c605b0ee7", "value": 521630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687846283, "uuid": "a469039f-ab69-4304-94ea-d255e2e1d68e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846283, "uuid": "3ce0317f-71bf-4e2c-a703-6da61c7dd296", "value": "PO-230102 .pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24a0e7d7-1503-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687881373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687881373, "uuid": "6c0b85b8-4516-4e5b-ba53-9dac1657c5a2", "comment": "Malware payload", "value": "4527683bf1a4b6727c549a1dd6b2cbf1", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687881373, "uuid": "cdaf3973-b2ed-4c4c-acf3-d1716d92dacc", "comment": "Malware payload", "value": "1409ba59ff4902e0fd699dc6046a1f4b4cb164efcdc7725e1cb5aa4865ca8507", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687881373, "uuid": "105d22fe-aa36-4a4d-abb3-4ee8859ff666", "comment": "Malware payload", "value": "06f71942ebfea471add9c252f5da3a928c69d0d3", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687881373, "uuid": "1fee71ad-050e-4542-a897-27ed70e29e23", "comment": "Malware payload", "value": "a1b157af9f9854f6ab8a201e50c66fb318393ea10f9dc7897e93059a398783fac8acee6680af8da7f51543fce0944aa3", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687881373, "uuid": "a2036640-8978-4c6e-9bd9-553873a1da5b", "value": "T1AD646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687881373, "uuid": "fdf72998-7246-4e45-977c-635d6c795b25", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687881373, "uuid": "9b7a8919-6551-4e2a-9303-6e3c9afe6bd3", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9mi:5xb8ZqekwkJPaThgyDChXohRRwb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687881373, "uuid": "abb186bf-992e-483d-990d-d405da4cf774", "value": 320521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687881373, "uuid": "5a8d6890-557b-4691-ac50-28c569c5aaea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687881373, "uuid": "bb3d9310-e9af-4d4b-9e80-ba2342578f5c", "value": "4527683bf1a4b6727c549a1dd6b2cbf1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04af9260-14ed-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687871871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687871871, "uuid": "e19c4a07-48de-4e6c-9f6e-7644b787c1a6", "comment": "Malware payload", "value": "ff2b285869c9ccf61176cc520624b5b1", "object_relation": "md5", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687871871, "uuid": "56167e9b-6cce-4ec2-8bc4-776a2f053297", "comment": "Malware payload", "value": "1604d4c94a771958e003922ad598f8f5292b52a6faf7876e46bff93aab7edfb8", "object_relation": "sha256", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687871871, "uuid": "c792baea-a9e3-4a07-aacf-3590fdfaa6aa", "comment": "Malware payload", "value": "390f49dbb96fad0e86d23f1b65e6eeefdcecdf4d", "object_relation": "sha1", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687871871, "uuid": "629a0a16-1a37-4aca-ab7e-7d0396784745", "comment": "Malware payload", "value": "6d620f4a2b71c6fa5b07b601c183ff4b734e2b4c8569e7223c42b8cbf4b9a5551016ad0670a642700a045a8bebeb9604", "object_relation": "sha3-384", "Tag": [ { "name": "DiskWriter", "colour": "#5031A1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687871871, "uuid": "8a8c3098-5138-43ad-ae53-e2b359bfa42b", "value": "T1DE235B07F6E28C39F0619BF85C34D6D9FA37B8703D792269A7645B8D8C1A2D16C98343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687871871, "uuid": "9a826523-32c7-4627-9d54-6fe22078680e", "value": "a2b96e12aa05e9f60d575273de7317dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687871871, "uuid": "ef443343-f1d3-457b-a58a-dc9ad0cb0f81", "value": "768:9yLqzcQ8zwtHEBbGoaPbs9IKRQ5qo2GLQdJzF4ztOyjg5YCtKO:cLqzcQ5kJxWpKRfzdJkIyjg57K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687871871, "uuid": "ff178316-1bf9-4e6b-a215-2d7e060c5eb5", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687871871, "uuid": "9fbaf0d6-d418-4e07-bb19-fee5cbf0b914", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687871871, "uuid": "516c3dca-b313-4496-a0f3-127b20554fd5", "value": "Virus.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c62e06b7-14b6-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687848573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848573, "uuid": "b5658c96-e2e2-4805-8c32-33499a570d8f", "comment": "Malware payload", "value": "da0989eecc06944ccfe3de41cbfdd557", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848573, "uuid": "41168d85-fa6b-4f2a-aff9-a860f30e8ad8", "comment": "Malware payload", "value": "16263b8e0929dc8324169a3043e67fe3c1dbbdd737e8c07ea49fc63effcd6ec8", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848573, "uuid": "29092423-dc63-4f3b-a999-581a46a4caf9", "comment": "Malware payload", "value": "b342f5fe7c0cacfffc48a097cc78c623a2f264e4", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848573, "uuid": "55a5f410-914e-4a51-b250-ee27d3750509", "comment": "Malware payload", "value": "94a7b5a38525ec6d99641adf2387bfcd480f84696e5e8fb95b4d8c3133ac69f3528bd6eb42ccb275263e061449c70e42", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848573, "uuid": "3c0f7f45-7a2c-4cf8-bccc-877f30bd9109", "value": "T11774890267FA1108F2F32B49AE7645784A37BE66697DC55C418C290E0BF3E44CDA5BB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848573, "uuid": "9cc85e5e-a4d6-442b-ac49-92eab42538aa", "value": "3072:FRr+dxPr+9gr+Ejr+gMSlctO+Jxq3udcXCIw5n5s5XNsnY+Tuia4MEMxzaklCbvK:8lcpnR3MxzakJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687848573, "uuid": "408c70c0-6d1d-4e45-b45e-ddb0921aea3d", "value": 356916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687848573, "uuid": "34113f7a-21aa-4902-8714-240ecad63a19", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848573, "uuid": "de90c885-b3ad-4e17-bec0-2644bf6d298e", "value": "8301_662_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e9ecf17-14bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687850466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850466, "uuid": "e66ff720-2d7c-4948-be28-60008027752a", "comment": "Malware payload (GCleaner)", "value": "26fe34be5bf7495fbfa16b029af58de5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850466, "uuid": "23a98500-a9c5-487f-8661-c1c409c5982d", "comment": "Malware payload (GCleaner)", "value": "16468700b0a3e499513e7ccee0c95a3665df63f3cc657e48e073b4e07a798e1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850466, "uuid": "961f86ec-df5e-4f89-96e6-da727fc6ac39", "comment": "Malware payload (GCleaner)", "value": "6495a9b8c036391e1ea9e3932e5d3647b1c4ca18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850466, "uuid": "0c9d0e68-d3bc-4169-a4c1-31b907b1275e", "comment": "Malware payload (GCleaner)", "value": "503b8fab8ffaffb7e60c247e75a9befdd2d663de48ce0842bfe63e33297524e17b46f2ee4eb12730d145a66d28b5ae7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850466, "uuid": "58aaaea7-1ae9-4852-98da-dba6f0258916", "value": "T1A6649F0352A03C91FD255B728E2FCAE83E9EF6504F597B9522685A2BC9B11F2F133741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850466, "uuid": "c5ec5010-c717-4998-a950-85e2ee17e9d5", "value": "2374c2e3effb7cec5b64d024cc2c8613", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850466, "uuid": "5dd92b8a-3855-4585-96e0-6799444482a8", "value": "3072:M+H6rkZEIVuPZ/gkUNh/04QHmWack6uT+7co7pXBjsI5TUeHDlPwiIBRMqaau:9H6AZTo/fUj0/GWaFc7v1BjTTNDlo2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687850466, "uuid": "05bb9a6a-3640-4b67-9b36-3f5678a36369", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687850466, "uuid": "6c7f86e8-ccd3-49eb-ac00-1e1c1d146d30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850466, "uuid": "9e15b9f5-af4e-4a6a-b647-00e29d5a0ac0", "value": "26fe34be5bf7495fbfa16b029af58de5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e2b1d33-14e9-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687870384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687870384, "uuid": "9dcc405a-2df6-4295-9cdc-337aae68ed3d", "comment": "Malware payload", "value": "cf201e0e386dabf6d3f703a1c5376fef", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687870384, "uuid": "88bd5f74-4f62-4e8d-b8ba-828536fb350e", "comment": "Malware payload", "value": "17433cdd6514a928c181fb197997edfec0bd4f5e998a92c94577448f675d297d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687870384, "uuid": "1d224944-a2ba-4744-bdf7-ecb73d333cf1", "comment": "Malware payload", "value": "dd2803a62832b10653089dc76a16f897fada061f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687870384, "uuid": "250fcb49-75e1-4348-a002-795dcc863bde", "comment": "Malware payload", "value": "c5aa94cadb796eb9436a663cd0c9a44bce1e7f02c57f70805cd67121bfb5b07c0f4038a5e85a7f37ca0be073927097b6", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687870384, "uuid": "2b544973-4bfc-4929-999e-2dccab83ab92", "value": "T15454CFE0678498E2DFDE57A7A1195E8D1339207FB98A14CC1046FBE93BBB7018E0DC95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687870384, "uuid": "73b99db2-8601-4ee2-ac85-99131bff6c99", "value": "6144:ngPggmOvXjb2VVy0WzK4gppJTb34jYy+HWZfmUpvZw:ngUOvXjboVIG4Cv4syY4f3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687870384, "uuid": "0c409176-687d-4bf9-9d98-85f87d9e4d2e", "value": 296979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687870384, "uuid": "218b796c-48d1-4404-855c-170dfbbba98a", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687870384, "uuid": "68409253-0ff8-4378-95ca-b894bedb0847", "value": "OFFER -MEGATEK-No.129099.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2427690-14d3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687860968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860968, "uuid": "bd180517-36af-466f-8f83-7c9974881381", "comment": "Malware payload (AgentTesla)", "value": "1a6a8f045ec98881900ed47e19c9923d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860968, "uuid": "47579eec-a3f0-4dac-993b-a18def8eefd6", "comment": "Malware payload (AgentTesla)", "value": "18b6a73808a0524c95b724475d46aca3e42874de551a0fcf7c8d56aff23f105b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860968, "uuid": "c0312270-b944-4d54-9ecc-340c7039d713", "comment": "Malware payload (AgentTesla)", "value": "f4f5a8b728db4351f56dde728c9faf2f73b8563c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860968, "uuid": "a20171a1-51a7-44a0-8d88-9fce7c213b5e", "comment": "Malware payload (AgentTesla)", "value": "18ee51a8986046f1a64357bc7b583366946761f1927ef6ea773364b0d3768e8dca7b1986af749ef8b837f9d6003f57fd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687860968, "uuid": "864d38f5-9430-4cad-b3fe-63b473a57c27", "value": "T18BC4593D1CBD2A37C074DAA9CFE484A3F550D93F39219932A8D797954706EA224C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687860968, "uuid": "4d0f5616-76aa-450f-9c05-8f8d8669e093", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687860968, "uuid": "a73aded8-c50e-4770-87e5-7db02c09f8a5", "value": "12288:WzJuBKeya4yBkA2k9P3Pg239t3gmGbeZh1WHSFpuO:WzJuVJl79n33LcHSF4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687860968, "uuid": "052cf8fd-fd37-4445-a4b6-56951fef0a6e", "value": 587264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687860968, "uuid": "511445f5-cec3-4472-bdcd-b1c5ea784dbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687860968, "uuid": "750107d9-2333-4071-ac35-a10510378b08", "value": "ORDER 80470-4-6847584 2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daf96fd7-14b2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687846890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846890, "uuid": "392446bb-723c-4f8c-a775-d6bea0632081", "comment": "Malware payload (AgentTesla)", "value": "7a0862730aa69695b2fba21a9482eb49", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846890, "uuid": "bb9cdddd-c79b-4903-af1b-f186a2a84706", "comment": "Malware payload (AgentTesla)", "value": "1bb064a2e748a234a98ee29231143e4f40d4ffc86e2bd4fe812e168214935a25", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846890, "uuid": "a46e5063-55f8-4625-ae6c-ebd67534ebc1", "comment": "Malware payload (AgentTesla)", "value": "6d6cab193c5af00989b412813fb7726e0590ebaf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846890, "uuid": "18382b86-dbe3-425c-864b-519aab3951d1", "comment": "Malware payload (AgentTesla)", "value": "c374dd76d1691fae490b41373bdb8059b8988fbe22fdbd1a86b96b4273a25f64721e2fe96c19c9fcca926335817e5607", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846890, "uuid": "0a4b993f-e836-47a9-8054-01133c2b0876", "value": "T130035C5EE78F02648F9112B7171A0E899ABDB23EB35141B1386C937433EDC3D46666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846890, "uuid": "19022777-c209-4699-a422-bf50c2045779", "value": "768:tbFx0XaIsnPRIa4fwJMEBfms/+sp5pgmM5cTu6ep/XWkNPYY3:tbf0Xvx3EMEBfmODPM5cCP/mkNPt3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687846890, "uuid": "f9d11a5c-8d25-44e0-91a7-4c237125e644", "value": 40425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687846890, "uuid": "d37d0053-6aca-4612-81e0-c390df7ea42a", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846890, "uuid": "0332a08c-9262-435b-a5fc-1d275f61cf66", "value": "987657SS26.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd4faee5-14dd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1687865416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687865416, "uuid": "d88a1b1c-d39a-4825-a60f-f002ff9465f1", "comment": "Malware payload (RemcosRAT)", "value": "02e54d58ef60f52a40e1dff3c5aa756d", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687865416, "uuid": "2afe46e0-138f-4808-92a7-362cbf804545", "comment": "Malware payload (RemcosRAT)", "value": "20d6b4781904d93104efcdc760eb6809714c3eae777fd098840d54008d301f7f", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687865416, "uuid": "f2c6ad38-f95e-4bee-8435-8df1b67c2de7", "comment": "Malware payload (RemcosRAT)", "value": "f7d15870d2565a64c800354c2a7292e94f9aa78d", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687865416, "uuid": "9746d61b-90f3-4ba1-bd25-19bf4dcfa843", "comment": "Malware payload (RemcosRAT)", "value": "50548306dc770a4d133d05b368975089932f2cd10b907f716fc7f3b2dc3c5477f7abeca0fc826e7f65fae8c2181b0593", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687865416, "uuid": "f88d2e6d-e5ae-4dd6-a6ee-1f7e58169391", "value": "T1A305339A130FEFFAD2C612ECEE124D542CE21A0E08F5265A2653667C3F5324D1AD39F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687865416, "uuid": "49be1bc1-c5b2-402d-8f6e-c7721e2f6872", "value": "24576:Dr25rv16TBdjmSyhIH+8MXjWPEinzRW0VWO+hR7gI:0ml48MXjwtWsW5d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687865416, "uuid": "162e13ce-d291-4cd3-ab22-c62f01ea0fa2", "value": 860604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687865416, "uuid": "c3c2dfce-b487-4d41-80bf-14b9a6e41356", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687865416, "uuid": "8dadd9f8-0356-402f-a2d3-87b3512bf793", "value": "27-06-2023_ PDF_00233466115969388.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fdca550-14b2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687846549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846549, "uuid": "78f4d23b-2662-4e9a-888c-915554ba2f80", "comment": "Malware payload (AgentTesla)", "value": "340abe0007e32743fc701080d3c4a7e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846549, "uuid": "575e5e06-e43f-416b-a37d-5ae03866d1ae", "comment": "Malware payload (AgentTesla)", "value": "22c4b05bcf26647a2464500666ec31c235599a73765d4cd3452721eb2cf2b020", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846549, "uuid": "7b9041fb-eab5-482a-87e8-10984d7c0ddb", "comment": "Malware payload (AgentTesla)", "value": "2aff7c4bc5baba90c871513a1d5f9e17e2846b8f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846549, "uuid": "4240ab4d-5c0d-4e74-a809-cdf1c791be0a", "comment": "Malware payload (AgentTesla)", "value": "36760509386f2782ba21ee257f9540e9997c33e6ec7ab6ae3b0ff7fe3500af73b727c5af470010097a91e2584beba604", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846549, "uuid": "c28190bf-ea4e-48c7-81e1-68fb9c0edf96", "value": "T1EDC4F19C369072EFC467C9779EA82C64F620B87B930BD613A01311AC9E4E697CF155F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846549, "uuid": "4c47fb54-ea8f-4f5d-86f9-86a2ed45700e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846549, "uuid": "85efa62d-ae20-49b0-8c6b-548001921812", "value": "12288:EFtpAq2iNCXqf52uanTd0ti5ljWBw+mmewtzDrEj5C1F5bxKqo1a:EFUq1kXkYnpf5Em+mFazD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687846549, "uuid": "e85deb40-0ddd-452b-a495-175839d47625", "value": 592384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687846549, "uuid": "63e7613c-b2dd-4674-968f-6519abb612cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846549, "uuid": "99233055-8e4b-46f1-99a8-3cfd46d43b28", "value": "CTM REQUEST BIRTHSHIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2752c2be-1503-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687881378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687881378, "uuid": "023cb0e9-1101-4904-a1c0-d39a6f5f0fc2", "comment": "Malware payload (AgentTesla)", "value": "4533b49ce0a3180c1779db32a63aaeba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687881378, "uuid": "ba121f86-b26e-49c6-8865-e07cf3e95a6f", "comment": "Malware payload (AgentTesla)", "value": "25277f616af1f7335329651071b68e7c202f7cf32896ab437cabe5a32c760a9e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687881378, "uuid": "ffb2d2ee-6aba-4f12-806b-c650dd24de79", "comment": "Malware payload (AgentTesla)", "value": "03a420e47d6f58d0e3d6d6c76af3420dc81313f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687881378, "uuid": "e4d48e31-4f31-42ca-8e78-8c4cbe819c72", "comment": "Malware payload (AgentTesla)", "value": "b90dba248a3a644ce6d68ac7ce2811ee3f45c8531a434e18232d388807112c6aa22d875c0128d396196e05e738bd272d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687881378, "uuid": "e6909f9b-ad82-4942-9fdc-8354b658ceb0", "value": "T13E0582BD29402E97D475E5B2C263088DF67F7032BF138D6B26D652C1862652E37ED80E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687881378, "uuid": "fc729b0d-9027-4133-9857-4c419552f649", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687881378, "uuid": "0d8f83ef-0110-4e81-98a2-8cd165e6fffb", "value": "12288:Vv37AaypPsLxWPMOXYqttmlaoMudaCpJUerZsJ0T55:lA5pgxWPJXPtmlazWauJUeru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687881378, "uuid": "51728dcb-4ee2-4651-a9b0-69c4553c0972", "value": 864256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687881378, "uuid": "ece9ca3d-c760-457d-b67c-e2fab93f1f4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687881378, "uuid": "c82c4cdd-3bc6-46ad-8f30-f9f87fd15ad1", "value": "SecuriteInfo.com.Win32.PWSX-gen.32375.31243", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc4cdd92-14d7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687862784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862784, "uuid": "9e4d8588-fe12-4dcd-b44f-9bde857fcf2e", "comment": "Malware payload (Formbook)", "value": "e4f27611074ee2528b4ec94d42ff3086", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862784, "uuid": "df93dafb-b4cf-4851-b6ed-0ebb20ef9e91", "comment": "Malware payload (Formbook)", "value": "276a229b8dc54203f9009eb1d2f50d391e16ed1831463687627fe89174a4ef9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862784, "uuid": "f87ee150-cf33-4c83-b982-195b40e8862f", "comment": "Malware payload (Formbook)", "value": "3a1116d1bf470552bef7646db02fbd8a4d53b308", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862784, "uuid": "163837ad-2cd2-465b-999b-0fb110e05016", "comment": "Malware payload (Formbook)", "value": "1943c3b50652c970b1f4dbcd74f2fa9e21f7342ea8b201c58c9a0fcac43c349efd32320401e6464aa5d73d35bc37c5db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862784, "uuid": "da5279ee-eb12-48c2-b230-589acfa6d70b", "value": "T1A3C4121138DC5F6BC5AD08F8A4202A5E87F635233981F3DD3DD2B5DAC0D7B852626897", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862784, "uuid": "23f13ebe-ac03-4b43-9014-ea9df8b7319b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862784, "uuid": "f6c19bbe-efd7-4e83-a659-ae128344d907", "value": "12288:s6X4yNCV8mmAyt62hPslW3EIPdUd6J83FUSBsIL:/XCVnmQueW31d4b11BXL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687862784, "uuid": "6a31f080-06a5-4204-9800-f89001c4302b", "value": 551936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687862784, "uuid": "fb5c9739-c61b-43b2-ab0d-21bb56dd6350", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862784, "uuid": "eec342c4-b385-40ea-95e9-e74a948e29b0", "value": "Mirus Packaging GmbH Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01f74af5-14de-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1687865424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687865424, "uuid": "50bf7c0f-f351-4604-8578-5279dddd0a97", "comment": "Malware payload (RemcosRAT)", "value": "82cd04029bbe5b5b71952f9c791fb0e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687865424, "uuid": "14f419f2-cfa6-41f8-af13-adbcb6846c11", "comment": "Malware payload (RemcosRAT)", "value": "27d99e06337e063a46cfb61b27c583311fea46bb77b22294407825c9ee1887a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687865424, "uuid": "d3d06b2f-6e25-4488-a179-0e20253108a4", "comment": "Malware payload (RemcosRAT)", "value": "8f6fc724fa52f311e0b4ab12dcc54c7c6f7538c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687865424, "uuid": "a67113c1-c4f8-4831-9370-bdd135d8a6fc", "comment": "Malware payload (RemcosRAT)", "value": "d8e60f22a7afe307fc55a91252cc8698becb2df6c95bd12d68530a20d97f831a0f2951aeeab6b60de0e021a27a43c891", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687865424, "uuid": "a9eb02f0-c055-4046-acee-4101bede49b1", "value": "T1A90523492359EEF7E5D212F8DE321B202CF6560914F5220B27036B6C3F632495A97BF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687865424, "uuid": "9ae712e0-9955-473c-81ec-a54836c48ac0", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687865424, "uuid": "f04793a0-a399-404b-81bd-8aa3acf4813b", "value": "24576:ZYD0cvp6FB/jIS8DIH+8IXjWFKibzlWCVq8ihRBgJ:mozXW8IXjsFWOq1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687865424, "uuid": "94d5935e-de41-499c-be24-96a760eb78bd", "value": 874246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687865424, "uuid": "3b6c46c7-6e50-4e8e-824c-8ab70cf1b743", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687865424, "uuid": "b4cfa484-128f-4af7-ba04-b58e1bf4043c", "value": "27-06-2023_ PDF_00233466115969388.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81f94edd-1523-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687895274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687895274, "uuid": "2d0c9324-070a-4a15-ad24-b127f01dab55", "comment": "Malware payload", "value": "e55683d061bb823c5ad9828c506f8c54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687895274, "uuid": "1a361e91-8201-4ee1-a1cd-66b5309d1411", "comment": "Malware payload", "value": "291cd51d8323f339f3c97ea088d30fa0f4e37778ad1c2c36943f46db28d0c2f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687895274, "uuid": "5cee0961-f392-4646-9294-f4d392df2d79", "comment": "Malware payload", "value": "bccb0dc03d26f969bd38c58247bd656544609a4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687895274, "uuid": "32f6a00a-c7a7-4236-b379-742d18258878", "comment": "Malware payload", "value": "1dcdc8932ec4c465114bca1fe70f5134ba7da2b57bb105ec54fc8776e46864967eb8745d4b68f89498d6374b1351137c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687895274, "uuid": "34d67056-8e28-4a18-ab32-5f81f5b8a0ec", "value": "T17F55E101BFC4CD10E2B14030DAA45A4ED775E6632662CF5B77DE761B0F76E80A943A8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687895274, "uuid": "9d5bb9be-a71a-4ebf-be9b-08f909533643", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687895274, "uuid": "6afbb5cc-5152-49c3-9a54-99d7c89717cf", "value": "24576:O/3McAn36SCCf16qY9SMlHnmDAO69NO1F6eQ+1BLHgZpJkq:A+3TbsZlHiAO6XO1F6eQ+vLHkJkq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687895274, "uuid": "09f649e1-5f16-4767-b3de-34ce224eb589", "value": 1297568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687895274, "uuid": "8bb923aa-8412-4879-90f9-86d4280eb285", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687895274, "uuid": "08bb964a-9887-44a1-97bd-7a93ed0ef3ef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38d22b70-14bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687850483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850483, "uuid": "56544fe5-fb84-4740-a7e6-bb41d90a1a09", "comment": "Malware payload", "value": "cafb62ef0721ebb55a8dbb37c9716477", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850483, "uuid": "fba21b50-625b-461a-8430-9da83b66b381", "comment": "Malware payload", "value": "2a965fc82c9dec2cd7e2bb3e3e7f010b2db0b4dca9bcf379aafd79e0a9b535b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850483, "uuid": "94eb3dbb-524c-4983-b3d7-5d7ffcbd71af", "comment": "Malware payload", "value": "41951c76259cfa036551a8615dcbe50e63ef790d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850483, "uuid": "a4308a55-3d55-4d40-9ebf-a7d7cb2dadc9", "comment": "Malware payload", "value": "be7e9afa463e661b867408e00d79c07e6e88961abdcff1e22dcbfdc5e242523366b78b0b7b970712515436ac34227e5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850483, "uuid": "0893312e-0a94-4ea9-baac-fb330de434f4", "value": "T15066E022F6924C72E5B30A318A2DFA74B5BE753C47348DDB67884F2839215D19533B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850483, "uuid": "f23324cf-ae5f-403d-9a53-9932ff16be8c", "value": "fd51f71acadc8155d051b22b30677421", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850483, "uuid": "5d48b759-a253-4359-95cc-726753744ecc", "value": "196608:XgmVa54pPwo+yqgvdC8kfF7j1oXdujKJFQY:XgmVamx4R1otRoY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687850483, "uuid": "35d9c9c1-74bd-4e82-98d0-b31322c70969", "value": 6703337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687850483, "uuid": "5d54d795-17bd-43bb-bf9e-4159569894ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850483, "uuid": "8f4749ab-c039-4e88-bbc3-da0b9eabddfb", "value": "cafb62ef0721ebb55a8dbb37c9716477.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e833df6b-14b9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687849919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687849919, "uuid": "ac4a3a7f-70e8-4e88-bdea-548be7366b59", "comment": "Malware payload (Loki)", "value": "5e6ffe8f38644e73dbf42cfc39300028", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687849919, "uuid": "b09f2e98-89a9-4434-9a5b-d8cf657d1248", "comment": "Malware payload (Loki)", "value": "2f389821c080d021c280aa929e9c2f8ddaea741ffecf602cd050ffa4341eb511", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687849919, "uuid": "e28ae5d0-e63c-4739-a5e8-6da2d21e1fd4", "comment": "Malware payload (Loki)", "value": "d5d82879c90e7c006f28db063c46449ac8c5354e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687849919, "uuid": "3406686c-e599-4097-bf09-c389b26b32f4", "comment": "Malware payload (Loki)", "value": "a15e69e0a76f7bc95b19bdb1efd456a3917e257529339e74ee5b4cdaf7b9bab9a776f5ad57fffa073be396b60c3482f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687849919, "uuid": "a337ea29-51f7-4361-88ea-690f051c9f3b", "value": "T1CEB4124193D121A6CD5248F648AB52750EC16C1358C49E438789733A3EB7E86FE9FEBC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687849919, "uuid": "ecf7726b-28f5-40c4-bf58-bfc6dbb7304a", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687849919, "uuid": "63949278-a911-43ea-b7ea-8da9fae13956", "value": "12288:9FKBG73lOUG2H7zS8zjDMmyKIVhjIQq4ra7XT:BrlMa7zbzPMCIcB4KD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687849919, "uuid": "1666fd0c-c21c-4901-8794-162767801cc2", "value": 517718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687849919, "uuid": "4aec0801-ea0d-4e06-9d8f-0b36f18acc06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687849919, "uuid": "ff9c44fb-8e65-46c4-bf5a-893be1023e39", "value": "5e6ffe8f38644e73dbf42cfc39300028", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "922659e0-14e5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687868672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687868672, "uuid": "2252b434-e82a-4d08-809c-d98bc999bb7c", "comment": "Malware payload (Formbook)", "value": "323122fe1c347737c08e30fec1437429", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687868672, "uuid": "7e69f1e0-5c67-4b18-abf1-8241d817d030", "comment": "Malware payload (Formbook)", "value": "2f8e9facdf104aa0a763dd40689e81b21b6664fb3b737e8d391d111e2bb38087", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687868672, "uuid": "e2897a16-cb74-49f1-a8f1-c2d7435c22db", "comment": "Malware payload (Formbook)", "value": "59857aae013c6d3d572f3054498d7ea9e4260b6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687868672, "uuid": "b07b2d49-b7ea-400b-892a-f5b225c0b2cc", "comment": "Malware payload (Formbook)", "value": "78b1cb3172af38e13fcfd4cc044ccc7e292a27006f718ccc0c0974e00d1edc62ea062b1a1c2f0fed083d8fe3db168352", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687868672, "uuid": "ef82bc8b-8952-4c9d-b5a2-c22efcd0f2a2", "value": "T1A6E4593D18FD2AE3C035D6B98FE5B467F520993B38219D226CC7A7544325A9224F363E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687868672, "uuid": "eb664da3-e43c-4008-87c4-1e2e6cee5963", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687868672, "uuid": "b0ef1690-40e2-40ed-845b-a0d2cf1053e4", "value": "12288:17mszcVdmaPuRmleQBHV5O08wWGciyDaTmVpvbr5:1isGTPuRtQBHSzwWLaTmzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687868672, "uuid": "d9fe3cdf-8794-49ad-a0be-2802eb1413de", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687868672, "uuid": "6b9f3915-e6dd-4417-a949-9f69860e28f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687868672, "uuid": "e1d89d72-a562-43e3-9ffb-1615dab4404d", "value": "Bank Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "916cab4b-14e1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (IcedID)", "timestamp": 1687866953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687866953, "uuid": "0f35f66f-83a8-426f-ab64-1ad1d085b5ed", "comment": "Malware payload (IcedID)", "value": "3bff1bbe68705a1e02ef7b4b64466844", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687866953, "uuid": "342857b8-c099-485a-8f6c-73a7f0ee82d9", "comment": "Malware payload (IcedID)", "value": "30028bd89f2f2348276eff8471c43ab9e5f58eb6ab1cef6a8c1a478b75ab3305", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687866953, "uuid": "762dff79-9bfa-44fc-a56a-6962cfad3f22", "comment": "Malware payload (IcedID)", "value": "60933bf14c6c541e476305a2731107b501a774f0", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687866953, "uuid": "2860c2d2-6a7f-476c-b278-72f40fc44b14", "comment": "Malware payload (IcedID)", "value": "936f5537b14178e27d3a1f9f5738efe6704064823c2f7162dd87d24607e71f4f8b2c22853b197cf24bb809809f859e86", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687866953, "uuid": "1bdb2c85-6d11-4402-a5ad-09dfc34ad787", "value": "T11D05DAC227EBBD4304270376335426E6D93ACA66C9D998CCF6457C58F0ECE46B9D82C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687866953, "uuid": "3a86c50c-c36a-4200-8826-acdec96ce422", "value": "24576:LYOB04ZfnMGjy/SLY+1jGdIl1mSGNF7JziIbF074FT4eNXzrBanKsIPmmN3hG+W5:DB04ZfnMGjy/SLY+1jGdIl1mSGNF7JzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687866953, "uuid": "b7e57e53-4806-4451-a7ad-9c6bf8251a3c", "value": 798061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687866953, "uuid": "3c2ec644-e2be-465b-b0f0-ef89c67128c9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687866953, "uuid": "c6f53281-8413-48cf-b07a-a163f4c7eb3c", "value": "Scan_06_23_Payment(41).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2c43f54-14af-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687845588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687845588, "uuid": "347327ae-38e1-4b28-88f8-730e419e7605", "comment": "Malware payload (AgentTesla)", "value": "0545de11c6e67c8b6f5c967db17f631a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687845588, "uuid": "fdb85915-7b89-4f40-87fe-515071d7f64e", "comment": "Malware payload (AgentTesla)", "value": "32540c8d3561a5683e3fcaa4fbbc87e19e16106534eaaf6649ce48934eb602ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687845588, "uuid": "4e077e10-89c7-4718-b6b2-69da1b144369", "comment": "Malware payload (AgentTesla)", "value": "d9b822c0969732ca54ff27ac5f587f9057d4369b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687845588, "uuid": "dd52e483-06f5-442d-aa1f-e2f463abd233", "comment": "Malware payload (AgentTesla)", "value": "87a1aadabc84650a1fa00780ec777574e96a42d1afaa53581027784b07eeaebdb36484ae7396e0b3563799f98f4c60b7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687845588, "uuid": "75722ae1-70a1-4699-8029-8362e54ca805", "value": "T123B423D4E52641BAFE24CC866A1259EC3CC32DDE4E9F464CF92C82F79091C4D3789B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687845588, "uuid": "1bdfca5d-2b15-4d78-8a30-b8331d380198", "value": "12288:iPaG7QFdSu5p/JeIVytD/gbyOgjJhZbW2:iPJ7Q2uVotsrgjJa2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687845588, "uuid": "7fea21d9-fb60-4551-b3b8-e6b29d51815e", "value": 524446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687845588, "uuid": "857443a9-8142-48f5-a191-2b08ef631875", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687845588, "uuid": "af5c11e6-9b02-4ceb-a781-80518cbaf0d5", "value": "PO#266203.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25d6932a-14c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687853888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687853888, "uuid": "2889542c-d5c5-4cce-81e2-7f5dc297d1dd", "comment": "Malware payload (AgentTesla)", "value": "3b527ca852ab5528c4f11618c37a8af5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687853888, "uuid": "782040f1-6da6-4a4e-8601-db7d83431a8e", "comment": "Malware payload (AgentTesla)", "value": "33aeaad45cd23db7f65ab2fbde36c77b9a2f16680469a7016cea0b659bbd12cf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687853888, "uuid": "3b684d9f-99c5-4d0a-a8b1-c1487042e9de", "comment": "Malware payload (AgentTesla)", "value": "613caff760da9b0f5d2f948bf2cd1d6f046cd005", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687853888, "uuid": "ae5f9e75-dacc-45e2-8640-41958d2ea119", "comment": "Malware payload (AgentTesla)", "value": "e80142c2b3a6426d332838ee1885330cd4aa54c462967ccf43c13813d6072efa2b962b9ab673be80432a811dfb580e04", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687853888, "uuid": "74b87af3-5185-404d-b278-5ed760bd599b", "value": "T10911C8A1E4824848F1D82275CDFDA24C2750DF40710645DE0C5F0CD669B1EBEDDB8032", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687853888, "uuid": "adb00c33-50d7-4629-95b6-591336c43174", "value": "24:wqm91TVRBKUVcKPhPv6obz48D7LKDbbDlfd6RQ2XNkrZv+icBlJkpTBvi:aTVicfmqRQCN2QtlJkR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687853888, "uuid": "71081c0b-bc59-441b-ae5a-dafb4050c794", "value": 970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687853888, "uuid": "9c089784-31cf-4431-b21b-a248610254c0", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687853888, "uuid": "4dde2e66-5ac6-4f14-ab32-0c40c8f2c74d", "value": "Transferencia.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c295111-1501-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687880715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687880715, "uuid": "e354ca01-f009-4312-9c37-221afe40cd92", "comment": "Malware payload (Loki)", "value": "8726987153dfa62a3ae9d3c2edd9afc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687880715, "uuid": "4f408586-0f85-45a5-808a-3b94c8f1db7a", "comment": "Malware payload (Loki)", "value": "355b738b1bfefdf20d18bc264d0741069c463d35eb34545de12a2187dbf2665a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687880715, "uuid": "b7771e24-c46c-4c54-8c3d-c7df33a35e79", "comment": "Malware payload (Loki)", "value": "433d8723c436a53f6d2c6b3426a5e244e22a4059", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687880715, "uuid": "cf850d86-c263-49a2-bc85-1ad57a3ffa48", "comment": "Malware payload (Loki)", "value": "a9b093800d36b5d48cffc193028e46aa63efb65b59c07116d3afd71aeffbd974e3b395d5ff904eaca117a7ce6400e40c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687880715, "uuid": "03b1e7aa-745b-4f0d-80ba-21a3f7bd02e1", "value": "T103C4263838BD1627D175D7E78FE7F023B278982B3021EA2568D297D50686F1225C763E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687880715, "uuid": "7ebd7561-52e0-4418-b5db-c55c9081b030", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687880715, "uuid": "89f66826-b509-499d-b846-3e535ddb4126", "value": "12288:s5dPG2fASvLaq7Bt5N+kD7trB9F8g5He8Vb/eCitRl:UApqtN+kld8w+8Kvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687880715, "uuid": "583326c0-2397-490f-8738-b82ec8046629", "value": 584704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687880715, "uuid": "34f2dbac-4ab5-4926-bad8-dae3ed43fe8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687880715, "uuid": "9f884b68-8ca2-4c8e-b58f-0f32ecbaa373", "value": "355b738b1bfefdf20d18bc264d0741069c463d35eb345.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b39ade9-14d4-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687861171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687861171, "uuid": "d8a5fb87-fdec-4638-9cbd-ec64aca3b3cd", "comment": "Malware payload", "value": "53336986bafde812a6f6b841e95c4a83", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687861171, "uuid": "348b4435-613b-494a-8e59-84663c75d3c0", "comment": "Malware payload", "value": "38d08d6988888ba6f01b47beebd0f7c5e872c668ff1fd42d9f4d0797a9a058cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687861171, "uuid": "ea5059ea-6bf9-48d4-98fc-f553cde978a3", "comment": "Malware payload", "value": "d17d2d5a66718871d5c87d20c478b63ea500c600", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687861171, "uuid": "7852bcc6-90b2-41b2-a9c9-7c443a0d6a19", "comment": "Malware payload", "value": "1e06108805ad25975ac2ff50758bf9677f42eaba9f5924827083d446deed28d1f84fd6539f6901a86fa3521ee6837eb2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687861171, "uuid": "e2c2903a-7a01-4a3b-801d-be48a645b3f2", "value": "T1C1939E227A40F773D81604715869C6B1AEFEBC710BA585C3B79C436F1F213D26B3926A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687861171, "uuid": "c3c4f194-e73a-44de-8165-c30e7417a813", "value": "a3a98f4b8bad628ffa25a9afc0275971", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687861171, "uuid": "9053ed0c-de14-4bd1-96ff-de102497565b", "value": "1536:u4qA7dXbJOZ1JWxoUDpktvMAk3v7ygfWXexd7SyyPxe:9qA7Q1whvP7ygfWXexd0xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687861171, "uuid": "36e3db6f-e996-4162-a6bc-172cf206955a", "value": 91410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687861171, "uuid": "14b9c20a-cb2b-4750-8501-4f22fbac2116", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687861171, "uuid": "c58d275f-61c7-41c5-a568-5080a43d724d", "value": "53336986bafde812a6f6b841e95c4a83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64301dd0-1520-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687893935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687893935, "uuid": "a20b4513-8a23-451f-bb05-113f84617353", "comment": "Malware payload (AgentTesla)", "value": "95e83f7c61a19e9622a78dab1b0f3ca4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687893935, "uuid": "113f7e9a-6799-4413-933d-c7e6c5f92375", "comment": "Malware payload (AgentTesla)", "value": "397046da411436841b9eee2f3edc21f72ba89f0165a29e1fef0cafa6755fcdb0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687893935, "uuid": "e07ade2e-3b59-457b-be7c-945f9bc938b9", "comment": "Malware payload (AgentTesla)", "value": "b8930667b4b8556ceea1ef3901688654bfa685f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687893935, "uuid": "a28e5eba-b6b1-489d-a338-0cb4b9bb26f6", "comment": "Malware payload (AgentTesla)", "value": "e664401a3b85a903f2d2b6d5d29d9bafe52f992210e962d5ab4396eaaca948c83cedabb34de41e0cfa451f12e68c9c2b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687893935, "uuid": "06476e0f-81fb-4b47-9b9b-99451d08332e", "value": "T1A3E47A3D2CBD2A37C175D6B98FE5C063F450843B3922A936A8C797654746EA325C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687893935, "uuid": "efd674b7-0672-4507-95f3-7cc8957093af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687893935, "uuid": "729e299e-ff0a-429c-9538-b60b74c251fe", "value": "12288:h4EBJoZ6ChI4+cat5AqP8nDyNK0Qi1QLdrFP22wj8a8bGwzNSNMdDN:6hphEcaAqPKZt22wjIZ0Md", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687893935, "uuid": "e35390b4-25c3-4e7c-9202-ab44f2fc0e8a", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687893935, "uuid": "57f3d383-7f3a-4461-848c-63a99fbb2b98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687893935, "uuid": "469f496b-5bc2-4a46-81a2-647eae83fdc3", "value": "rDHLZAG0022018745.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88bebc14-1502-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687881112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687881112, "uuid": "47d21caf-fd5b-4ae4-b665-1a128f6bf243", "comment": "Malware payload (AgentTesla)", "value": "865fbb1ab47d673ae26074e396b366cb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687881112, "uuid": "88421677-9490-49cf-ac85-93511c099db9", "comment": "Malware payload (AgentTesla)", "value": "39f3f3f1b8972435c525fbe6edf5644f882f3ef80bfc4302b459bed3deb710fd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687881112, "uuid": "dd9f6b06-3030-47cd-851c-84e5f564b31d", "comment": "Malware payload (AgentTesla)", "value": "068e691a56270c47644f5054012091c10a976438", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687881112, "uuid": "a31dd4df-951a-4f9c-b3cf-ad0cfd4e3229", "comment": "Malware payload (AgentTesla)", "value": "c83a16dd7cdfdf4e2450a5b84641520865782a4834d8b039e59d7dc62cc4e073962ac686f36808a8ac4a4a651c5c4250", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687881112, "uuid": "d335a624-2ec9-4dd0-8131-ab3e243b03a2", "value": "T14FC4683D1CBD2A37C075E6AA8FE58463F150D43F39229932A4D787958746EA321C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687881112, "uuid": "8a7bdba4-c13a-4ddc-b88f-2c4be6f3a70e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687881112, "uuid": "8c8d882f-8a4a-4bca-8d28-78bafc57ac63", "value": "6144:f0zhm9lTfq59aNyhnnqf33IqY4puV8/aogQur5sX9YmZGuIDyVNZ0qJ+:fHlTfFfq4UVIa4i5kNyOjeqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687881112, "uuid": "3976dd7c-fb9e-40a0-9560-9886f646f952", "value": 587264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687881112, "uuid": "cc21a80c-977e-41ce-96d8-e9ecab5878f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687881112, "uuid": "00e94e8e-29a2-41e3-ba62-f0a61f313f77", "value": "CSID 270883.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3873889-149f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1687838771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687838771, "uuid": "95079442-7f03-4e03-b910-4ed3a7994e6d", "comment": "Malware payload (AsyncRAT)", "value": "0f78c7fdb9fec5fdefe9e8ffbb7a6072", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687838771, "uuid": "b29643f3-0f6a-4055-800a-5defc4bb37ba", "comment": "Malware payload (AsyncRAT)", "value": "3a23f25fbb533df0fdc29eebe8f5f2434a5169683a74097a8a18d554e0d071fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687838771, "uuid": "f50150ad-fb33-48da-85be-9f8adfe46bfa", "comment": "Malware payload (AsyncRAT)", "value": "cc81836883173f30726e930b78bac99b7dc66236", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687838771, "uuid": "81b0c751-9e58-4bdd-8c4e-e8b7ce71fb09", "comment": "Malware payload (AsyncRAT)", "value": "44d4934500821f567486c85a34967ea5e8298a75ea453e461a08fb42a23e789c37bbd3702c732293bb527d3989e7e10e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687838771, "uuid": "6a568ac2-d554-42fc-82f8-f6bfdf1b5a97", "value": "T1F804391437E81919E3FFCBB8F4B001259B72B8236913E76F28A859ED1D62345D550BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687838771, "uuid": "7f283733-e05b-4ee7-b6a2-4c4722ef9dc8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687838771, "uuid": "f01cbb5f-40a6-4318-a9a9-51bca537489d", "value": "3072:G+STW8djpN6izj8mZw+GSv5hqIPu/i9bcJ2cCw41ex6+WpDz:b8XN6W8mm+vvnXPSi9b4ps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687838771, "uuid": "c7991d33-b193-4cce-b8c7-68a35e9a3afa", "value": 174195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687838771, "uuid": "4d24b95d-d102-4e88-8775-24f38fea9ac3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687838771, "uuid": "95be6a6d-c3b8-442b-ae17-2de5235cb552", "value": "0f78c7fdb9fec5fdefe9e8ffbb7a6072", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bd1d077-14a3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1687840288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687840288, "uuid": "3444f2e3-b93b-4611-b389-bd7b07e9ce64", "comment": "Malware payload (Smoke Loader)", "value": "bf75474fdb506e5fa9c36c07d9c4925a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687840288, "uuid": "0148699d-d635-455e-a00d-8db7f1fbd8aa", "comment": "Malware payload (Smoke Loader)", "value": "3ad79ee3d20e4aaef20910b591c492333b1d0b0d798e2c965754321910bd67cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687840288, "uuid": "e00f6f9e-1ad6-4d81-8f38-e5a2fad47de9", "comment": "Malware payload (Smoke Loader)", "value": "75492dcb7be8bace8db4a86797fcfd6958f99fff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687840288, "uuid": "7ffa94b9-8962-43c0-ad55-45b59f4d1208", "comment": "Malware payload (Smoke Loader)", "value": "d22a930ff36ae5eff361e85955e3cf42247e3b8a8c65e749f59568b8b775739da622215219bcccb061b7b85708324907", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687840288, "uuid": "7ce86f22-045b-4c8c-854b-7ceb4805da20", "value": "T1A4248D0352A0BC61DD2E8B728E2EC6E47E1EB5618F557BA723385A2FC8710B1F573251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687840288, "uuid": "933084b6-0dd5-4dd5-a523-e8f11744ac97", "value": "beb5a90def3136cd5678402095e4e39c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687840288, "uuid": "da56bbf2-04bd-4847-8c95-be0d038a2a16", "value": "3072:n0BvrVuFAVH2P1M7DYnbOvngg/uI1UfV1JB3d7RcE:sv439M7QbOvKIGlK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687840288, "uuid": "f99f9a7f-0018-4e9a-99e9-0b16b4afa0a5", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687840288, "uuid": "a81c594b-9df4-420a-96ec-b746684bff51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687840288, "uuid": "9db9d073-6470-4d3b-9bd5-117b54f13ba7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfe605c5-14bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687850710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850710, "uuid": "4de16831-ff93-4302-b3ea-b3ece29834c9", "comment": "Malware payload", "value": "097a21260514cb14f92607730a979570", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850710, "uuid": "5e2903f0-756e-4aa5-bf97-d87ffbb899ff", "comment": "Malware payload", "value": "3b497a83286df05edb600bd5c1bded2d3b6f11456800d5784e86efa1556c9f89", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850710, "uuid": "dfb9927f-f3f7-4e97-b03c-62f23c6e4066", "comment": "Malware payload", "value": "f2724a3d2a5bb4db2b73cbc0828d9286c5b62b8e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850710, "uuid": "2df54331-d2ff-4302-994a-6a11f79a9d0e", "comment": "Malware payload", "value": "4943106c56d6ee5466e46cd19eed3a6560f70b25cdcb52a09d6c12b6876126d5143066ee7cf7633245600f4e5fe8263c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850710, "uuid": "b0d47527-91f9-4610-a445-deac7ae839d4", "value": "T165B3F1877E1088CEDE9377BED33E0B3501233BA7551E16A427F9ACE11E3866B4814D51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850710, "uuid": "38011415-effb-4365-81ef-1e4eceffa855", "value": "3072:mBefihU8fQ2Sob/xg+eNV1A1I3aiI8i3GdVAzuECh:mBefiv/12+2A1AIpFzxCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687850710, "uuid": "c2dd3990-e874-49bc-9e7a-e19917f4ccd0", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687850710, "uuid": "33fe83c6-9305-44ae-bbc4-4b79cbcb3b77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850710, "uuid": "c4058ca1-2e71-4a5f-af02-8c35c744b7c2", "value": "097a21260514cb14f92607730a979570.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65c785de-1546-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687910259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687910259, "uuid": "7deb5c9c-e4c6-4cd7-8d03-152ba81bf876", "comment": "Malware payload", "value": "ccbba2aac1cae3a0bd29cb42203e20b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687910259, "uuid": "59a2b57a-5970-44bd-bf43-2193651e5e1e", "comment": "Malware payload", "value": "3cd8941da73295f75980a8c38d92902b378614aabddfb395121cbc1724abce22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687910259, "uuid": "6956c208-5214-49aa-9ff1-bcc04197da65", "comment": "Malware payload", "value": "fc43185094768f22e4857f09cf902e4ab8b1ce57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687910259, "uuid": "81ad716e-9f51-4ae2-9253-969dcab245f4", "comment": "Malware payload", "value": "f32f569b92e918d2c3cf79fdb4f81a6559b9d7d36d6045d90e902cc8a52a91c0fdcc32d25b0cec4f0e095f13548339c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687910259, "uuid": "a1a798f8-ca3e-4749-8369-65d0eb6b50a7", "value": "T1FBB4473C1CBD2A3BC035D6B98FD5C463F554843F3922A936A8D787A44746EA225C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687910259, "uuid": "e68b1f4f-462b-4e9e-8211-86124475dfa0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687910259, "uuid": "19d270bd-1a3b-4e41-bcb1-6b2985e3b66f", "value": "6144:lRdos3JPCNdsRxUxQ/tYqKFBXf1iJi3m916neS8mJOWzTKHUGetd/3U2m24:Nos5m68QlYqKdyisScKWNckzh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687910259, "uuid": "5bd572c4-5693-454e-83c6-09577d55ee6a", "value": 535040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687910259, "uuid": "ec1c3d0b-156b-4527-b30e-690ebffe7e10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687910259, "uuid": "7fde0bb6-6255-4e15-9116-ebfe22e1f5f3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9275c9f8-14d3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1687860942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860942, "uuid": "e7d09cac-16bd-442b-b9b7-5332b96481b6", "comment": "Malware payload (RemcosRAT)", "value": "612a753fda401029ddca1989452bd74a", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860942, "uuid": "c11b1caa-a744-4f70-8acb-d33fa8c3b548", "comment": "Malware payload (RemcosRAT)", "value": "3cf13bb5ddbc61a5057d476f9ce1c27265a56f46e1e89f5ada07ac39ce19916d", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860942, "uuid": "6b03721a-eba6-4f6b-ae87-0a4b00178050", "comment": "Malware payload (RemcosRAT)", "value": "bb4e25679323c4f74cc53e24e1c8ff3cec1b07cd", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860942, "uuid": "80f46d0e-dfb3-42e1-9637-7ee0d3e4f50d", "comment": "Malware payload (RemcosRAT)", "value": "43ca6d32b71a2062120568eb961a5270e383f52d73b662ad3769af56156902c2790cb97dbacbc0bfe48b615f3125264c", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687860942, "uuid": "18d943eb-2fe0-4cb4-84bc-38cfbf50c3bb", "value": "T1E205233BA91049638C17F6FE2DD632FE6B36CE4074B852FB181214BC7F4A89996448D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687860942, "uuid": "a40fe981-dc76-4891-943d-e1c8253409ed", "value": "24576:H54B6Oq05q5nXLkg6Iakc23Cwzs3hcsnxEskd2:H56q05q5XQg6Iakc2yRmsnxEskd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687860942, "uuid": "386c50b8-165b-4d0b-9f15-8c7a0551665c", "value": 829943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687860942, "uuid": "6ff5d408-0b1a-43a4-88c7-e043e388363e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687860942, "uuid": "0094f0b6-6f1b-4c0c-9873-2229b3f92264", "value": "RFQ BRAS BASE 7683465 2023.R00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae94bd29-14ef-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687873015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687873015, "uuid": "5e81db40-8d24-41c2-9dee-4c07e71aeab7", "comment": "Malware payload (RedLineStealer)", "value": "d23e69a7bcbe1f775b68341d9a48ad55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687873015, "uuid": "4018ec49-919d-4421-b1c6-e618bff64af5", "comment": "Malware payload (RedLineStealer)", "value": "4211eeba048c6e90e7da732ee62ef8c8602b39f55a6b1536a3f48963005506f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687873015, "uuid": "74137175-2535-4c65-96d8-9a54c629e26e", "comment": "Malware payload (RedLineStealer)", "value": "ea997af665d07f87848dcf83de1468b6e2c6c372", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687873015, "uuid": "a2fd466c-ccf6-4905-80a3-265b92ca966f", "comment": "Malware payload (RedLineStealer)", "value": "026867e2e76afa416d10ac11e71d3ea1500c910fee2b9e5b1ee258f163360215f68f3ba9f91972878c94466e07dca1f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687873015, "uuid": "439595d7-0f50-4ebc-93c4-b47560ae7399", "value": "T15F56008CEFEE8DB3EE7649F80CE765D55C5C72871A689E46221C887307052BE769380D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687873015, "uuid": "1338b896-e1c8-437b-bc53-8a85efbb96a0", "value": "a95574c9913dbea82b8cba27ffd5141d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687873015, "uuid": "2cb029b7-bc42-4b12-8062-c1ac1a13a2b5", "value": "98304:VALTKkN3jEIZUZW14tYyuNVZpBad8wdqetuejwCgNp52CA0/uZUT1:23KKjX+WStYyAVTBad8w9tDjwCyjRl/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687873015, "uuid": "3a1342a0-a1d9-47c0-8c88-a3f2426f735e", "value": 6046344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687873015, "uuid": "671ccb92-834f-4215-8e9e-301976ba2ca5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687873015, "uuid": "89fa21fd-0988-4a48-9367-52d267baea0e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "965712ed-14d3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1687860948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860948, "uuid": "245fe2c2-0ad4-4678-968e-21a4f29f6b61", "comment": "Malware payload (RemcosRAT)", "value": "826572294dd7857d627783220e0fefa6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860948, "uuid": "81a8424c-f677-49fa-8ddf-f9ac41619d90", "comment": "Malware payload (RemcosRAT)", "value": "4400353ebbbd72f1a260b3021c48fa67439ec6accd01ecd27ada202052f27391", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860948, "uuid": "e6db72e9-ad1b-45b0-bb22-59a1b56c8363", "comment": "Malware payload (RemcosRAT)", "value": "f1f8fe7f3f3f880adba739ea2fe5ef7725c29e8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860948, "uuid": "2d064569-84f2-41f4-a037-3863ad1ef09f", "comment": "Malware payload (RemcosRAT)", "value": "0cea3f9acc9489d34d48cfe78f13f106acb1a9087b73fdbc0034d8dee971b46224982d56cc2464bd70814d5a924584e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687860948, "uuid": "7eae3725-049d-4ab8-83ec-6916153d148a", "value": "T1C815BC3D18BE2A37C175EAA9CFE49463F500D53F39229936A4D797914706EA324C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687860948, "uuid": "2eadb706-ce7c-44f3-a89a-dadc1db6b386", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687860948, "uuid": "553256fd-40fe-411d-9319-dd1dbba1868a", "value": "24576:vHFNm3V5CJ7Ys5SdQUg+z6BimmTlJ0stgF:vHFc5CJ7Ys5SdQUg+z6BoLhgF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687860948, "uuid": "5fd34e33-da5f-40d5-978c-52d00e3a9279", "value": 920576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687860948, "uuid": "03a801d4-b562-4211-8e5c-fdac8f36fd62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687860948, "uuid": "3aafe966-57b0-4062-869a-fc6ea453518c", "value": "RFQ BRAS BASE 7683465 2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19bd149e-14c7-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687855585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687855585, "uuid": "0f29a432-79a7-4451-b8a7-4798c9949656", "comment": "Malware payload", "value": "6e1379b9922182e0348daaf605129342", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687855585, "uuid": "922b7615-2c7a-4273-aefe-cc59847db72b", "comment": "Malware payload", "value": "4551ab5e824b19bad4d18678992450829a4a17fe9d01cd40f209ffb147c67290", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687855585, "uuid": "ed5ec611-c300-4300-9d11-0b17eeedbe21", "comment": "Malware payload", "value": "fa56cc3551d8601bfebd2085b11449f4dbaf0dfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687855585, "uuid": "0d751ce5-4c96-427b-b46b-d7512bed90a9", "comment": "Malware payload", "value": "e9017627be05efb1f39df7495676375b6ca55b88a5b70de5fc1a0260ede39a02c93e136fb478edc2f0ac9876be8c1d12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687855585, "uuid": "c8f20150-5c80-4df0-8954-26365ba3a667", "value": "T13B7412C86BB8C863EA910570497ECA254BB59C166A9187472380FD2EBDF16D34B1F337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687855585, "uuid": "ffc439fe-2cce-439e-9f18-b00cb53a4388", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687855585, "uuid": "120be59f-92e8-4a16-8a6e-5a00b1a2e27e", "value": "6144:wYa6XHj31AURTv0HwSgtzmfV9E6VJkriVv9wyAX9shF8ewr0SY:wYtDPJ7OZP9pZhFmrXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687855585, "uuid": "c62b3ea2-3533-47c5-95d3-c7b2d1106dc2", "value": 349467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687855585, "uuid": "45ec5ea4-928c-445f-9204-e842d9d9aaf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687855585, "uuid": "dcf5d6a9-8e82-4cea-8218-00c4d359d324", "value": "SHIPMENT DOCS 4X2000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "802c84a2-14b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687846308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846308, "uuid": "f81ba57c-c903-4225-916d-a08cb7cf4d74", "comment": "Malware payload (Formbook)", "value": "d91260a98896839dfccebffc6c11a13f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846308, "uuid": "2dc2eafb-52f9-4136-a1f2-5053a6e71aab", "comment": "Malware payload (Formbook)", "value": "45dec1fc7a43e44be22a5bc161baaff3a7573562b1574246e5c59235620d715e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846308, "uuid": "b860507f-5299-47e6-ad38-4d41f40b5ab8", "comment": "Malware payload (Formbook)", "value": "589c7a5ad66e3ed75301cbdfe7a22646a73c3800", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846308, "uuid": "3eb0dd42-1170-4e1e-b5b3-3407b468ec47", "comment": "Malware payload (Formbook)", "value": "ab0298835d5f5f0d95017f4fae2a635c093f8a55a16c2b9afa854847f9134468d829b8ec8274d2f50c6a055abce6f723", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846308, "uuid": "cc7a7608-77ac-416d-865d-90dc5d71ca59", "value": "T11DD4F18C7650B1DFC85BC9B7CAA42C60EA2175AB470BD347905711ACAE0EA9BCF151F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846308, "uuid": "34922571-80aa-493b-90f6-803e73a3330c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846308, "uuid": "bffc79b5-c59b-4471-be35-7645e6f8da0b", "value": "12288:Z22iNds1zpmnchs+TSIbQKJ1SzfCaAfoAgLI+OCuZm5DvLIAibDfWy:E1A9ach/mOhSTCRo2cq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687846308, "uuid": "54a3d3ba-c681-4638-87b9-4a2dda657e06", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687846308, "uuid": "ca910538-9f39-40ce-891d-83c39c0dcb40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846308, "uuid": "3c4be1c1-65a9-4e95-b7a1-f53ea73f22e1", "value": "Mirus Packaging GmbH Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d958356d-14d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687862349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862349, "uuid": "53a925c4-6ebd-43d2-bdd7-ecad20c47115", "comment": "Malware payload (AgentTesla)", "value": "fecfc02cd801b4c0680a653d0b3b1d59", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862349, "uuid": "2912b150-7eac-46c0-8548-f34bccad870d", "comment": "Malware payload (AgentTesla)", "value": "461f3de19176b99a3e099a1df86f7f3ba4876fb21b2e1c6487cbcec7eef31a01", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862349, "uuid": "b7377623-a7fa-404e-baff-e1ef3d82ba77", "comment": "Malware payload (AgentTesla)", "value": "10a43a572d3c363ab52fc388a447078161f441c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862349, "uuid": "17d756b6-f068-415c-adca-b242b1d6e289", "comment": "Malware payload (AgentTesla)", "value": "7d95e36b85f9b5dd65a1aa9def69a2617912d92d288954db260e5388eba18f317931a28553b20cf04cde33c3708ce86e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862349, "uuid": "14740836-c377-4885-a715-75b709b47c5c", "value": "T199D4693C0CBE2A37C175DAA98FE584A3F454C43F39225A3664D797658706EA325C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862349, "uuid": "da1926ab-72e0-4fd1-b540-a1e545fc492a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862349, "uuid": "e6e997ef-fc9d-498c-aed3-6fe0bcd0acdf", "value": "12288:22iNFfP+yupQlzMqYaOQEy5gWnQT9QIp8zVrR6Y0z8RrR:21IutMqYaOcgmhzVgY0zm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687862349, "uuid": "a3c34637-7eb7-4557-983e-a2412ba4c36e", "value": 612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687862349, "uuid": "817aa14c-4b3c-4491-b552-48de2219177f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862349, "uuid": "bdcd60e3-ac03-42c0-8921-90a07da0ff98", "value": "FACTURE PAID INVOICE RECEIPT VIA HSBC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "573a210f-150c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687885324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687885324, "uuid": "4082b884-5a88-4d2a-a471-20d234e49e42", "comment": "Malware payload", "value": "6dd7657c5df61676608943ea224c7ad1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687885324, "uuid": "91f15b1c-8b76-4cc2-8ffc-e0ef16ace019", "comment": "Malware payload", "value": "469943082624eba881657ecf4b49a8f2cba8eb4ae21ba35301f4da8011315dd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687885324, "uuid": "bbedd0a9-8bf9-4a39-88fb-1b2bfd9765c7", "comment": "Malware payload", "value": "53c174b53be1617ac834953928c44020b35bba2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687885324, "uuid": "a8d32110-44bb-45c7-a678-8b90055827ad", "comment": "Malware payload", "value": "4d99f4d755573662382bffd400239ce97d44e8e9ae5e4f6840d175cff9610e3743954b2c73aec08b0ee91800af580b52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687885324, "uuid": "f5cc88d1-399d-4092-bd12-c30709688dc0", "value": "T146958E32B7908076C9633931859B8379A675EE205F3992F763A01E393FB01D2993C75B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687885324, "uuid": "2c7ac023-e14b-402e-80ff-02dd9bee5e01", "value": "34ac90acdbcc305f2547741b40559fc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687885324, "uuid": "f19093c7-4f7b-41f8-814b-138b7e50d7d2", "value": "49152:XdivEQ5YCLXM441CY+Xt4mjQoNn5X/WQ1Zt9GzQyyJLNHaywwFdEbjGfmDz5:N9Q5Jz219+Xt4hoNn5X/WQ1Zt9G0yezk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687885324, "uuid": "53fbc18e-ad0b-4bd9-bd04-66166df87afd", "value": 1913344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687885324, "uuid": "38d1f0b8-9bcc-4929-84e4-c09147c08263", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687885324, "uuid": "fbfe3b8d-425b-4044-827e-0ff96c8301a6", "value": "hinata.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8b4ae84-14f6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1687876038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687876038, "uuid": "a292276a-afb7-4b62-83aa-f9333c563c85", "comment": "Malware payload (NetSupport)", "value": "44cf4436467c85a7774d8a5952b1a981", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687876038, "uuid": "e20bcef0-821a-4a8c-bf20-9f822e6dd211", "comment": "Malware payload (NetSupport)", "value": "49f9a913caf617b4ae7e91bc6e255a3d66939a54d52b7e8af86211b4896b12b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687876038, "uuid": "ffd79d3c-44ae-4f68-a9dd-d5b39005aaab", "comment": "Malware payload (NetSupport)", "value": "cd2d37adfa8acd8c4f7c065dcc66bbe98d843296", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687876038, "uuid": "7b4c6114-242a-4619-93ec-0a2d987f7d12", "comment": "Malware payload (NetSupport)", "value": "7929199840abd51f30ebfaa8491573a939529970a0f6c36bc40fc5b0defd59815aaad367fab730125e78227ce50fc869", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687876038, "uuid": "25b1f8bf-cd84-4e40-95f5-8606ec66925b", "value": "T13C657C26B6838C37C0721A3C9C5FAF9997657E112E3CA44A7BE40F4C1E396417D3A297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687876038, "uuid": "8356ca87-7f56-48cb-9076-7a2cde9014ab", "value": "64648ecce0bcf1e21a329d5e0935ce9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687876038, "uuid": "21ab0cfe-91ae-48d0-8e7c-e5b4d00c7648", "value": "24576:b4oIeQLLzA9BWpBu/5tTnqQeNNSaihqgovV8xQHhpgAz/4ckUd9:Mol22RtPzh5oN86wOkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687876038, "uuid": "db114ec4-9005-4604-9d8f-a0d388420449", "value": 1450872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687876038, "uuid": "9fce15e6-4a8c-4ece-91a1-7e174bd9d173", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687876038, "uuid": "ab06cbe9-0aa8-43fd-beef-c39471cc4fa6", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cb7a4a2-14b6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1687848396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848396, "uuid": "eb9a8c3b-c2aa-4e37-b960-b7afaa3d207f", "comment": "Malware payload (STRRAT)", "value": "1a4ac030a58da776cfe4a9c81e563bd4", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848396, "uuid": "6cb888d9-7d27-4934-a1c1-93a43f20b76f", "comment": "Malware payload (STRRAT)", "value": "49ff3a5373588c3e2a8d117ffa091662f87045ae3ec828f3223e65649a5b4680", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848396, "uuid": "1e548544-5163-49bb-b997-2f5fa65c15dc", "comment": "Malware payload (STRRAT)", "value": "3159dc0894baaf593e1365921cdbfd580a5885ae", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848396, "uuid": "a8c8dfcc-35ee-40b7-bc87-30687804d31c", "comment": "Malware payload (STRRAT)", "value": "04f69fb1430c5ac405e7f2561e288e7050db47debdffff62370a9af99ff8687b126989b04cbaf7d224dabc783aa015bc", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848396, "uuid": "e5c5b3a1-7b1a-4c5a-a7c7-3e89f8270697", "value": "T11163F171BEF78498D113B0F4A46018CF155F499EFC4EE057839E4AE81239FA49B86D8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848396, "uuid": "b2c29a2e-1731-4444-bf89-b7f1cdcc429f", "value": "1536:ETgNpqksfYxlEnBQ1taArWKnrw4S3gDhpK1s207Oc3au1r3bQnsYuPjRwnQHzOi+:vhDHE27nfS3gLK1s26aWr3bQnuLViS3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687848396, "uuid": "a35538cb-fb7b-4585-be24-9e782d60e2d5", "value": 72306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687848396, "uuid": "acbf40d9-9857-4ec7-954b-a465923da5fe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848396, "uuid": "1caa0c10-56e5-4922-8f21-3b6b6ca5e353", "value": "QUOTAZIONI-Offerta.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d1bca1-1510-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687887007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687887007, "uuid": "fd5eaf97-5e6e-46a3-8f08-efc7935984b4", "comment": "Malware payload", "value": "4723d0cce36695b17519a9139143fb00", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687887007, "uuid": "0207709e-463a-411f-864c-87d138ef773c", "comment": "Malware payload", "value": "4a8f0f2a54b609ababac6ae63e15df5e9163d8f1657ae998c6389b176f37f3e4", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687887007, "uuid": "83e8f112-70d2-49d7-a95c-5112e157520f", "comment": "Malware payload", "value": "453e3c8984b787ff98703f03c168cbb6b306f1c2", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687887007, "uuid": "14785333-c8af-4e27-9e51-ab55ff91cc01", "comment": "Malware payload", "value": "16e97117ba9529b2e2de80eeaaacc1998f0259cc76066c7396c7aa227d55db4d08a3d65b0ca099e94c0855a2614bc445", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687887007, "uuid": "71b4896b-ab90-4d16-944e-17b3805b0541", "value": "T1F8646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687887007, "uuid": "6ac9ffe4-7e77-45eb-9c71-fa45a0f61a11", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687887007, "uuid": "b15f3328-b626-4c98-a279-e80e30a40bce", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9mH:5xb8ZqekwkJPaThgyDChXohRRwa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687887007, "uuid": "16dab176-03ef-429c-831b-3a8238ed0b84", "value": 320521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687887007, "uuid": "77399155-781e-4f31-a82b-50e39dd47fce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687887007, "uuid": "42c74ead-b94f-4ce5-b3ef-8cc3f001f788", "value": "4723d0cce36695b17519a9139143fb00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45cf2808-14b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687846210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846210, "uuid": "a93633a1-00d6-4232-981e-e3b5e6686f11", "comment": "Malware payload (AgentTesla)", "value": "b3f88abb6f184d275c30fcbc10f4d09d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846210, "uuid": "a232a68b-76c2-4531-9b0c-751623eb18f0", "comment": "Malware payload (AgentTesla)", "value": "4bc4516b5db503b67107df186362ebf8d3029fe3a98c9ad777fdc2568f427113", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846210, "uuid": "0b8c760e-5aa4-47f1-ba1f-80ef909445fb", "comment": "Malware payload (AgentTesla)", "value": "0722cd74845fbe8f64284c5e10a53ae95ed2dcc0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846210, "uuid": "ac3ce85d-2936-4215-b939-93b2d4014e0f", "comment": "Malware payload (AgentTesla)", "value": "5961f67cbc5cc1e16076880a99b03a5318c0d0f2ad66940d8a828e83da84d027e88e6059834e717e925332851bd32847", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846210, "uuid": "449367c4-1ed5-439f-a8c0-3fd509718b15", "value": "T190C4E09C3A5471DFC827C976DEA42C64EA21B077530BC647A01326ACDE1EAA7CF151F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846210, "uuid": "cb4546db-9b96-46bd-9665-5980023ce106", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846210, "uuid": "d819ab25-6850-4bcd-98c5-befc684ac87d", "value": "12288:TF2iNFkrq3xzkOB3GjFwO2Lo81zZspCg296hJ5+deE0cfmzrvZ9Gtq4NIb6:TF1Au3xn3+F721z8d296b5Kb0cfmzV9G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687846210, "uuid": "007fa9c6-880a-41a7-91f1-119182b0f940", "value": 592896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687846210, "uuid": "5eba8956-e746-4f09-b26c-fa781b082438", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846210, "uuid": "0bbf8172-f1ca-436f-b334-b7f8ede63b34", "value": "Remittance slip 060223.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e43eb86d-14d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1687862367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862367, "uuid": "56e7acc7-87a7-46e4-97b1-9a3352f27f70", "comment": "Malware payload (STRRAT)", "value": "d46ced619302d537e07481dfe8a1e7e1", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862367, "uuid": "c9d63eba-e876-4cda-b54c-fa7c24f4fee6", "comment": "Malware payload (STRRAT)", "value": "4e0f0e48af90b53ca2f5bfe07730901ca963655051f5fd4fba455933bc9a72ec", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862367, "uuid": "9bf088a7-9e2c-4b74-a0f1-116134fd087f", "comment": "Malware payload (STRRAT)", "value": "135311ed819821a8a5043a0141c192e7b121a459", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862367, "uuid": "f256374e-78f9-4122-9d26-39dd94506710", "comment": "Malware payload (STRRAT)", "value": "5ba43ad0287cba7a18de69893bcd024fa5926e25e781cb0c20bf9e5d9d7ea28cc3745d8df99aae4c427e5745d5c9a02b", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862367, "uuid": "b4126e14-75ed-42ad-ace6-3ae04dc698ad", "value": "T17E24011A7DD9C6ECF42B56769048C27BEB0E81C8E542957F31FD5A480C76CBA1B03A4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862367, "uuid": "d479f1cf-0864-4cbd-b878-4d0af63fd2a2", "value": "6144:UgYgkGYzGvr/s2tpIg5+YagSKH2KDUsI9:UgYWQEIgoYtSQ2Kgx9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687862367, "uuid": "e9b0a44f-8021-4e6f-9f41-8e95d4e2d307", "value": 223561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687862367, "uuid": "1f2c656b-35fe-4696-802e-bebe00eb68ba", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862367, "uuid": "8d186c00-91de-4438-b775-9b980b3c1093", "value": "InSeNaCoder1550ddc8.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b299e22-151d-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687892739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687892739, "uuid": "b742061f-e427-4fd2-b466-f950523716b4", "comment": "Malware payload", "value": "3f1ec380d80e52ddcd61bb03a6c2eaa7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687892739, "uuid": "2831bbbd-865f-4a25-96f1-3c8b7cddb416", "comment": "Malware payload", "value": "4fc98df8a9705ec249f9bf3c058c3f092cc062cafa55386dcbdbd52119f7bbca", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687892739, "uuid": "4c8ffe11-96f8-4c7f-b22d-a73425d8791c", "comment": "Malware payload", "value": "6f188dd6ce55e867feae7d2a77570bb34bfa9678", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687892739, "uuid": "51aeb89a-9d29-47fd-8636-77908ce712a4", "comment": "Malware payload", "value": "84b706f43f5dfc7f1a9c7f98024f947d6a8b74570bbaad965e0838eb88931aa1b6f74325fc6b8d1e0c5072c5a18831a8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687892739, "uuid": "26355aa5-dc8c-43e1-9245-6e26a73f0c70", "value": "T12DD35747DBEA144A066BF03C17DE7209F66356131AC8CC807D5C02957FA853ADABA7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687892739, "uuid": "838bc143-f153-4f08-a3bb-8c4aa14e38f5", "value": "1536:6eq9UWXpGYSVZxiBe62ReLnC/fpuVTdNM3x+U0eU0jnczJgQj:6NUapGYS0ZeU0ugQj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687892739, "uuid": "103d22a6-b7f7-499d-b426-d7d161bf987f", "value": 133432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687892739, "uuid": "d3245cf7-8f1f-48ad-bc9a-6124e7705607", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687892739, "uuid": "47867d13-8ee9-4ec6-bde0-2426267bd5ea", "value": "test.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd9f590-14b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687846492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846492, "uuid": "a7af86a9-dce4-4b1a-bb7e-d627c2b6beb7", "comment": "Malware payload (AgentTesla)", "value": "67ab869ae2756b7a999981368873111b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846492, "uuid": "e82937c1-f146-453e-b043-2c273e3cbf27", "comment": "Malware payload (AgentTesla)", "value": "5065fb3a28f67d9a310e3ef3a8e48b23186af3935e2192e8558602e2515de130", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846492, "uuid": "27667cd6-0fd2-4654-8095-5162c3a42e45", "comment": "Malware payload (AgentTesla)", "value": "5597a73b6b2926cad0f8251277198662ad8c5b80", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846492, "uuid": "676b7786-9f07-423b-afc6-b1272e1c41ca", "comment": "Malware payload (AgentTesla)", "value": "7ca284c79e287acad6a822b8a56ab23378b8d79f049c152ec60089794e1d83d34030ffd3ff0ca40e066060ab4ef263f2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846492, "uuid": "763421fc-53fb-46d9-8c41-dcb6e3cf3e75", "value": "T18BB423C216BBF1F5B4AD127A35E629C4F5CA73B99810CC7C4CC541F18C6C6962B9A8B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846492, "uuid": "82d24636-3c09-4d6e-bdd5-1269cc69bf4c", "value": "12288:dSVgvpbY+jh7LTdae70gc/J9A4WosUyVzv6Yx:hdYOL4HIBos5VzP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687846492, "uuid": "bc40052a-e663-4229-96d2-5e479cf7b2d3", "value": 524803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687846492, "uuid": "6f3e2d48-11c4-48f8-a337-3da3d4f58d5b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846492, "uuid": "62d08f92-ca87-409e-a955-4ed2ec0bc6bb", "value": "Pre-Alert Documents.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8363835e-14d3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687860917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860917, "uuid": "148c8260-5c81-4629-b563-2c4efd3592a7", "comment": "Malware payload (AgentTesla)", "value": "08f2986220e5f337c1ce26ae69828b06", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860917, "uuid": "baa1914c-db06-4238-ac7e-8fdcc3649594", "comment": "Malware payload (AgentTesla)", "value": "5159332b722a3541185d315b0d8370a3eb4baf047caa4edd2c21e4dbeeb1ff5f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860917, "uuid": "4cd10036-ac01-41c8-8528-e047ee909036", "comment": "Malware payload (AgentTesla)", "value": "eb8b058765e44a7d73ae18fd080601324b0d52ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860917, "uuid": "db9e6cd0-9823-424b-9342-f4efd964aafe", "comment": "Malware payload (AgentTesla)", "value": "f8545d290c3f1b4ad30a4d09b95f9c8717dfa3d036154d1a109c76cd42838b5ad9573b44d2925287f88ceef6234302c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687860917, "uuid": "b8bd6fc4-44f0-424a-a409-1c8f7e8450ba", "value": "T1AAB423CDAA5D8F91603562EE540B15DAAE990DEC198E34F00E406BCF431F99C1FEAD6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687860917, "uuid": "f597d03b-49ba-4a2d-9a52-f31689e90ae2", "value": "12288:lLJ/tEmseJb7XY0fPSfOL/DMKohKjfMr3so:lLJ1EmHJnF6OLbTohKjsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687860917, "uuid": "40af8408-18ed-4fbb-b519-a09f5c9a8049", "value": 522023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687860917, "uuid": "f2759384-9e19-4a0b-bfd7-ceba5fdb9850", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687860917, "uuid": "4e6dc3af-2551-412a-97be-1e7c6ca4d8bd", "value": "new project product.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a2d9a3f-152c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687899046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687899046, "uuid": "d16477c9-0e6c-4807-affe-30cb300a9ff7", "comment": "Malware payload", "value": "f670b806d1fcc9d434a8d2bfe97ed636", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687899046, "uuid": "3737c0db-7042-4c81-b439-fa75500403f9", "comment": "Malware payload", "value": "51ac24925b969eb4360deb7771f2ac9b0995b9b8b2fa0fc2ad0062383122587d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687899046, "uuid": "4b41a904-02f8-4321-8177-c247c6bc7d63", "comment": "Malware payload", "value": "0ef37b45518a37eb7f2f903e02df064cbb83c381", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687899046, "uuid": "a0d163da-cb5d-4dd9-afe2-3b3bb721a063", "comment": "Malware payload", "value": "5fa27b3dc347773161ccb79fd9d903f05e4845e70760af41deb716eead1f4f3c2e99a97fbe340b1706a005acad8ca022", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687899046, "uuid": "5b107c4f-d9a4-456a-a444-1fd4e548a2e5", "value": "T1FBD47B8AEBC1DC6BC41503B04DDB9725273AF498A383DF4B27A495382C6376A7F8564C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687899046, "uuid": "a10b76f6-914e-43f0-b01c-2cade411f763", "value": "e9ef9b3a65dd6bf58caf965b2eb31e2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687899046, "uuid": "36213dff-2e07-499e-98b2-038f7e05050b", "value": "6144:aQsPjChP/DWxDmFKP9VCUMrex0Ai/k8XFRFj75Gn39OXa5:Bs7Rx6FKP9Vyp175a9OXa5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687899046, "uuid": "57f1bd2d-eecc-4b8c-aa6b-27360a044376", "value": 605522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687899046, "uuid": "d86b8b1c-259a-4e10-8570-b934f136d101", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687899046, "uuid": "49bf2529-e21e-4b66-9679-60c4662e9d3f", "value": "51ac24925b969eb4360deb7771f2ac9b0995b9b8b2fa0fc2ad0062383122587d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2228b1c1-14e3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687867625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687867625, "uuid": "3524b1d9-147c-4e38-bea0-c6d1137021fb", "comment": "Malware payload (AgentTesla)", "value": "4bdecf933cf87cac4f8aed299fdcd572", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687867625, "uuid": "c768fe36-16de-4e0d-a746-e294ade9b910", "comment": "Malware payload (AgentTesla)", "value": "5278127c9e67bad3f8f2470c767aac3c0801cbbcf7c68c1d2e57a37e989b83ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687867625, "uuid": "18ebda73-ff44-443e-be8c-2364d86329db", "comment": "Malware payload (AgentTesla)", "value": "f51de953af94d96108b1f8269aa91274de64e4dd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687867625, "uuid": "ec851bf5-2234-497d-bc88-623488bb8e8f", "comment": "Malware payload (AgentTesla)", "value": "8eb0df19017c03b8c72a81e19c67a30ccfcd48e9df8ceea2c9cd015b00a28befd459a84b00645664a61e85923adea960", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687867625, "uuid": "0883d591-01b0-4f00-b472-ccb658357c96", "value": "T1F7551227D9029E9ED84B83B12F175999870EBE617AC97C83195C3F8F0AB1F50D58B21C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687867625, "uuid": "237b3c08-a337-45d9-b8fe-97c7c00220ca", "value": "24576:84xqLKYjW4DLwBkLjVcDLwBk9iw17IpuLLkDePd6ACmdg1rl7FeYp:bQLKYjWPgjVboX1sMkQCmdql5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687867625, "uuid": "2e9e41c1-8b25-421a-8212-4a0cca900fe2", "value": 1380864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687867625, "uuid": "748e4a5f-c168-4fc5-a2c3-b27a707db35a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687867625, "uuid": "ce124b24-dc5c-4fae-9d68-b6dc0951702d", "value": "REQUEST FOR QUOTATION.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20a5ac0d-14d7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687862469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862469, "uuid": "488a148d-4ae2-4d5e-8382-a4943eff9d04", "comment": "Malware payload (GCleaner)", "value": "2e149c2509e751783f67aac9af2e57e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862469, "uuid": "320b9687-6d4e-451a-b97d-b5f36b74708d", "comment": "Malware payload (GCleaner)", "value": "5457285bf50fb555f651ddc0fcd19174bcdef1eb6356ea7c5872dc1a5847dd11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862469, "uuid": "151b1918-aed7-4b32-8777-c8146e82e47e", "comment": "Malware payload (GCleaner)", "value": "5b7ff80062d98aa091708ef19bf9c141d09ce258", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862469, "uuid": "98406550-df98-427c-a34e-b5c225d78a6b", "comment": "Malware payload (GCleaner)", "value": "da5b68750c5a77e38827ab6aa36207792259668b7adda196bf3529b90f1590e575c0224c433ef1c798316fd984e224ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862469, "uuid": "d35d5f0d-364f-4409-b434-657bfc5955af", "value": "T14B74AF1362F17C64E5264B329E2EC6E8361FFA608E5D776722186BAF09B01F1D273750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862469, "uuid": "96148472-e863-489e-b7a2-d74ac7fb97c9", "value": "1feb2748e9c85b40aca77d212fe28304", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862469, "uuid": "e210f921-5659-4d21-8892-42055f98b74d", "value": "6144:jf1xE4cT+KOpHMEH5d6SfjUEV+d1Z8G2lpENA4tWe:jzjcT+KKH54S7+3Z/2nSbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687862469, "uuid": "a552b8bc-ec6c-4088-a128-aaa50a325756", "value": 350720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687862469, "uuid": "39f22735-1edb-43b7-91b6-9b2efc92ad0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862469, "uuid": "5c9b1c79-d288-4c1c-9d15-412af2712cfd", "value": "2e149c2509e751783f67aac9af2e57e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "655c1074-14de-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687865591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687865591, "uuid": "3fe31277-d868-4f48-a30b-587af6b6a86d", "comment": "Malware payload (AgentTesla)", "value": "5c064bf62e6fa1c715a57e8c97521945", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687865591, "uuid": "a5eab0e0-4108-410b-b7d0-7a5795a77ecf", "comment": "Malware payload (AgentTesla)", "value": "5527c6e95c67b38151fbbf6f5d18671d56c96f27f66981029c633a413e73d7b0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687865591, "uuid": "c90c9325-35e0-4280-b2e6-ac4a55ee04be", "comment": "Malware payload (AgentTesla)", "value": "09bbd8dc6579b758f07e76edeabc404e5c2efbd6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687865591, "uuid": "30f21241-f712-4d07-9c76-c4839a7aad85", "comment": "Malware payload (AgentTesla)", "value": "d5bb6c83d9abb1ace87fd5cf37f05b01e057d1fdc61a9ba9c338bc56b9130b855cc4623faafee5d24ee4dd79e891cd10", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687865591, "uuid": "089b3346-8fee-44fd-b9a5-3aaffd8f519d", "value": "T1FCC4683D1CBE2A3BC134E6AACFE59463F550843F3922993664D787914706EA325C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687865591, "uuid": "bbfd0d1a-eeab-422c-9207-75ff03d7c757", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687865591, "uuid": "ce276d69-1acb-42f3-a6e7-e5981fbf49f8", "value": "12288:iofo+LuX0ju8uYVv/wRcWBZnswg2BzWktmHZTfEK:0L0jfuYtccKZnvg2R9WH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687865591, "uuid": "fa01b024-8993-45dd-b9e9-302e6fd27dc4", "value": 587264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687865591, "uuid": "b9491e78-e760-4cd9-81e5-7e76f11f3a88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687865591, "uuid": "d535e334-1892-4b46-b7e4-65c08b2f92f2", "value": "purchase order#627203.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "010de61f-14b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1687849101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687849101, "uuid": "8fac09c1-c411-488d-8f18-5960c29757cd", "comment": "Malware payload (Fabookie)", "value": "ec26f3d39e4631f0b6aca3366bc3620a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687849101, "uuid": "5e5ec328-aaea-41d4-9189-e54d2fa023a8", "comment": "Malware payload (Fabookie)", "value": "55fae777d74a76aa182ace8254102c0c5a312e22d28628ac56561d79d19fc95d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687849101, "uuid": "d46b924e-c5e3-4b7e-b774-c34bca6d8afe", "comment": "Malware payload (Fabookie)", "value": "ec6ad15861d2bf3ca3bea06e8dabb654fc0bd6c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687849101, "uuid": "e582907b-b6d4-4d0d-a838-7673d7659f90", "comment": "Malware payload (Fabookie)", "value": "c49daae0d602bfe3d932dd12250f57236df41fb5b75d9b84129a2de12262467d9f37331e04bd9c66c7b5c6b7431116cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687849101, "uuid": "f5518a55-8f98-41f8-8315-8c0b9581991b", "value": "T1B515AD4377548885E04D45348DABCBB9E6B17C207B2C43A773B2BB4F6E32AD16512F4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687849101, "uuid": "9b9e1ff8-8643-4786-881b-3f48b4652bce", "value": "de5ffdef0b7fe6105bfe44941d62fcd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687849101, "uuid": "7adb6f56-8d36-47d5-9f37-7f463942f0cb", "value": "12288:77214bUY0DpDE3T51qviizQBODAFZCYylk25ZERX7s5Zx5Z25ZO:H+3wT5kRzAFncToc5Yw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687849101, "uuid": "20ce668f-45c5-431e-b979-78381599d12c", "value": 956928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687849101, "uuid": "9623be3d-adc6-4084-9e88-da70e72a9d2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687849101, "uuid": "48dca038-99a9-46f8-8835-868a378c111e", "value": "ec26f3d39e4631f0b6aca3366bc3620a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22039422-14eb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1687871061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687871061, "uuid": "bdafceb3-9880-4141-b0a3-0ace7394fb85", "comment": "Malware payload (RemcosRAT)", "value": "d369e18ec4048062a567171eeae2cecd", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687871061, "uuid": "931a17d9-6ba2-4a76-8946-20aaf0c8c04c", "comment": "Malware payload (RemcosRAT)", "value": "57ad4237be228935df14ea78a2f0ddff450d621541316ef06d043e962b9c8d66", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687871061, "uuid": "1bd7c78f-c45c-4cd6-a7e0-bbc6f052c682", "comment": "Malware payload (RemcosRAT)", "value": "08924b6f72c9729b4195bfc4d0181e869a17508d", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687871061, "uuid": "05ccf3ef-d6c3-44a2-85b7-cc3a16f979a6", "comment": "Malware payload (RemcosRAT)", "value": "f39de6980e620381e75226d5827e70773701e3626ab231a01d048ce9f43eefdcaeb594ad6d64b324b14b2d7491a7eba4", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687871061, "uuid": "bc404d75-bccf-494e-adc2-2aa791961b28", "value": "T188452261EBA5C0A7E1F665702A34622F25F2F06310B9075B73DC962CAB47BA0DD1F712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687871061, "uuid": "e39a8c93-d777-4aa9-bc67-2a6006f8c043", "value": "6144:nYa6lYz84WE8fYunZTkHvZjzuaadQOACZx7vhTTFgARS0K2zYN9mNNn17M7Qsxst:nYQz8Y8RToZxai2R5g8uXmNfGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687871061, "uuid": "8ead2f34-6d1c-45a8-86d4-1fed133054d1", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687871061, "uuid": "e98a1794-e5a7-4186-b6ce-66c26b869118", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687871061, "uuid": "ed8cde66-c1e4-4fae-bfd6-8706c3eff622", "value": "AWB, Commercial Invoice, Bill of Lading & Parkinglist_pdf.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aa476c5-151c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687892121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687892121, "uuid": "42fe17e3-be0f-48bf-a2d2-53e50559e273", "comment": "Malware payload", "value": "f49edc0723d7aad93a3e3c159f3ba14d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687892121, "uuid": "4a6000ab-0c6f-475f-b4d3-ee66a4572e93", "comment": "Malware payload", "value": "585c6b46aef6762d3ef8d39436cb48fb895976acd89489bdb7b033ca6cb3cddc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687892121, "uuid": "2b400343-8aaf-4531-94a3-9e6a80b264d5", "comment": "Malware payload", "value": "e4ab6f5b4c4bdc727e103f3d629ccaf6174b49fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687892121, "uuid": "048b48a6-ad1a-434b-8032-500812537f9c", "comment": "Malware payload", "value": "d2594f6986bae3f52bc3a051892e371aabea38f4867a41b4888cb77df7a5627c85037e1c32f08ed7b38af50f5ef9d03c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687892121, "uuid": "0f5d2b57-69e7-40cd-889d-faa89cc8971f", "value": "T1F93302D3F965469BF8122F75BAB43EBFFEA97988C80482C1C4150C6BD12111C3739E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687892121, "uuid": "54cf672c-0f62-44c1-a2d5-445f95ca3ebc", "value": "768:ZtaQTaH713lKeMMrnPyoll5CRBZ/R0F4RksK9P2j4nyuOP/QEnVnhiNFY19j4/0Q:3aQiZDMyqIlMBZ/R0F4E4kcHiNq98wG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687892121, "uuid": "bd73c5b9-e3de-42f8-a0f4-d000cfc4c524", "value": 50400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687892121, "uuid": "c32fe498-06e8-477c-83db-0178830e82c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687892121, "uuid": "55e65a46-2fc5-4225-9cbe-25e10f25c975", "value": "SecuriteInfo.com.Heur.20230627185342439781615", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4988c306-14e3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1687867691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687867691, "uuid": "00e9cc03-1b2e-4120-b2f8-5f394993082c", "comment": "Malware payload (STRRAT)", "value": "aaffc5262ba30e3ea20e6195f39d021a", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687867691, "uuid": "f758ff2a-3419-4aca-916e-e9f89564f67a", "comment": "Malware payload (STRRAT)", "value": "5c06e1544f6e3c1b235bf9a2c720e07a8a46253882d7d8552d42f472ad638109", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687867691, "uuid": "a866bc27-bd09-4e06-816d-79d74f0d0bc0", "comment": "Malware payload (STRRAT)", "value": "93e3c3e08b0ba58374957299a74b68155e4f334f", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687867691, "uuid": "1002abb1-bffa-440c-9a38-fb8960e72104", "comment": "Malware payload (STRRAT)", "value": "5b079d569c55449f8ed77ada3093e571347f173dd3728d78ec53ffe3d40c20e9cc178a7a971a0e5d8defa8e54ead25a9", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687867691, "uuid": "bae5dd11-92d9-44db-bf85-0f1cef2d61cc", "value": "T14A24010B3EDAD0E9D2171071005A82B5BA1D44A5D50BD76F26FC0C9A9EB4C2E8B52EDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687867691, "uuid": "eb30b66b-2e2c-46d4-81ce-0ab09eb4e5c2", "value": "6144:NhfBco5zzHNroaMYWIsXwKH3gpQQ89+dny:jOEzNcalODH3VQ8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687867691, "uuid": "da3a655c-11fa-4eaa-8c9a-4f60f97e4238", "value": 223512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687867691, "uuid": "19ec4fea-6e36-4be8-b6fa-a1a1c7b77951", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687867691, "uuid": "56b99d70-b0ea-473b-84cd-cae60d1bd0be", "value": "Solicitud de cotizaci\u00f3n #230627.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84f4c00b-1482-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1687826130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687826130, "uuid": "a46c62e0-65c0-49ee-b843-c027a57d6e04", "comment": "Malware payload (Rhadamanthys)", "value": "ae9991a02aa20ebbc2cc3c0f40924442", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687826130, "uuid": "173b7e34-ecea-4185-9e27-fd624e8d6543", "comment": "Malware payload (Rhadamanthys)", "value": "5c38a5dd3703b1c4b8c2466b18ce9f4c45ef4c9bf6c3096bee8b24d20ecd247a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687826130, "uuid": "4e6948bc-12b4-4b88-8bde-581a80202392", "comment": "Malware payload (Rhadamanthys)", "value": "f9a563d92d1ab148326f1b1f2b8d5ae70c0c6ee0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687826130, "uuid": "979b5865-68ee-409e-a3e9-4ae7d6e3dc4a", "comment": "Malware payload (Rhadamanthys)", "value": "d9fffdd684c66938aab8cc0f9467c9b566fc69080b55441ff8f11feab0b5c0199b7ddaf5c62e3613840d3e389733c7b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687826130, "uuid": "9eceaf5c-5213-44be-82ae-bb89974ebdbe", "value": "T14755F101B5D1C072D472253209F4EBB66E7EB8314B6499EF57E80FBE4F206C1D631AA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687826130, "uuid": "d44a4783-7b79-452f-9aa7-9db5bbd8853b", "value": "1e5efd483892326cc4eeb97bc14a6266", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687826130, "uuid": "270ddf31-70a4-418d-baef-e8838bd6a852", "value": "12288:PVon2T2h6bhdoDJdZuQU574H0HNfusW2wvpwSIDMUF3cTOq1Ni:PVT2oPaJfCAKfu1DBwjPcT51s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687826130, "uuid": "63eda83a-5cc7-4080-bac7-1891494776d2", "value": 1390592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687826130, "uuid": "49156a17-e8fa-41fc-bb47-11c0e4a5a75f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687826130, "uuid": "627fef74-eb8a-4499-85b2-61a231f44717", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b05892-14b9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687849665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687849665, "uuid": "e5ab7d44-5f4a-4cfa-9987-836f0f67a36e", "comment": "Malware payload (Loki)", "value": "bbd76370ac91e9e7ee832b127afc4d2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687849665, "uuid": "efe7a4d5-a2ec-4f09-a665-56716eddbccf", "comment": "Malware payload (Loki)", "value": "5c84b146af428dfe9237101f85bda6b13a05c0019c57257f7fcad564c71a7e93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687849665, "uuid": "6c1257cd-cba5-48af-8f46-180e0eb040ac", "comment": "Malware payload (Loki)", "value": "5a1dcca9c5b27b7e29ed2fe7009bcef7a9e9176c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687849665, "uuid": "a4765c9b-9ab0-4159-9a85-2a124f33188d", "comment": "Malware payload (Loki)", "value": "2f85448c8a7cb4f5eec7bd9b174e03c9762eda5b4f4097d877b90fc8b9b477569ccce9d24d6b2c882ffe3a1635e97de1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687849665, "uuid": "c8be1aa6-5510-466a-b31d-9755e4746560", "value": "T1DCB4493C08BE2A37E078D6B58FE58063F450D47F39295A36A4C7CB556706EA229C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687849665, "uuid": "2ffd5f73-bfee-412f-989b-da9c48de920f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687849665, "uuid": "428dc181-fde4-42bc-a20d-be979c7cdf3b", "value": "12288:ZVf8yqvrGXHc3OZ+AgtqNmuU1Pup5cpV6:ZporGXHc+egNmu8upupV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687849665, "uuid": "c84d1f1c-c8de-402a-b7b1-29351e27717f", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687849665, "uuid": "c26775cc-0781-43ea-81e6-aa97a3d53bee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687849665, "uuid": "585859ab-7257-4e2c-a99a-dadcca3cbb7e", "value": "bbd76370ac91e9e7ee832b127afc4d2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "748958eb-14b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687846289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846289, "uuid": "5ffce29a-ac20-4841-a375-a21edb294a20", "comment": "Malware payload (AgentTesla)", "value": "98198b2e5e78a4e9d74c3ab3134bad92", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846289, "uuid": "96a9c8cb-eb0e-4eee-9395-be38dce901d4", "comment": "Malware payload (AgentTesla)", "value": "5d0e819a624b53524558b2e89007e0a645123a0e401a4dd5c2e5f709730e8f0e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846289, "uuid": "2c4d6a7b-c563-490a-ba8a-04fb4c0cf16f", "comment": "Malware payload (AgentTesla)", "value": "1bb0bbe7f9b82c3488a240d0add3513ae4e253ae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846289, "uuid": "ba308078-da36-4385-a522-3bcdb241984f", "comment": "Malware payload (AgentTesla)", "value": "75b78784f3b80694ae8caeae93930c3a615caee35ddd649e02ad4bfa6f83b67eb03553c199d7ea74c2f9e2e60231c183", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846289, "uuid": "188aa032-f584-4ea5-a0a4-071e2a77b245", "value": "T168D4593C0CBE6A37C178DAB98FE88463F450957F39225A32A4D797548706EA325C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846289, "uuid": "18c81b6e-8664-4208-af8b-23fbad0e5f2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846289, "uuid": "09994573-718c-4252-a530-ccabf7574f9d", "value": "12288:m2iNiHTJiETbJK4Rk4PA8OdIq77P4owwXUTrRZx:m1AzJiE3DgL4o8Hzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687846289, "uuid": "081dc32e-0bb0-41a7-8c73-a8a1154dd94c", "value": 607744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687846289, "uuid": "5bf43ebd-8225-4b06-94c2-ef67b7ca72ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846289, "uuid": "3d87d865-9c3f-413f-9e07-fdd3311967c1", "value": "PO-230102 .pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e1be94-14bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687850534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850534, "uuid": "06433f7e-0c99-45bd-8f28-e935fe9b0c2a", "comment": "Malware payload", "value": "632c38d693ea3647761b79e7880d9a7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850534, "uuid": "4b351f2d-dd68-4ccf-9d1f-e9f15cf3dff7", "comment": "Malware payload", "value": "5dc64de09c601fd34fc8cbceed6eea6c2df0e3b5b9bd31600f5e187b8e223055", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850534, "uuid": "6297c4d4-5ffe-46b0-8bff-dadfb0cc3536", "comment": "Malware payload", "value": "1093c32def10549949bdbd30702ae2f08828ff75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850534, "uuid": "4aa96759-f066-4517-b430-41a09df81d95", "comment": "Malware payload", "value": "f7205902205bd6bee148516ec3ac4ff7aeaa96b2470c27b53b38b6277792e1283a915dc4bbe2659f43bd1b9e5e75e790", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850534, "uuid": "89144666-f321-4c7a-84a9-3c668bd35dbc", "value": "T138338D1433DC8262E4ED1B7D9C7219800332B2BBA657E71D19C6A5AF1CB337487457A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850534, "uuid": "72c62491-7394-4bee-a6fa-584339f130e1", "value": "1536:RyiIMjUOybvqDqefxSwTJUnSX5KH20/IgW:0vOyeqefxSw1QHJIgW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687850534, "uuid": "b1ff40be-dbc3-41c2-b5cf-5df58ad26a0d", "value": 54272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687850534, "uuid": "7112cbfb-c155-48f7-8945-e40bcbafe30d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850534, "uuid": "ff95682a-e7e0-40fe-95b9-e87dd0f9fcef", "value": "632c38d693ea3647761b79e7880d9a7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25712739-14d7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687862477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862477, "uuid": "cd10c7b1-f2a1-4a10-89a2-6419cdcd642c", "comment": "Malware payload (AgentTesla)", "value": "535472ea19b5990c26852462d7635f05", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862477, "uuid": "79635057-845a-43d4-ac21-1cd103a2bf48", "comment": "Malware payload (AgentTesla)", "value": "5f6f7213190e70f29facc25878e3a95958f48e78796dd01410a2c633314bf229", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862477, "uuid": "1be2561b-493c-4d28-a699-1054d734b11f", "comment": "Malware payload (AgentTesla)", "value": "29408611e3d46f9bed5112c0f12968cfcc3f3dfe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862477, "uuid": "bcbf7acd-a231-4768-bc1f-71feb12210b6", "comment": "Malware payload (AgentTesla)", "value": "9a9ec6edc21716895975ab92262c68e1828667a3e00fc74bdfb04517182888bf4270fa75791f75d7d7f07ab48b8c015a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862477, "uuid": "74bbb8b5-216c-44e5-addc-6dbcfa5cc3d9", "value": "T1FAC47A3C0CBD2A37C074E6A98FE5C463F554943F39229A3268D797958746EA325C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862477, "uuid": "16e68b81-7206-4736-a71e-24a5522740c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862477, "uuid": "41929385-96b5-4504-90af-8fba796e2f05", "value": "12288:lhpT98es/HtUaAdbGVns3KwOV1PzxcdF7hpy+Sq:lZJs/NUaAdbGVsaBntKhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687862477, "uuid": "d7750f53-9c3d-4296-bf70-322d93eb8283", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687862477, "uuid": "d61105b8-a2a9-40d9-8616-ced4266012fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862477, "uuid": "246eac4c-bcb9-4a82-9f8e-d8cd29f9b7d2", "value": "535472ea19b5990c26852462d7635f05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6599ab82-14ed-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687872033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687872033, "uuid": "e339a0f0-f72c-43ea-b7f3-85a65a68708d", "comment": "Malware payload (RedLineStealer)", "value": "19e121aa0354c0b184a2287a17dfa229", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687872033, "uuid": "300efcc2-c981-48a3-ab60-8e8aeb7b7c8c", "comment": "Malware payload (RedLineStealer)", "value": "60f326f78fc53f1aec8af6c50ae573f451cd6ad35e1763613cad940c244813f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687872033, "uuid": "69d5f2a9-1286-4235-943e-bce8bb302011", "comment": "Malware payload (RedLineStealer)", "value": "d13af6eb6db79b6f2c93001879959a3485edc107", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687872033, "uuid": "52252378-bfd8-4a1c-a20e-4771ca0e5922", "comment": "Malware payload (RedLineStealer)", "value": "df870d3d74fa85c0e0fef449998f88ee6c6165dd4196897a30e628dbe9398ff356121fa49c330a52488236bdfc42f551", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687872033, "uuid": "32b58af7-901a-48b5-950d-528fcee6867a", "value": "T188847D3392F17C50E9264B72DE1EC6E87F4EF6538E6D776622189A6F04B01B2C263750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687872033, "uuid": "6f025881-f51a-4fac-83e4-a810da3335a7", "value": "4cb73e7166b3b7d1d1133e9f0d5a861b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687872033, "uuid": "f81a0f93-e515-4c4a-b454-c1c7e46362a6", "value": "6144:wnWxr52qnJAQ1e0TInuS4nVK8nAautsnVE5Y5+:wwF2UKaRQu9MEwtB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687872033, "uuid": "e6772728-a03e-46ce-acd0-7a68f0c4a826", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687872033, "uuid": "0a0aacea-a861-49a0-8367-ba4c767edf8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687872033, "uuid": "5d33331c-536c-4a13-a146-25aa424390ef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ca66820-14bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687850517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850517, "uuid": "45f2b769-be89-4482-bbff-7d4c0c031bb7", "comment": "Malware payload (GCleaner)", "value": "6a970ced977afbf10ce8f6de7bd88463", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850517, "uuid": "cc1a84e9-b015-4f59-a2be-3fa81c96ee31", "comment": "Malware payload (GCleaner)", "value": "627f8951741dd0a34884569a76db355c1100d5cba269d65731fd410ef2690fe0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850517, "uuid": "e68a2d26-e92a-4dfb-b249-01f8eb77d775", "comment": "Malware payload (GCleaner)", "value": "98f16d71ecc9b1cb4bc7c8efb7a5742a3fb6f585", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850517, "uuid": "a304ee5b-74f5-4aae-95f9-0cd30521e28b", "comment": "Malware payload (GCleaner)", "value": "5202bbd9b92bfad45f90d7362bb282e038114341225c16fcb17fcf11691b942fb7c4d9db08c9704896dbf6c81fef556d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850517, "uuid": "76bee7b5-e8ed-421c-b093-359042e777ae", "value": "T1A6649E1352903CA0FD255A328E2FC6E87F9EF2604F593B6662685A2BCC711F2F533651", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850517, "uuid": "313e0795-4a9d-48db-97de-7c5b8afa7126", "value": "2374c2e3effb7cec5b64d024cc2c8613", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850517, "uuid": "51efe152-ea0c-477b-8cba-a1e8507063b0", "value": "6144:NH6tze7zHmGqygj/JE8+y7/K8v5mqguFJLh:EaGGqZEhKvAqNFJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687850517, "uuid": "463295e1-db16-4681-83bd-aa5c5cbb7d3d", "value": 324608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687850517, "uuid": "0e809233-a8b9-4c8f-827f-35bb03d0408d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850517, "uuid": "b25fe926-2eeb-44f7-87fb-312f81819871", "value": "6a970ced977afbf10ce8f6de7bd88463.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d5fe8c8-14b6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687848317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848317, "uuid": "97295f00-6f67-4e21-b6e3-999daef5ba6f", "comment": "Malware payload (AgentTesla)", "value": "32a6577bebc6f3e33e0c8222b24bea3e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848317, "uuid": "d6d98c5b-fb19-4507-a18b-8067f20a944c", "comment": "Malware payload (AgentTesla)", "value": "62804130bd52854d369a3586de018287087aa07d7b5d5e3e851122be331b1200", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848317, "uuid": "cd23a7ed-0673-4e68-99a0-6d871931f406", "comment": "Malware payload (AgentTesla)", "value": "dcd0c99d8526d73e92c201494c3b9ba90b4f10e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848317, "uuid": "6c5accd0-8063-4fd0-8279-04a2e2cedd36", "comment": "Malware payload (AgentTesla)", "value": "6c1355d874958848aa735eea64e5a4d2a7bf8d07600905ebbac3691e3cda9c38807ede31f9a805932df273bb5dc7b448", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848317, "uuid": "7b978e2c-e523-487a-bd9f-f108646a5341", "value": "T10574BF0032F89756DA7E6BF45AB1E16107B6BC6B9A31D20D0DC634DB2AB1F118DA1F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848317, "uuid": "60d28759-497e-4141-aa26-9df01e21ddca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848317, "uuid": "c526e1a1-01c1-458b-849e-75a170ca6337", "value": "6144:2jdw4etGyKAMuPzNfZK04jZuKqSuuLn1OABoXTff7fJAaFNhop:D4esyKPUz5ZKXqkn1OAeD7JAO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687848317, "uuid": "40516c80-25a6-4245-b5bd-0eff48afd75d", "value": 356864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687848317, "uuid": "e5df4d9a-c1ab-41a9-ab19-7b8ab004ecda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848317, "uuid": "2847c33c-88cb-4bfc-8065-5765081a5abb", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fac6040f-14b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687846514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846514, "uuid": "e27efd76-4e30-4669-b1c0-71ca630f1e56", "comment": "Malware payload (Loki)", "value": "925612a8443edc7be73b18c8bbd84027", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846514, "uuid": "73831a02-9178-40fd-ad02-21e7a54e2f84", "comment": "Malware payload (Loki)", "value": "633a98d383c22972ea44c78b7197db5067025d5fc34eea5fb83d62346bed3a76", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846514, "uuid": "f1dd2c77-596f-45cd-a217-c8ebc04bcc09", "comment": "Malware payload (Loki)", "value": "f3dbc7556a638219a11eb9cb595ba03181d349dc", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846514, "uuid": "d685c8a0-b7ac-4a6c-bed9-68496519c4fa", "comment": "Malware payload (Loki)", "value": "e43daf3cb941165231e969fadc8f3db6ebd052230bdb544e918930cacc0d848aa49e5eaf95aa0aff8d6a7eadf4658ea3", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846514, "uuid": "c928c4b6-8805-4686-b34c-2cddd7228066", "value": "T15D9423AD61EDE4E9EB7117863C55E1ADA0FAFC4C03D2ADA478B6400A07DC72E513E48D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846514, "uuid": "742a88dc-7998-464b-b9b3-782a6c8dfd5a", "value": "12288:nlrJNcMdMft66aVrhVj76zoJiO938RQ7pzQNaAFJf:nlU36lXRKE5maAFJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687846514, "uuid": "9b971c34-999b-4a8e-b527-e86096287e19", "value": 448013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687846514, "uuid": "3ce47ac5-84b4-40da-bb8f-836fdaf390ef", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846514, "uuid": "37897c78-4f92-4263-b324-9917ba9bb4f1", "value": "DHL Receipt_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01141949-14ec-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687871435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687871435, "uuid": "db4d3904-ab80-42bb-b588-2040e2779650", "comment": "Malware payload (Amadey)", "value": "73423b603a3a819764da2d2892a610a1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687871435, "uuid": "37ae3602-976d-4c35-96ad-ec6655f7abba", "comment": "Malware payload (Amadey)", "value": "63ffebbe4a88dfcc781e6d38de5cbffc7fc8f938f9f230352f4f31a6c6eee1c4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687871435, "uuid": "73a018f0-803b-46b3-9e80-4783da5df580", "comment": "Malware payload (Amadey)", "value": "37894a72f197b0d45c66b686bb29bf059329310e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687871435, "uuid": "8618ddd1-8d6a-461a-b195-826dd0454616", "comment": "Malware payload (Amadey)", "value": "7bab88836b4376a81a3f72b80b5a104eda88d003cb6a10d94ef394f3d067e7ebef94fdb994a8c8c1192a9fe8a7e60acd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687871435, "uuid": "3409cdaf-5eab-48d6-8b87-9ac00d378220", "value": "T14516125EDFCF4CB2DFB845F50CE794E88D2CA0772960AD9A229C1A6B072417D382197D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687871435, "uuid": "7e229410-82ed-4c6e-8181-dc2123fba817", "value": "a95574c9913dbea82b8cba27ffd5141d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687871435, "uuid": "aed31656-3547-42c4-9881-5166d15fbca2", "value": "98304:fj/xb0tfRGDCgVG+Rf74pVwX+5DEpraStT:fdQtRGzVGeT4pVwX+5DEdaS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687871435, "uuid": "32c0deb4-f528-45f0-9d7a-320df31c200e", "value": 4085384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687871435, "uuid": "0091e6d3-1bed-42d7-b3d2-2f7be7f59832", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687871435, "uuid": "c622dd2b-8a27-48cf-ae5a-fd4475d7d233", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cae9857c-14ec-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687871774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687871774, "uuid": "59f60776-e889-4c8f-86f3-c6d7bc420135", "comment": "Malware payload (AgentTesla)", "value": "5a56e52399f81893e2677de995012fdc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687871774, "uuid": "486f4ac3-7e7a-4ccc-b4af-e4b6a673e5ef", "comment": "Malware payload (AgentTesla)", "value": "64967a2c331ec6b964b60c708f21c9343409f6d20770cf6f2a95da1aa2883e97", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687871774, "uuid": "c853a63a-44ea-4cb5-aac3-93299cdd3460", "comment": "Malware payload (AgentTesla)", "value": "38ecb5e5caeb7d39cee022b9a8c9a6db99505839", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687871774, "uuid": "ffa2e72f-443b-464a-9214-fd44ba7848f4", "comment": "Malware payload (AgentTesla)", "value": "0a5046f730f037862fa3e34ad02e43b1a31fc50154e4b4654143e33140c4393673de89fd67a881ba98567c883bfe4d4e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687871774, "uuid": "661db112-7de0-4524-b2f4-8640160a5f4a", "value": "T120B423F639F24AE91265FCB67200791CD7F3194156309B4264EA9FDC7E08A45B8F1BC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687871774, "uuid": "aaa746ed-fb24-44cd-89a4-ab643dabcbd5", "value": "12288:qA7R2k8Q6Qr12W3nojXn0YFEClpxOUxXzq2mCB:qAEXQuQojXr+4HOUme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687871774, "uuid": "a0beb76b-191c-465a-8c97-7dbdf0e11d0b", "value": 495361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687871774, "uuid": "f02e4367-33f9-465c-a7eb-a1b2039d0949", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687871774, "uuid": "c2dc510a-e4ca-4a37-b391-05ea11664cd0", "value": "57m\ufffd LPG SEMI TRAILER 7 NOS.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ce76071-14ca-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687856933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687856933, "uuid": "a9353a4f-0682-47d7-84ae-036c708d539b", "comment": "Malware payload", "value": "6b26692eed339c9f798fb246617768ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687856933, "uuid": "cfa046e7-623b-413a-afd8-aad2ba285abb", "comment": "Malware payload", "value": "64fc496019ab38b82334bdeb9b02cc80829bb362cc56705eecf83972d9f84412", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687856933, "uuid": "540e05b7-8a0b-47d9-9b89-8717aa51fe63", "comment": "Malware payload", "value": "913b3cd3860375d605c3eba876f362eb0f94caba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687856933, "uuid": "56bfe12d-6624-4284-a928-8509feab342e", "comment": "Malware payload", "value": "f49cc4a198613561c45f98703087e77a1be242715abff150944cf481daaae6db7e320aa8d58c11a177ffa1cb9e38ab82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687856933, "uuid": "cc1312c8-b484-4f06-8946-430534ff2264", "value": "T136151202BEC299B2E0661D335B656B10693CBD202F65CEDFA3D41A5DDE215C0EB317B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687856933, "uuid": "3b076697-d9f2-491e-a151-d86e48601c32", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687856933, "uuid": "a3e61fdf-f1e4-4665-be32-87aa02d8c316", "value": "24576:2TbBv5rUyXVXcJApapb36Ea6zjckIMyPADtuCfbff:IBJMKgpbiojIbKuCjff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687856933, "uuid": "32da4ce8-bf45-44a8-b67d-5a40543b9f07", "value": 928853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687856933, "uuid": "d56cf92d-d6dd-47bd-8da6-ec466a590ceb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687856933, "uuid": "f8c2d7b2-eaf5-45d0-8f39-3f5b4126a9ec", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d739843a-14af-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687845595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687845595, "uuid": "c37c6d2b-476f-458e-a724-be405454ef0d", "comment": "Malware payload (AgentTesla)", "value": "2e491b57220c06760d227b5197175393", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687845595, "uuid": "ec0bfc1d-606d-43fe-984a-23ac5a38d24e", "comment": "Malware payload (AgentTesla)", "value": "6673285a97d7ef391c811a7372c1033ce8f117f8f15702782461ff4737636ce8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687845595, "uuid": "5d7508ba-acf0-4a57-8f83-c3d6bf904c43", "comment": "Malware payload (AgentTesla)", "value": "479e6216f205cb33f4f9c7ed53b95112ae119ade", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687845595, "uuid": "bd17c29d-49e6-4b3c-88af-8a61118d0312", "comment": "Malware payload (AgentTesla)", "value": "2e2c336eff96b0ed437aea9ace652498db44018a228d61e68220dceced79085d524a21565952a268309ce862977eeb96", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687845595, "uuid": "bc79651f-6440-47e6-b3cd-7b21f963cc54", "value": "T11AE4373838BD5627D174D7E78FE7E423B6B8982F3021EA2468C657D54686F0225C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687845595, "uuid": "822e30fa-c0d3-4dab-8514-9587fbb7558e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687845595, "uuid": "940d51ef-cced-43ec-a627-b69c5d85deeb", "value": "12288:s5dPG2fo/oq507+FjSm9p/7kAtDrjpgcunDdp3QIWySxV1:Uo07+8mj/tnjqcIhp3QIFu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687845595, "uuid": "0cc7c748-7cdc-44b5-8e87-4141af599e84", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687845595, "uuid": "bb9714b1-56a5-433e-9d77-69cc19c26906", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687845595, "uuid": "d0a16647-5a6a-43b5-ae52-51c3cc55fa3b", "value": "PO#266203.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14897e63-14e2-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687867173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687867173, "uuid": "b711f819-52ee-4d5d-9a03-cde76929563e", "comment": "Malware payload", "value": "f1b681fd77c1cc725cfb0aa504a8afea", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687867173, "uuid": "d3637b99-071a-4482-90ea-82b67cd10e65", "comment": "Malware payload", "value": "69ade76c288737d3a213fb864568088398df45ac3667f36c363a13dd662b5d82", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687867173, "uuid": "0db5d662-8fb6-4610-ba06-899048d0e786", "comment": "Malware payload", "value": "7014eb425d9c9fd8d09cb77fcec371d898e6e919", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687867173, "uuid": "f66a435f-dd39-4be7-b251-57b6e9265040", "comment": "Malware payload", "value": "b1db5ef287f809b65a50e4db32c6452f48124d6cec5f41d46c5d0fca9488c0d5508b275418f72d63c5fe19d16ccf268b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687867173, "uuid": "c7ebc15a-534e-4afa-b756-1077f2499036", "value": "T1A1D47B8AEBC1DC6BC41503B04DDB9725273AF498A383DF4B27A495382C6376A7F8564C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687867173, "uuid": "f02cf42b-b1d0-49f0-814f-7e8db2f52987", "value": "e9ef9b3a65dd6bf58caf965b2eb31e2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687867173, "uuid": "4bbaf4da-2b7a-47d5-912a-9d632ebb9bf8", "value": "6144:aQsPjChP/DWxDmFKP9VCUMrex0Ai/k8XFRFj75GV39OXaa:Bs7Rx6FKP9Vyp17549OXaa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687867173, "uuid": "e4604131-7723-4324-96e6-37bd3008393d", "value": 605526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687867173, "uuid": "129171fc-cfd8-49f8-b225-2df420017c75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687867173, "uuid": "991051e8-516f-45fa-aa25-03d326976db1", "value": "04993758883.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55cd5538-152f-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687900354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687900354, "uuid": "9b14ece9-5fa1-4d76-a2dd-772788794c12", "comment": "Malware payload", "value": "04caaf3af08096c4dc9f4e38ea2edaa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687900354, "uuid": "5ef439db-fadf-452a-af1f-508ca7197d85", "comment": "Malware payload", "value": "6a8f3e9e3f6ba5ab1269257d7e17be994e76b020cf70144e310719337a4158b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687900354, "uuid": "ac9b5cf0-ca5c-483d-8103-1a0a1bdee66c", "comment": "Malware payload", "value": "4b4ede14e2947ac30e051a969e7cc016419705b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687900354, "uuid": "116a93a4-485c-4e8c-a90e-7ec58b6738ee", "comment": "Malware payload", "value": "36cf7fbcea8864881c1f780829a972826ce80786b969aab81c9005f0538aaaef5f829235a951aaf86919682e1a70f2f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687900354, "uuid": "d3d81888-d8bb-4baf-9cc8-48a09ab7d623", "value": "T12FA58E1F9DD9EF82C97A5432C6DF08A098A7D851AF524E237B3D156031272287BD7B2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687900354, "uuid": "541be3ec-8164-4d49-ae73-3ec06954923f", "value": "353a605dd3c09ced271e38d347ff0ff7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687900354, "uuid": "26c2a7de-4328-4a1e-9abf-a461a54884fb", "value": "49152:i7Tibkr1n5gpD/0ieJpMbSoFFZGdnFnCa:i7TuA15g9U3poBGlRCa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687900354, "uuid": "a3d0a9d7-229b-4fe1-8304-d90858e833d5", "value": 2169856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687900354, "uuid": "3b95cfd6-bbb3-409c-a756-3a8329340a6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687900354, "uuid": "d669493f-c849-46a7-9007-81c31b325d5f", "value": "6a8f3e9e3f6ba5ab1269257d7e17be994e76b020cf70144e310719337a4158b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7adc0922-14f0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1687873358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687873358, "uuid": "91fe8ada-0982-47ba-83ed-cea28938756d", "comment": "Malware payload (CoinMiner)", "value": "9fd1506305b26c9371423b21887f3fe6", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687873358, "uuid": "ab0d5146-03b1-43a2-960b-486e3d9909aa", "comment": "Malware payload (CoinMiner)", "value": "6fb30c4e262ddab6ff3891852c92f5cf640e130da29af9e1445f803ace1418eb", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687873358, "uuid": "09691949-17ca-4566-b9a4-118e82d27149", "comment": "Malware payload (CoinMiner)", "value": "3a25409f38be1e73d129458bf718bc9b0cc9dc2e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687873358, "uuid": "67547ef7-c61f-47e2-8338-42aad5082e53", "comment": "Malware payload (CoinMiner)", "value": "b4c1a1070e569de8deb3cbf12dd4052695acc4901a12b0f2d99dd048a385ec64d28fdc973dbb049057658e6d4028d9ab", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687873358, "uuid": "46d3e4a5-ac28-4e3f-b164-3e550f8268c4", "value": "T104445C13A2F17C61E52647729E2EC6F4362FFA508F1D776622186AAF09B11F2C273750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687873358, "uuid": "ade5f7df-a02d-495d-833b-c440ed726e19", "value": "b578e3789f52bf10595635e957a47d40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687873358, "uuid": "e64d204e-2c29-4c09-a04b-8186b6262bea", "value": "3072:7xl2o6C8uspbasIIzjblLI1oQKShSA0C0Nlt5lU6UA8HHMZG/uMSRKx:T2+spbasIIzlLOo9SYC8HkhA8HHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687873358, "uuid": "e40421bd-951d-4b92-882a-1b9b6f1a3a39", "value": 267264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687873358, "uuid": "cfa398a5-69cc-4ea7-bf01-af539a63fb6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687873358, "uuid": "b56bf2a0-5a8f-4c6c-b7dc-36d45a2bc41e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5efffef6-14bd-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687851407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687851407, "uuid": "db345fc6-254b-46e2-88d7-09a5ab2055e1", "comment": "Malware payload", "value": "188ca10c2b3cdf00b0db9a39d24e8ca3", "object_relation": "md5", "Tag": [ { "name": "anatsa", "colour": "#8EF8A8", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "droppper", "colour": "#60BFFC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687851407, "uuid": "fcf188c7-7be5-4c27-92ae-c757af325f57", "comment": "Malware payload", "value": "7231546ee377738cbe9075791eb6e76b7bc163c1b91831e05e81b4756fff4028", "object_relation": "sha256", "Tag": [ { "name": "anatsa", "colour": "#8EF8A8", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "droppper", "colour": "#60BFFC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687851407, "uuid": "53b95e93-37ef-42d1-bfc2-99228b616ea3", "comment": "Malware payload", "value": "e1d4ac63aa5f93b6a84396bb7a2b5b2de20d57d3", "object_relation": "sha1", "Tag": [ { "name": "anatsa", "colour": "#8EF8A8", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "droppper", "colour": "#60BFFC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687851407, "uuid": "8b8ddf52-bcc0-468f-80ad-142b924e40ae", "comment": "Malware payload", "value": "376fee2526f28ae50454b1eb5fc0245197c8255342122bbf89a1841293f175882ed3d3579187976d82765d627a8b4ada", "object_relation": "sha3-384", "Tag": [ { "name": "anatsa", "colour": "#8EF8A8", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "droppper", "colour": "#60BFFC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687851407, "uuid": "64a4bf82-3dd4-4293-9994-5721c084e532", "value": "T17217123AF71D6D0ED833B0B14EE5186504B92C21E7755B626EA8B33B5A334486F61FE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687851407, "uuid": "20348373-50d9-4dd1-8b4b-2ddae6f18acc", "value": "393216:alBg3K3HhF6IM7/uisqsIkN6p2HIkTXtWk2lTO3FQ5SFinGpJgthA0J:alBg3K3BFwXsIE6pbTO3Fv/GXJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687851407, "uuid": "18496931-1006-44d1-bb4a-7f59a1927e5c", "value": 19602736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687851407, "uuid": "cdf2ade5-d257-4425-ba70-ea32050db63c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687851407, "uuid": "c9969e81-d2e7-42fd-84c7-031c83de179a", "value": "PDF FileMaster Reader & Editor_8.8.3_apkcombo.com.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f80ccdf9-1509-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687884305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687884305, "uuid": "a67afb82-3ec9-4221-ab2f-131c571c4464", "comment": "Malware payload (AgentTesla)", "value": "d8a1382a6ba6b919e6fe47bd493bdf21", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687884305, "uuid": "b08cb7b2-3e51-465f-81f4-311c8b085b4d", "comment": "Malware payload (AgentTesla)", "value": "754a93d8bd8a0ad6d585bbf804be6b2f8575796ac3508aba7c63b051bec6addb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687884305, "uuid": "6ed32cc3-ec2f-46ce-84fd-a37f61a7c912", "comment": "Malware payload (AgentTesla)", "value": "ee6878fe401780082e530bfc1146e6e92637367e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687884305, "uuid": "8aa1bf12-d670-4fe2-837e-dc47244ccc54", "comment": "Malware payload (AgentTesla)", "value": "a0f3051e7c6b17715074c9f3e98087221739db29deca000cf4f5b7131d50baa1aed65a4b7dd454bb1308d83dba959da7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687884305, "uuid": "d08e64d1-da55-4e51-9f0b-e8492f6eed44", "value": "T15CB4235D010F1AF0A4826BB6E7DE62AA4DE61C5120356F9BE5377C33502F93436CEAC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687884305, "uuid": "d2e8138d-3fd5-4d5f-9b5c-bff28468f190", "value": "12288:GiX0euZkiMlhE3QMAPT8IiVW6RLI0qHjyAiesw9:GiEe4OkAMAPT+VD6HjyAnsE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687884305, "uuid": "5ad2cb99-d398-4917-a349-efb1f80baba2", "value": 533289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687884305, "uuid": "82f1cbc0-d20d-4844-90a9-9c36c028115c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687884305, "uuid": "4dc21c97-b13b-41ba-9d10-1ea0ce4be3da", "value": "SOA FREIGHT SLIP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53585334-1520-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687893907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687893907, "uuid": "b82a480e-7ea2-4008-b142-e1996c5fc807", "comment": "Malware payload", "value": "30140b84cfc771a419fd8ddbe7992709", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687893907, "uuid": "9ea8b245-2b2f-4212-a0b4-e87680faa142", "comment": "Malware payload", "value": "765390e138f302a7838f75b5c1e416b5376006b786bb3fd101836ba8509e229f", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687893907, "uuid": "7870aabd-9295-4762-9743-2327a10c7dcd", "comment": "Malware payload", "value": "2442bfcaa79d6ad6856be517e55a018c2e178ab8", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687893907, "uuid": "bb6868ec-677b-498c-9bd2-4be148c1696f", "comment": "Malware payload", "value": "5c2ca9a1f8649edcd10e83fbec0f6a1ba3e837bedff841f910f2a669fd9375708b764b456c2f221a8d9743554aa8768c", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687893907, "uuid": "97b1fc19-b60d-48f2-83ba-f4bffadcce57", "value": "T10E65121077AE0013C4BF07FC58A152B113BB7AA6B522CBDA3D5F72E967E5B0645A0B07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687893907, "uuid": "e6de9b07-8930-42b9-a4f7-a1279aff6b47", "value": "24576:X1KNogIGOb7E5+YRFi2gAuXZ8w8WuV8lB:X1KNoYpo9p8w87V8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687893907, "uuid": "a452ee58-e107-42dd-ad6e-fe58eeed5c71", "value": 1441792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687893907, "uuid": "6c835b6c-6cae-4240-940d-efe524fe0042", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687893907, "uuid": "f0f0d343-8cc2-4eef-93f5-b1cb6a13cff4", "value": "n#05-PL20200624005.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a3d628d-1509-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687883933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687883933, "uuid": "1c39a8e1-babb-4cb6-8d67-7b70ecd98ce7", "comment": "Malware payload", "value": "9e56b9c5aa34b057ebe9a7a3ff3c8bf2", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687883933, "uuid": "b4afb954-22de-43f0-801d-9655db7085cf", "comment": "Malware payload", "value": "77db3b54666b168d13a308be378cad1b8bb84db621f8055a03471a254d4c79ed", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687883933, "uuid": "de35e62c-74f4-4420-8d66-e9734e7e0122", "comment": "Malware payload", "value": "dd2c9046c7b4c5d4ff06d2c77bf4fde491bfa15f", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687883933, "uuid": "7ddac9b0-36e5-481a-b05b-f52da2cd1b50", "comment": "Malware payload", "value": "37fb103636c1ea8954d628faedd446ae0c74cd3f7ac932d01f9a117f4dd9d50470b6a59627ac0b87a16742a3bfe08cc3", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687883933, "uuid": "05d9f5c0-2ea7-4ad5-9eb2-3a6e42dbfb5c", "value": "T14A646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687883933, "uuid": "7ca1fe25-f10b-461c-a038-3f6e516e4264", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687883933, "uuid": "2dad8abc-1167-43fb-9722-0baacbf99585", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9mP:5xb8ZqekwkJPaThgyDChXohRRwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687883933, "uuid": "0ee9c59a-40d5-446a-b5a4-591b4ba0b507", "value": 320530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687883933, "uuid": "4f962227-9aae-4ac4-9dc7-683848fdfb2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687883933, "uuid": "fdd0fd5e-9cab-4cde-97c1-8a281deda6ea", "value": "9e56b9c5aa34b057ebe9a7a3ff3c8bf2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3931eadd-14b2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687846619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846619, "uuid": "edabadd3-4421-4c7b-9f31-8e6456230495", "comment": "Malware payload (RedLineStealer)", "value": "e7deb80365c9b5f80f6668b171c790c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846619, "uuid": "daf5eddb-c184-41cd-9991-df7919387aca", "comment": "Malware payload (RedLineStealer)", "value": "79c4819c2c8e76c2498554c3c2ca9d54e2019df92254b5bf7a2d42896ec440d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846619, "uuid": "210f14ab-e9c1-47df-b97f-67b9a57dd952", "comment": "Malware payload (RedLineStealer)", "value": "588b9dc095208accb02e58f64f22e40b33016b21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846619, "uuid": "5ee85763-395b-41d7-a060-3b9b83f33256", "comment": "Malware payload (RedLineStealer)", "value": "6d486443b0ac04f9a8d0e109e0ad603f404ecec94d1f4e4ca89247a2e1d8a06885e2d500987f37db6ce216afb8e4b0ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846619, "uuid": "ec973812-087d-4310-8ad6-7c38067d7aaa", "value": "T17C357D4973A4419DFEA7E176C623CA07D7B178460277862F02E49B766F337712A2E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846619, "uuid": "f8e73024-20ec-4605-9ccd-f35d2e7001df", "value": "fcc64241b6c54450be7b9c57ec0906c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846619, "uuid": "5d8bc0c6-30eb-4afb-b0a3-21fea5ea247f", "value": "24576:EmJZW2wSdIHuiCyhuGaD0y13DrmmfVpd+c2ZAa7ZRaY2D0v:EmJZW2FIOiCIuGaD0yh/zvd+c2ZAafaY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687846619, "uuid": "8389ad5d-164e-47dc-904e-b0b1c5d39768", "value": 1081856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687846619, "uuid": "6c3e8cc2-1370-4a4c-a966-e7d1af42eff6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846619, "uuid": "6a13c443-b79a-4d18-905d-5bd3568ce7ec", "value": "e7deb80365c9b5f80f6668b171c790c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b8bdccb-1520-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687893840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687893840, "uuid": "ce7657b6-f337-4f4d-975a-232bad4b1076", "comment": "Malware payload (AgentTesla)", "value": "f600a24cc55b4c115ebd0accd6fdfbda", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687893840, "uuid": "42c98065-d41e-4700-ad0f-176ec50e5261", "comment": "Malware payload (AgentTesla)", "value": "7acc949f4e01f5ee720f2821349e3a0dcf05a7ac15470a8d7f6ff9aef1d00d2e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687893840, "uuid": "593c38da-9659-4603-b6c1-177df59f4990", "comment": "Malware payload (AgentTesla)", "value": "7ce192af9de8d00fac2aa2bc9eb2ab68439e096a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687893840, "uuid": "c55b3764-429b-4d69-8c7c-6a337deba276", "comment": "Malware payload (AgentTesla)", "value": "a68a1c17b881bfb869a4a3ac9ed91ad2733b12b5a30408ab31b56b8b44952d23b89142378fba18e97d578cad198fad2e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687893840, "uuid": "5f27ef3a-e2cf-4ae3-b311-4ff9fa4e9c24", "value": "T1E5E47B3C2CBD6A37C034D6A98FD5C4A3F444853B3D12A932A8D797A54746EA325C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687893840, "uuid": "11479a6f-9d3a-48a2-8499-1563554bcfa6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687893840, "uuid": "8ef2aeca-a822-4503-bf96-d88fa7da9ba1", "value": "12288:JkuecCrXU6e9uVEvIOYkREszypdknZZOHi0JmoOG3ntNH1/DqnEcUPi:JCIuVgzREtpUcJL3txQYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687893840, "uuid": "e6f6bd11-2d29-4f37-91bc-6b783b071127", "value": 677888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687893840, "uuid": "b01bb090-85ba-43c7-b044-25f8621f8a73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687893840, "uuid": "31821a16-5b0a-4a88-8a54-fe35adf68051", "value": "rcotizacion0299003.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0274f05-14d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687860616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860616, "uuid": "39e7c586-fe23-4cb0-9d73-550efc4e8a3a", "comment": "Malware payload (AgentTesla)", "value": "c077dbc3952dcc24ad99e09fa85427f4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860616, "uuid": "1e40f2fd-7af7-42c8-9b51-46a143ddb796", "comment": "Malware payload (AgentTesla)", "value": "7b9aec8522f9e771314b053eddb934d9d5797905011ae3b5c6d48d0420547918", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860616, "uuid": "bb24963c-29fe-40b2-a5b0-443e980dd112", "comment": "Malware payload (AgentTesla)", "value": "98c4ec4ba6651e4d503fff6c162ba299bcc0e01e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860616, "uuid": "c41b34f4-0f00-48e6-82d2-41b894829e68", "comment": "Malware payload (AgentTesla)", "value": "d138c7b0511778e12142623806517fa41e035500bd15b275f54c393b39a11488e3b26bbd59001dbfbe9fe8f361a20ece", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687860616, "uuid": "4781f46d-e2b9-41ff-9b8a-a01ed95aa2ca", "value": "T167C423A809EEC461386463F3A6837BE587D7D00382D58DEA65073BA85EF1D3D1243D9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687860616, "uuid": "dfe69415-79b2-4af8-bca3-e7c738226eb5", "value": "12288:GRuOrPwzNboEejq3jAksdjFnLo80GS81is/og27ArJh+dqE0YDM+APKo:rvzaJG3jKhF3d1Bf27ANhKn0YDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687860616, "uuid": "14d5f6c4-330c-4ca4-9cd3-00f7d078f3ec", "value": 545520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687860616, "uuid": "30fcb3ec-918f-49f3-aded-79f83c7d30e9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687860616, "uuid": "7a8ccd68-3849-4228-9d56-ef114c398acf", "value": "TT SLIP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63a8251c-1495-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687834234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687834234, "uuid": "5fb227d4-0622-455c-b13d-13f822dad7e2", "comment": "Malware payload", "value": "161b54d2b84e6a5497a36fb844dc5972", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687834234, "uuid": "449884dd-b273-481d-b9c0-86d3b7010e81", "comment": "Malware payload", "value": "7ba7505b93e251ea5b32285b0da00ce741ee52472a4277e1321eb6de3c4371f2", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687834234, "uuid": "937b8c8a-af02-45ca-b7d6-b3ea4320fdab", "comment": "Malware payload", "value": "12c1dc5cf0ecb95689649221a45631b62dc275e2", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687834234, "uuid": "3b3e652f-05d6-4422-a96b-a67fa2aca9ae", "comment": "Malware payload", "value": "7c1fbd89141f8eeea4fe46e51cef3c26e544fd939da1ab2438e99dadcf86312063bb16d3ba08af38273d611dc97430da", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687834234, "uuid": "1a70d808-1181-457d-8cfd-623c2d739a37", "value": "T1A99612DBF798992FC87704B2497E5271225B4D028E839B436C48371C297B6D82F9DBC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687834234, "uuid": "6249aad4-c1ed-4add-a73b-c4311f3fe6c8", "value": "196608:AIc26rFR/+lzq+GNGn020Qu7MFS7w8y1/:VcxrH/+lz5020UFS7w/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687834234, "uuid": "1fbcc1ff-1e57-46f9-ac51-f8b5f43c66c8", "value": 8682446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687834234, "uuid": "4b95b3dc-f7c7-4bee-b8e8-9b8f18f85a38", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687834234, "uuid": "204c5c38-83ad-4b0c-9879-b01cd16ac2b9", "value": "aplicativo.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21a0bdfa-14c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687853881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687853881, "uuid": "1dd4ca2d-adc2-47a4-9522-635345d0cd83", "comment": "Malware payload (AgentTesla)", "value": "30ebc5bb661195c81b6dd31e59f4302a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687853881, "uuid": "da2b7ce9-c98c-438a-abed-e96ac689d68c", "comment": "Malware payload (AgentTesla)", "value": "7c2484919615d020288017069415dfbb589b8052b22439e36707febb425d8565", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687853881, "uuid": "2cd554c7-0d8b-47c3-b9e1-deed08694347", "comment": "Malware payload (AgentTesla)", "value": "557a73ef7fb5f4679c2e634376586144d3947f19", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687853881, "uuid": "754870a1-4317-4c2a-82e2-fee4770d9fe7", "comment": "Malware payload (AgentTesla)", "value": "22f08eaf6d6d4e9f487eccf94d19f7f9ca3e5c309e14994b8912e0b4b9d05ca7597d7bf0a42c0715cf4be6aaa41be9a1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687853881, "uuid": "b148532e-7e46-4d61-9b2d-0ede32003251", "value": "T12B21E7313461B7270CA24CBC4E3DB89092B4EC184A729CBCC5617EC940B7645960015E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687853881, "uuid": "72a4995e-9889-4361-ba6b-25a0a49e5e3f", "value": "24:GZqI8bAQTkgPEl1R613be7y4ezMnVdxdjejDdAiedskkA/6aIRw:GUbPXElDKay4ezMTxByA7ds9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687853881, "uuid": "40703503-c1f0-4fd3-bc54-bc90b76d9dd8", "value": 1163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687853881, "uuid": "4b16b269-30f0-474d-be7b-1301690d405c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687853881, "uuid": "fe4764d8-cc8e-4fe6-97b1-9c32e79c2094", "value": "Transferencia.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39bc1a2c-14eb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1687871101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687871101, "uuid": "3ab07c32-62de-498c-a6c4-6742ad3f77d1", "comment": "Malware payload (RemcosRAT)", "value": "98d52c27d53e81ace5db2d1b1580f6e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687871101, "uuid": "025f17fa-f586-424b-89e4-798d5ad4b416", "comment": "Malware payload (RemcosRAT)", "value": "7cd77a765069b1826b7594f693608500096f6f902c25b7994fa4d58bfe91be66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687871101, "uuid": "4aa348d1-784c-4ee6-b103-77e75131b20a", "comment": "Malware payload (RemcosRAT)", "value": "3c26d3f12e2cf87a3d6c58d1b0431504587eca70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687871101, "uuid": "ad74932b-013f-4e39-80cf-aea4747a5668", "comment": "Malware payload (RemcosRAT)", "value": "605db96db596af8a57586ef8fe28cc5a29ba58cea5f96c45556e26d60873c3494721753b45dd93adb7a7f7b7a15ca3ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687871101, "uuid": "8cf08eaa-c6cc-4c02-9829-3aeacdcec6e6", "value": "T160B422B1EBA5C1A7D1F265702A34626F25F2E0A31479075B73D0CA3CB947BA0E91F712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687871101, "uuid": "a4f65601-1411-465d-bb4d-64057f17570b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687871101, "uuid": "f75bd9c9-e53b-4379-ace4-5f56913cacdf", "value": "6144:zYa6lYz84WE8fYunZTkHvZjzuaadQOACZx7vhTTFgARS0K2zYN9mNNn17M7Qsxsc:zYQz8Y8RToZxai2R5g8uXmNfGA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687871101, "uuid": "d61aacbd-6de2-46d0-8d22-c654e126f7cb", "value": 495629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687871101, "uuid": "a26b4062-7a24-49de-ab24-36441fb83ac3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687871101, "uuid": "5e79edad-74ab-4846-a1c6-2d6d5a79e111", "value": "AWB, Commercial Invoice, Bill of Lading & Parkinglist_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5596fbe-1523-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1687895441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687895441, "uuid": "32e776dd-9dc8-4c41-b537-1f4f52d9d510", "comment": "Malware payload (Rhadamanthys)", "value": "af1efddb3afaf3bf4d121a9d4c7e7d68", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687895441, "uuid": "5e25faa8-f73e-4aef-bc76-3adc7b44688d", "comment": "Malware payload (Rhadamanthys)", "value": "7d2102bb62f4eb41eac647e66f4f37eabce90eece6e0589603108b03ebfe300c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687895441, "uuid": "2b757efe-156e-4f37-854a-ed44f8a6b90c", "comment": "Malware payload (Rhadamanthys)", "value": "f9943a72ca72fd7a7a3495d039cf37a0decb3998", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687895441, "uuid": "2be12f81-6095-4af9-91a3-c03017701b0a", "comment": "Malware payload (Rhadamanthys)", "value": "56fdb1aff4bb35dc18f0994a9accdf0cc93e2de3d4bc9bbd4eaea4087bf61873e9bd94289d40c32ab2fc3e575ac74985", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687895441, "uuid": "d793dc47-9782-49c4-848b-b6dc2f7acc28", "value": "T192A44CA6BBF1AD84CE8D23F388146BF4069E437645F2D2D84D295952273F669CB0B13C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687895441, "uuid": "9c920092-7e17-47f0-9425-bb45d8ae5e9c", "value": "c304949191802a43e7e86d8fe3dcaf65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687895441, "uuid": "fe2a91cf-7c4e-429a-bf12-f23f34b0a7b1", "value": "6144:IjKvnAzRPqkroWhcrTIhB1uA2dOJhhgWbMbitWGFNuldsfiy3NiGA:Ijzgk06oIuA6ahE+F0/y36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687895441, "uuid": "bf737930-5ea5-4c43-92a6-1b846e84bc9b", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687895441, "uuid": "548bab0e-1af0-4871-9af6-eb0d1f64b84f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687895441, "uuid": "ad5fe48e-95ad-48b0-95c5-20677f0cc8c5", "value": "af1efddb3afaf3bf4d121a9d4c7e7d68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ed3aed-14a4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687840919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687840919, "uuid": "b1312fa6-7ea6-4362-9609-03c59c1effef", "comment": "Malware payload (RedLineStealer)", "value": "3d817fb8c4f9ffd35b2d9f9db6667b7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687840919, "uuid": "7f8a1bcb-6e2d-472c-afbc-846bcf4977e8", "comment": "Malware payload (RedLineStealer)", "value": "7ddaf52a889a848fab1ac30bd0987e39d85a0e2bfe67492f02a9b91266def326", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687840919, "uuid": "eddd870e-9030-413a-bd71-7cad1c191a2e", "comment": "Malware payload (RedLineStealer)", "value": "ee3aa7c63fad34d6a706e63857917b208aa6c8c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687840919, "uuid": "10697c34-95d8-4002-98b9-bff40c344cb9", "comment": "Malware payload (RedLineStealer)", "value": "e93b196f52e1be7b55a25dac4ccb4c73b633ae6614d96545fa3c6391295555ec9abdcc386ac2a8e1ca276e58c7e28fae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687840919, "uuid": "67792e15-4ad9-4803-8b05-1bde6d381929", "value": "T11264F11176A0D872C84745314825C6F86A7BB8709B78C6CF73982B7F9D702D19BBA326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687840919, "uuid": "f33cf64d-38fc-41e5-9fba-13db0917251f", "value": "6be0f5f4cf6bb40603faf64d65d5ff40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687840919, "uuid": "26d9fbbc-053c-4256-a29e-33810cab3f7f", "value": "6144:+s+QlFCgcXme2ZvOR44O/UsXTJ24L/qfNH:NTPCbXmVS44w/NG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687840919, "uuid": "2e8a7924-60e0-4f03-a283-8365c550b296", "value": 330240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687840919, "uuid": "ac5260c8-2bee-4927-8344-43f89870145a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687840919, "uuid": "061d3c2f-cce9-4500-9164-7fa17da3c3d3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eadb6bb2-1501-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687880847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687880847, "uuid": "25301255-3fd4-4be2-b7aa-5b281c33134c", "comment": "Malware payload (AgentTesla)", "value": "d0b147d7e068909c8e48a1a77ffeacfd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687880847, "uuid": "52a89f71-d625-469b-a4ee-df8ad1c705c2", "comment": "Malware payload (AgentTesla)", "value": "7e7f1d18321207cbaabea3f8c316d13c13dbfae51a52a42c5a9d3c5478f75454", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687880847, "uuid": "68ec4b7e-5bcf-448b-9b77-b878b6113cf1", "comment": "Malware payload (AgentTesla)", "value": "1838f7842aae2358c31c056c9f5afa63d65762d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687880847, "uuid": "adee5530-7d60-4414-8ef0-c49222ed7a8f", "comment": "Malware payload (AgentTesla)", "value": "e015d717451daed9339fbd3559d02b638b951b302e8d7eddb953b2ad6bca36b927e0df5710b91a18d6c65208666e0f1c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687880847, "uuid": "3ba10064-5164-40d1-a40b-440e441c69d9", "value": "T18915F63B68FD5AE6D06CC5B98ED5F36FF4109C3A28219D226C92F7544636A9220F313D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687880847, "uuid": "93f2cf7d-1e31-47fb-aa17-1ce8731a022c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687880847, "uuid": "a970b2a6-c275-4121-81ab-b1ac1a9539e7", "value": "12288:Ee85jky5rfh/YCD2viOuwe9NxGcj1nBxSSTtORJhtLu:EtxkorB2vvuz3rBzSMqhu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687880847, "uuid": "e94aa391-8ab8-48dd-a147-cd7dbdb55732", "value": 949760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687880847, "uuid": "a1aee47a-a039-4fd3-b819-34cfdd5a2b29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687880847, "uuid": "349d6481-a1c4-4897-91f3-6ff09ee97182", "value": "Invoice_Power_045687_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57fefcc1-14e6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1687869004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687869004, "uuid": "ed9087ca-17c5-4a9e-b939-5a28916b214f", "comment": "Malware payload (STRRAT)", "value": "5163df6fc307a8bbb4ea8639f46660c3", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687869004, "uuid": "9bc5beee-11b3-4a0c-851e-05aaabeaece5", "comment": "Malware payload (STRRAT)", "value": "7fcc0369ad02d92b3021bbc84e1eb49b919656e9b41fa1877e9232305c8cacd5", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687869004, "uuid": "ce58b2ed-afa8-464c-a80a-8556c8338fa9", "comment": "Malware payload (STRRAT)", "value": "8ea04fbe4100172a06f702a45f36d4152f530b8c", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687869004, "uuid": "d5137bf4-aa70-4dfa-840c-eada70cb7bd8", "comment": "Malware payload (STRRAT)", "value": "cde80399331f79bdb94bcbcb6bb9913e232bfdfa484cf45c9f8dad76486b8e01f9389a9e1243d88b14db5726359a357a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687869004, "uuid": "ecb53ce4-e1f4-4bf5-8fac-64c2e2b92afc", "value": "T1F124025AFD9BC4E9EC1B7573442D8229AA0E9589D844813B71FD11A60CB1CBD0F85F8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687869004, "uuid": "913448d9-2b4d-4064-9109-9b4dd0f87c3f", "value": "3072:9hkSzEwSU/e3jI7baxHJ5CqjDdWdudp+KsfQgtoooy2Q7uZFnPhYsr4uaqslXyIS:n+UIcg5DdauYQgyHyPutG9yUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687869004, "uuid": "9c0620d1-2ccc-4b27-8dd8-b07a275447cd", "value": 223713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687869004, "uuid": "f69ac992-2393-491a-a93e-69495ae3d98a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687869004, "uuid": "814da220-b214-46d8-892c-2b1651e1a795", "value": "QUOTATION OFFER REQUEST 1034783pdfpdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c4facb-14b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687846202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846202, "uuid": "f88ce94b-17e0-4501-b3b1-ab8a834074e1", "comment": "Malware payload (AgentTesla)", "value": "61d28457effc4d0abfe62682ff5a816f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846202, "uuid": "739b2d5f-2004-4221-afb7-a49ff0030eed", "comment": "Malware payload (AgentTesla)", "value": "80407e9455304d74e49fcefb8124c771d7c997566df03ce885af1e95e0463207", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846202, "uuid": "6b68f450-31ae-46b6-bad4-4290262daf94", "comment": "Malware payload (AgentTesla)", "value": "3afb4554bddf03632eeeef29faf1c47800572789", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846202, "uuid": "38305eaf-850b-4b77-b0d8-ec3a869c0a83", "comment": "Malware payload (AgentTesla)", "value": "7dafce69bf3fa52e701584fe857e278c0c3df414f3fd472616a38a8fc8b3848c59f38392589a3811d99d5aeed64c47cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846202, "uuid": "aa8b75f0-5241-4ce0-b7bf-89231b0a91d3", "value": "T171C423A809EEC461786463F3A6837BE587D7D00382D48DEA650B3BA85EF1D3D1243D9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846202, "uuid": "7821cc24-c371-4c83-a4d5-d37801fa2eaa", "value": "12288:yRuOrPwzNboEejq3jAksdjFnLo80GS81is/og27ArJh+dqE0YDM+APKW:HvzaJG3jKhF3d1Bf27ANhKn0YD2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687846202, "uuid": "0ff7cf74-be3a-42c8-96cd-e64f52d151c9", "value": 545550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687846202, "uuid": "855432aa-65bf-4145-acdf-258f9d4430c3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846202, "uuid": "f11bb381-2ac1-427b-bb9b-ed790e5643e7", "value": "Remittance slip 060223.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc7a3dc6-14b7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687849094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687849094, "uuid": "50c11ae6-e31d-40f3-a1e1-6fffea62dbc6", "comment": "Malware payload (AgentTesla)", "value": "b39ec4e8104e06705f1eea981c75ebce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687849094, "uuid": "7de50c96-9388-4888-ae1f-91fd8165e433", "comment": "Malware payload (AgentTesla)", "value": "80ae62b5d4012d415c4cb598140cfb6ad485b07f712a0c40d31d6fb46c4dd922", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687849094, "uuid": "6fedd459-5ec5-4263-95ac-a38bf3de03ba", "comment": "Malware payload (AgentTesla)", "value": "7be155468ed14d5e7a8dc4b148ae3f85525417eb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687849094, "uuid": "0ad74dcf-ac02-4790-8ce3-9b0833c50745", "comment": "Malware payload (AgentTesla)", "value": "8ab90b1b11c0d169b8fb4b5629cc02ded1d5af9c2a560b37b3ebd9af18258b3ed7063eeca7959f63a51fa78111456b77", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687849094, "uuid": "5cbce96d-97a7-480d-96ad-94fe6aebf814", "value": "T11774BE54E6B46F16E5B9CFF0693715000BFD67DBA4A0F6E68EC560C2E4E7B007960A23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687849094, "uuid": "cbd5d597-a385-4ccf-8f0a-149bec514929", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687849094, "uuid": "60c6f652-e89c-4fd9-836a-b917ddaaf204", "value": "6144:RlUtnJcqhzaSI0jd9oUphk48ln0ydrwxuFF7CqdEyr4J0HioEjDcuqoAY:Rl+zaSIUd9BpcR0ydrAixLY/n3cuqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687849094, "uuid": "f8320d6e-242e-436c-be47-9a4b99ef9a90", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687849094, "uuid": "ea70c644-906d-4a22-af15-fad185faa3a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687849094, "uuid": "3a819697-7d1d-4240-9473-2b26b1c2d927", "value": "b39ec4e8104e06705f1eea981c75ebce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "278a9b96-14d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687860333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860333, "uuid": "4707c2fb-ef17-47d6-8a63-91cf2200f505", "comment": "Malware payload (Formbook)", "value": "097af75038e469e9c2fb3e529864cb00", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860333, "uuid": "e6f5d495-e7c7-4531-b874-a16acc7a8026", "comment": "Malware payload (Formbook)", "value": "80f235cf687639f2fb63da58fce0ca22565cfa3806212d9b0516a3614f9b1ecf", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860333, "uuid": "72a73509-6872-40db-b33b-c6ec8df3b17f", "comment": "Malware payload (Formbook)", "value": "c6341ac17c21f667f100f3d86c45da9c437ed5cd", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860333, "uuid": "77b324f5-a2ef-4ead-b06a-011d2c87bcbd", "comment": "Malware payload (Formbook)", "value": "0c03504c76672243347ffab6f2538f9ea7a4db2c22ba6e9b84cec494839734e62310154f0a133c46bf3b426c560e108c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687860333, "uuid": "e36ee03a-fe47-4eb7-a757-5f4f6909d0d7", "value": "T10BB42325C98627E45C3983237B56E3ABD11A05D7A25A7DF42183F3EBF8B613B610C891", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687860333, "uuid": "246c2624-396d-4135-8905-9c2f9801d0ce", "value": "12288:kbsZpIbCwpeJG9GGAYQSlp1lod/DJu/0JrbwHMr88E:kbsrOCws4AYQ6zleDJD1gMrRE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687860333, "uuid": "3d3adf90-3484-42b6-8d98-218f52287960", "value": 542297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687860333, "uuid": "4968b535-eace-4a86-a23d-6b6725ef111d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687860333, "uuid": "958037a1-1b47-4ce9-a689-2c4aef002ea7", "value": "\u0421\u0410\u0422\u042b\u041f \u0410\u041b\u0423\u0492\u0410 \u0422\u0410\u041f\u0421\u042b\u0420\u042b\u0421.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614c3f0b-14de-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687865584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687865584, "uuid": "fd9fffc6-f934-458a-ab67-a6991612a3d9", "comment": "Malware payload (AgentTesla)", "value": "e5c6933199be77402e0a28c09b52476f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687865584, "uuid": "2bfd0432-ec4c-41f0-a4d3-ce5b97db7ce6", "comment": "Malware payload (AgentTesla)", "value": "8143a5394c44396b5b1ecc124f07e4562257d64b7dc2fe732e5248ad855aba44", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687865584, "uuid": "b2fef18c-b6a4-4e55-87db-028d25da4613", "comment": "Malware payload (AgentTesla)", "value": "06c24e1a05e483998a9b2bdc09ccb576e177f04e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687865584, "uuid": "933f3cb8-ea22-411b-9324-74ca434b479a", "comment": "Malware payload (AgentTesla)", "value": "511d9699393d567ea4980c70da17297c7c7ca6eef8e7b8d02256987e08410bb3d34da19d2cdec6951d84977f3ffd7003", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687865584, "uuid": "ad028dda-34f9-424b-95c3-69dd90caed0f", "value": "T130B423AB60B25A1776257A8B9C033F2FC5EF5E2187E05CE4113848A4C69CE53D8B5E6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687865584, "uuid": "594ee155-5a6b-4bc1-a122-1f680186eb11", "value": "12288:aIcqYofu+7aX0hu8sSJvcph39cWuLkyQMhFOhXTjah:aN70hfsSo39cWuFQMfajo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687865584, "uuid": "e6f3556b-931e-4c4e-a061-846296018101", "value": 498014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687865584, "uuid": "f993e7cc-a3d2-4c74-a7bd-3fd74c292857", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687865584, "uuid": "31884eae-456d-4938-9fa3-8155937bf0cf", "value": "purchase order#627203.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45416fe8-14ab-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687843632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687843632, "uuid": "59092cec-d5dc-48ce-89cb-c1c3596272b3", "comment": "Malware payload (Loki)", "value": "c20111457da76fee6940ace7b6f3ef1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687843632, "uuid": "f45619a7-35f2-4053-b987-7507da98ce83", "comment": "Malware payload (Loki)", "value": "82459746ad789498fb60c495e633e452cd072fe0ac457a0032cac23fd12f6610", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687843632, "uuid": "79b03c3a-16c0-4ca0-87f5-f2932d380d60", "comment": "Malware payload (Loki)", "value": "294c7ddc3226aad4273a3f3258c011058a4b7962", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687843632, "uuid": "f9dfea9f-976b-4056-a7b0-67129ee0098e", "comment": "Malware payload (Loki)", "value": "581c0031f9eec97816fefcdec23c5dd890095b1fddd6b8108df40a455467a5760a7c1bb8c736998ec5d3b941d5ad7c4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687843632, "uuid": "664f5ff3-bc10-4522-83a6-6e08f36994ec", "value": "T1A3B4473C08BD1A37C175EABA8FE584A3F454C43F39225A32A0D79B558746EA361C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687843632, "uuid": "74afde7a-73aa-4bdb-8634-72487f345905", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687843632, "uuid": "e7a65b77-7013-4878-a2a3-818a7d0a1268", "value": "12288:c2iNXJuSdJh6DlKpeF8TO2MbvnlRwZNhGwGyUoU/iqU0OKhikHMxn:c1lgoJGKhO24TwjhGfyUPfxOKhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687843632, "uuid": "0eec3346-79ab-4e76-85ca-15eb47297982", "value": 534016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687843632, "uuid": "82ca9ce1-1bf0-452d-b312-a082446b7749", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687843632, "uuid": "84805c08-91e9-4306-acd2-9173e6bbfd10", "value": "Maersk Shipment DOC & Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df789da8-14e2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687867513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687867513, "uuid": "95fe2598-cf1a-4b9e-8125-414662336311", "comment": "Malware payload (Loki)", "value": "66d0453b37b9b3cfadde152ecad55d36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687867513, "uuid": "a16df013-1720-4ae5-87c2-54a2f3d85331", "comment": "Malware payload (Loki)", "value": "827c98452dd95a7456fac5c5fc472c56f436e02b8dcbf4b4ad4c5fc34ffebbdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687867513, "uuid": "18d3b01a-78cf-40c3-ba2e-227350e96c65", "comment": "Malware payload (Loki)", "value": "1db6279d5c9b66d2dcbecc2a73a4718f6e87e178", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687867513, "uuid": "0e53c820-0921-473e-887d-a3c32d47a36b", "comment": "Malware payload (Loki)", "value": "8e88d58006082d0b5046deab0cef261aaeb224719ac83e24a2967b023c176ee5c97f191274f3688a2714eed90cb02e2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687867513, "uuid": "707412f7-8197-4006-8740-7e2179476dab", "value": "T176C4586A28AA6949F262AD3C5FBCB131821EE7F115350C730EFB044F22125F59B9D727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687867513, "uuid": "bfe2676d-a423-4129-b1b0-92aa79a39e2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687867513, "uuid": "75fc8c94-6a4d-4a9c-8d45-59a2626c11b9", "value": "3072:mFmPtd2epEFbMkbNZG46Xz3kFE0bFd+m0de2fcRMBLEFx11Hiv2MN+Rh3tC0zMni:umBjkbNNhNHG+96+P3tCJnWu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687867513, "uuid": "766d40de-f840-4538-99a1-4687ca0c3138", "value": 581120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687867513, "uuid": "6989bb0c-75db-4ee6-9eb8-67f1ef2e79ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687867513, "uuid": "7ad05313-ad57-4423-9860-2b39df68502e", "value": "Port-MetallKftSipari?i(PO29014063).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24571607-14b3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687847013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687847013, "uuid": "528f0087-c5f1-4986-9454-307f39eac051", "comment": "Malware payload (Formbook)", "value": "741435f0b08b1eb26a5038b6f3e58d62", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687847013, "uuid": "1a1285f5-093f-4240-84a8-47f35391378c", "comment": "Malware payload (Formbook)", "value": "82d95142c247e3cb59a0f4e5d91e4024d2a2432aeed197e7aba6476603cf0534", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687847013, "uuid": "9ce0065d-d352-49b8-aef3-d93fed26e94d", "comment": "Malware payload (Formbook)", "value": "94c0baf825742ca5c8ac6e7838874f7214004754", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687847013, "uuid": "1003c364-4d1e-4e8b-a56b-caf5d3754ec4", "comment": "Malware payload (Formbook)", "value": "5b9be2def0453185b4ed81fb222ab53623c4a443a78c97bc22fdbcb58eb44346d034137101c4dea63d5c957dc9d0a942", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687847013, "uuid": "2262438d-c697-4e01-8d3b-7f595919e597", "value": "T1F2135D5AD78F02A58F4112B3271B1E89AABDB23EB35050B1746C837433EDC3D46666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687847013, "uuid": "84bcfa8e-819a-47cf-ac28-de58df27948f", "value": "768:qFx0XaIsnPRIa4fwJMncgajsI8bj95UrLg/rF:qf0Xvx3EMn/I8N5kgjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687847013, "uuid": "b6475194-3e59-42ba-b14a-1aeaab7197c9", "value": 41646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687847013, "uuid": "c887476b-92e7-47b8-b258-df08c8cb1cf0", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687847013, "uuid": "c2b9beda-7639-40a0-af36-01b9f7445c47", "value": "9875458603.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a622b27-14b5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1687847963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687847963, "uuid": "e6883f09-b006-4655-aab6-306a76241c9d", "comment": "Malware payload (RemcosRAT)", "value": "3a91727fffb6ec4145a77998af295231", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687847963, "uuid": "48716f4a-3bda-4841-81a8-f2ad7239e427", "comment": "Malware payload (RemcosRAT)", "value": "83a153e0349b4945fb3bc4c2402aa9000d6725375ee2aba7b1e02e50256522fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687847963, "uuid": "a64ba899-a556-4231-9906-a8c752d497c8", "comment": "Malware payload (RemcosRAT)", "value": "dfbe4c7e17baa599701f5613c0b18e8712e1d01f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687847963, "uuid": "19917acb-cc5a-4bf2-aa0f-300cd215e9f0", "comment": "Malware payload (RemcosRAT)", "value": "14524ece81237dd0a4126843f8dcf8b796746c9d3ead84860b7c52a79a150155f9dcb065404b4fce773bd21aa108cd6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687847963, "uuid": "6b5af5a9-61f7-4c5a-b805-f5745f6e1ee7", "value": "T147E423093267C4E3D39A91F04A23E5BFF7F40655002A8A477340AF9D7C73A96C5A97E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687847963, "uuid": "3c443432-7e58-4b19-b80f-477e6bb6db57", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687847963, "uuid": "ad7a8982-6949-4f23-ab91-ae6c9a287ee8", "value": "12288:aFnsRYI8T12tF3Y1HIQDj0fLnar15WAGDcU4+9AOSK3w+:aFpIUYvIBDjAGJI545W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687847963, "uuid": "41467069-0e46-4dba-8b2c-dd0bf511c312", "value": 664190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687847963, "uuid": "34382030-98b0-437c-8453-bd114151cf77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687847963, "uuid": "b12e77af-7d57-463d-83eb-fcbd8cdd63e7", "value": "CONFIRMATION OF BOOKING #5648897.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b97f350-14bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687850622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850622, "uuid": "6366c854-30a0-4745-b093-3e88145790be", "comment": "Malware payload", "value": "a48d5c22522ca3a1124632eb957e66d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850622, "uuid": "63906d78-d724-40a9-b2ec-be7b079388c0", "comment": "Malware payload", "value": "8485a69ea1e78d9731830bb2ac19585ba734076484afc30e7ebbb41685bf020d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850622, "uuid": "e5975eb9-84be-452b-b380-e115cd9850cc", "comment": "Malware payload", "value": "6276db699df1f086d8cfc502fe1c1b0b35148f6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850622, "uuid": "5f5dc864-a26b-4d72-8484-89ad29a8baf7", "comment": "Malware payload", "value": "a71010f2050fe4508eeec41532f702bf8941e7b41b7c205daea4931b781dbcc4a4d4629069aa0ca7f2e8570c207e5907", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850622, "uuid": "ec890ee2-92b6-4a97-94e8-da00da40711a", "value": "T113136C2176A0C4B2C523A57054368AF1AB7FB83113B4D9CB5B681A395F303D1AB7E35E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850622, "uuid": "1033a730-75c6-40f7-b028-577ca8a47041", "value": "768:bdFzvC0FaM/0YuOXcTa7YnG/rINuMclRY1QNq8tnO8EldGgkC8NIh:jO0U40w8GDpACpnOooEIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687850622, "uuid": "d5a50324-5421-4c87-90d9-3b3115e92c0f", "value": 42847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687850622, "uuid": "b30715e2-3cf1-40fa-83f9-cd08ec8dadfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850622, "uuid": "73f05141-57c3-4d90-b18c-a2772c210ab3", "value": "a48d5c22522ca3a1124632eb957e66d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5ef54d-1519-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1687890860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687890860, "uuid": "e0cd3d7f-efe4-4701-9098-856006ce258f", "comment": "Malware payload (njrat)", "value": "5658dd93a8379d6c46126a380ceb8b50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687890860, "uuid": "b32456e7-f96d-41b4-a63c-ca4b4236dd38", "comment": "Malware payload (njrat)", "value": "8539d8e44e928a23ef872c5a8ad4d4e632c9f489a013a5b29d36d15ac2767b61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687890860, "uuid": "b1c10b20-c7fe-4fb9-8971-6466b2a584fb", "comment": "Malware payload (njrat)", "value": "4de37a6d63ebd5f89a96eb8f832c12dbf21c38ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687890860, "uuid": "32ab45d4-4593-4c7c-994f-5ab082c4251d", "comment": "Malware payload (njrat)", "value": "757e9090c5e43f2309b5dabe456b182ac9b7c530b1775560407f67bd46d9e9b262950ca3283be1c2899a925500823a71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687890860, "uuid": "0787bedd-4ff4-4d78-a152-de7ba393847f", "value": "T1F0733B4877F54A12E1BF0DB5897292220B36FC075926F76D09D174AA5FB36C08A09FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687890860, "uuid": "004f4c9b-395d-4fec-b9e0-1f372faca5ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687890860, "uuid": "97c7d89c-3093-4e0a-9af7-dd9cf0987040", "value": "1536:qpbXx+1CmYDp2S5wpOk3JCK6pFoETQ6fOpd/9nEh9TGGhJcR:OwQwpOk5CK6pO/9ESGhJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687890860, "uuid": "c3e40ed6-8b85-47b9-bd23-27647ca7637f", "value": 79872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687890860, "uuid": "be12a1ac-1c1f-43c4-8997-3904dc1caf86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687890860, "uuid": "c616160d-cec5-446f-a822-ccc3f4fd90e4", "value": "xV0aWLFtJKKg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3180b37-1503-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687881612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687881612, "uuid": "96a8a4a6-619e-42a3-ad4d-f9ba5d0af9ee", "comment": "Malware payload", "value": "1c19ab349028aa2dba07346a5b6e80ef", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687881612, "uuid": "f129255b-88ae-43d1-9e2f-0017ec475524", "comment": "Malware payload", "value": "857a0cd640f1c5f96ff6187bf56b32e5a98846f0c6d885f03bba820bbce8cb98", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687881612, "uuid": "4b8f1a43-bcf5-48ed-8d20-72c3c22ca0dd", "comment": "Malware payload", "value": "635cf2da1a7754ade8f7a104c6ff9b111bed5c22", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687881612, "uuid": "4f6788f5-c782-4936-8a30-507fab8b094f", "comment": "Malware payload", "value": "b71e5f3d739c7dfe418fa58fcf65ada1aa0fcb5470267a80229039bb4596a29382aab99d5d5be33e581784abbe722728", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687881612, "uuid": "982e92f0-82dd-41dc-a4ba-05d08f50e4c6", "value": "T113646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687881612, "uuid": "682ec946-ad2c-44aa-9b91-c616b290c44b", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687881612, "uuid": "11aed043-9823-4639-aa8b-d81d8de4daaa", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9m3:5xb8ZqekwkJPaThgyDChXohRRwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687881612, "uuid": "66e3c9e8-e938-4fc4-92f3-c4668ec2014c", "value": 320518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687881612, "uuid": "95d24c34-56a3-41ae-a424-7021201aad1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687881612, "uuid": "82f4c754-2331-4551-91c4-4944053b179e", "value": "1c19ab349028aa2dba07346a5b6e80ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f916f996-14f2-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687874428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687874428, "uuid": "1bd1b81c-9593-408a-9797-39b077ae9574", "comment": "Malware payload", "value": "cc19caebc64e9ae56399d52f05f9b597", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687874428, "uuid": "f72fee3d-6538-4f47-abf3-6ab0e257d0c5", "comment": "Malware payload", "value": "8698fd23a84c915a798868d136872f659ae7e7454c64d5bda4817e7f26c87c1c", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687874428, "uuid": "56daba7c-5441-4acd-8b7b-4df65d6096f1", "comment": "Malware payload", "value": "9f8544925a4fa33b5ab8a5ca69b4c0b36b6a8db6", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687874428, "uuid": "2d7a00d7-b53b-4346-850a-cf85619719a1", "comment": "Malware payload", "value": "56132a2c13e749acd9a204f87d3d8e8168eec08a5ca195020647ae39d4034018e8924330abf71dec441931707d536674", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687874428, "uuid": "6caa4fc1-334c-4df5-8fbd-31dab8eb0798", "value": "T11303F2EDD11ACD89F3F3E47C020A0C44D156B6CAB2679EAAD426722D4D405DE0B5D3DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687874428, "uuid": "b05209d7-1798-41bc-9924-5f8e7e53c6f9", "value": "768:f2w4o5bM3BP+jZzBTvGgCyB6IYWFScoOkWxtuGeKI49NZkk:fbS3BPqUO6V+oOkCblNZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687874428, "uuid": "ce4c79fb-764b-428f-bedf-bd30fe976438", "value": 39067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687874428, "uuid": "949d6516-5cfb-4d62-8326-4c0303664f2c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687874428, "uuid": "75eb0e41-a0e1-491c-b746-0531d73d4b9d", "value": "Agency KYC Details.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc7952a-14b9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687849925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687849925, "uuid": "fd32fa31-5281-42ff-b549-8e896ed9ca56", "comment": "Malware payload (AgentTesla)", "value": "6cd68ce9a80f20a78a5f1202bb4fa900", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687849925, "uuid": "d3ce0d66-71c7-433d-a5fd-fcf09e063f86", "comment": "Malware payload (AgentTesla)", "value": "8729ea2e975594942343d1407bd47345daa356b354986bbc6efe9a86fbd3ca19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687849925, "uuid": "43a54108-d904-4326-baf8-8c3df2efdab8", "comment": "Malware payload (AgentTesla)", "value": "e93132dc8e716eb76bb7bfa4e31ec232cb055b16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687849925, "uuid": "7ce4c28c-1fb1-4162-89e1-1ccb1a0bf34a", "comment": "Malware payload (AgentTesla)", "value": "a9faf2eecd65f5e8e821a0b14a6c848ebe5178e4d5ec4dc946c05021b9b1b0ba2b93b50ecd840028a0a507aff1c3e437", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687849925, "uuid": "ec4ab86d-d008-4b87-9629-13649be2420a", "value": "T1DB4412A1F7E082E3E57616B16F72571827F3E20509B49F2F53102B19FD22742A50ABF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687849925, "uuid": "b38f21f3-3e0d-4564-b46c-ea0d1f36ed8d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687849925, "uuid": "474f2c7e-04c1-4d68-8771-ee9b966fca4f", "value": "6144:PYa6RfjExPIveNAM3flcQGtvnaU3GE/Cng2A0Xlt:PYDfAxwOvlJGxnf3GE6ng2A0X7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687849925, "uuid": "d74991fb-22c0-4c3d-a312-4bb08db8912a", "value": 273703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687849925, "uuid": "6d428f0f-ab43-4a31-9d7c-1bf4ad6dd480", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687849925, "uuid": "ea213fd9-0948-4186-af47-8db3b666239e", "value": "6cd68ce9a80f20a78a5f1202bb4fa900", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40418f53-14b2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687846630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846630, "uuid": "572338ed-9c96-4b1a-ae37-1dfcb3187c50", "comment": "Malware payload (GCleaner)", "value": "da40d4429f3cb3d91164ff418cd75332", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846630, "uuid": "a3f99f61-57fa-43bf-b2a8-ce252a4a3858", "comment": "Malware payload (GCleaner)", "value": "87f58956937f84708706f515675d0b48125ace13ede701886e433cc8b336720d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846630, "uuid": "9bd7f464-1909-4eb7-b06d-506c9125d9ba", "comment": "Malware payload (GCleaner)", "value": "c0efe0e15fc7316ec46e6dc0e0f1c587894a9ec5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846630, "uuid": "c45b71cf-fd9e-48d5-b93f-394ce183bfc5", "comment": "Malware payload (GCleaner)", "value": "257289bde6b6983b865580d91fa7ad67797a4d38e6572393802f53f24a146a4042f3ca2d231879c8bada6ff5fac55d9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846630, "uuid": "56407140-d5ec-431e-9433-ef075bf4c00a", "value": "T1AA85CF3FF268A13EC46A1B3245739310997BBA61B81A8C1E47FC384DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846630, "uuid": "71e2d2b7-6cbb-4bd5-aa4b-0524b2d4815b", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846630, "uuid": "a130aa8a-30dc-4222-9b14-0c9e1541eb65", "value": "24576:s7FUDowAyrTVE3U5F/11lORCF+BKic6QL3E2vVsjECUAQT45deRV9RO:sBuZrEUzqCF+BKIy029s4C1eH94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687846630, "uuid": "f9154595-e3a6-49d8-b2ee-16b0ec77786a", "value": 1795446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687846630, "uuid": "486d5d49-718e-46f5-8aa4-7339e1343222", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846630, "uuid": "e5ca9c20-35c8-4d38-b062-098ab53c51de", "value": "da40d4429f3cb3d91164ff418cd75332.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c6dd2f9-14ee-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687872367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687872367, "uuid": "aba7583a-3b82-4b18-a9a2-7647844f102f", "comment": "Malware payload", "value": "4a80265058d8eaf92b0b11ffd7577bce", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687872367, "uuid": "153bd815-ea9d-4e52-9f79-569508b73069", "comment": "Malware payload", "value": "8a76486bb24718603f5479b5d80a8c2af0c10b17c8363bffd80e35360a424df9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687872367, "uuid": "6df7b0df-5195-4e0c-882d-82f1c915216d", "comment": "Malware payload", "value": "d627b282ca2dee87c6cb70b3520b8cd89c62998b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687872367, "uuid": "dcbaf351-72ad-47d3-95d3-f5a54d154ae9", "comment": "Malware payload", "value": "69efab79c6befe2e9ce06b3b5b0adde97d27738bc72e7d266b809a5831748607bf795f2d531cea872fc29f5b3cdd2a1b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687872367, "uuid": "f9d538ec-a4d0-426d-b02e-4668275ca466", "value": "T1F7F2E13AE54C5528C652977E0980BBECDB1C61A21426648C74ADF79E4BCBCFB037718B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687872367, "uuid": "30cbd591-eb13-463d-a75c-e5156a580de3", "value": "768:3LlYkVjzqWmtGuo7n0IwezOh75AJkFrLEHPeYyolDP:7Skpqr/o71weu+IEH2YyolDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687872367, "uuid": "5e448e6e-d779-4ef1-a5cc-7e6b5c5b0f98", "value": 37578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687872367, "uuid": "940449e5-85e5-48f7-8b6e-eef924b0cf5f", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687872367, "uuid": "8df2e0da-c535-4170-8503-e70ac7fd6d31", "value": "Modulo-di-Rimborso-Agenzia-delle-Entrate.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27fcaa67-14d7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687862481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862481, "uuid": "e4d8e3c0-6197-42c6-b09f-ddf8a9340d77", "comment": "Malware payload (GCleaner)", "value": "5d00a0076b938e7e3f5310e849860736", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862481, "uuid": "32a0376a-4e17-4619-88b7-1006748b8875", "comment": "Malware payload (GCleaner)", "value": "8bcef7f2318c046a3e75cd30dc002ebbf60d55c669a73e861c2bf1bb76dc9010", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862481, "uuid": "4f43fe19-b265-4fc9-ad77-34a138296109", "comment": "Malware payload (GCleaner)", "value": "5d2323b8e4181c6032ab98906eaf174229c2eb80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862481, "uuid": "2380e196-622f-429c-a801-9d3e5ed4000f", "comment": "Malware payload (GCleaner)", "value": "78ca36d88ff7f7980547b7e097f6292b8acf396bb49dba92aa78609ccce03d7351ebd09eb9da87a4814091349de255be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862481, "uuid": "3f4ed0b0-5a3b-45ca-9f16-892e30118596", "value": "T1B574AE1362F1BC64E9264B329E2EC6F4361FFA518F593756221C6AAF09701F2C673750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862481, "uuid": "842b03ea-820b-4156-99cd-735c56f10dba", "value": "6697fa255a05fffbb8331cc121287cb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862481, "uuid": "f1ebfe07-932d-4d60-ba0c-51490fd742d4", "value": "6144:oCFs9HHo36HRyMxH93ugu7/Bamh83epiPejkPEbyzi:ol9o36H3eg8Z83eiPejkm4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687862481, "uuid": "c66b0eba-8804-48da-8003-f4ea6494b94c", "value": 350720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687862481, "uuid": "03c44c5e-36b7-4fcf-b027-46af6c2aecf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862481, "uuid": "7891f9f4-fc2f-4e16-932e-0db65ee5b541", "value": "5d00a0076b938e7e3f5310e849860736.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea51255f-14e4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687868391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687868391, "uuid": "6041699d-b715-4d5f-9111-fd03c896918d", "comment": "Malware payload (AgentTesla)", "value": "1ed397cd2528cadd6425cf1c2a303868", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687868391, "uuid": "9f25f731-1796-4f1f-a969-80525314e058", "comment": "Malware payload (AgentTesla)", "value": "8c6409fe9b0d2edecf0c8071a35002957c5f8495d3577ce99141a6846e15a207", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687868391, "uuid": "22469913-524d-439f-8a1b-2aa850ea1cb1", "comment": "Malware payload (AgentTesla)", "value": "7c5e9257b92967d347bb262b7b783e9ab43155ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687868391, "uuid": "dc0291dc-0167-487f-8f86-1fe127d1ae58", "comment": "Malware payload (AgentTesla)", "value": "9648094e84ef43e2f674631ce5dc1fc066c83d0c1e3895fc1f25496c9fc4f803bcb953ea280711823392527c09ea8c6b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687868391, "uuid": "e6afafd0-fcd9-421a-830e-31ba07841384", "value": "T192B4231F4B9FF4A6AF3853C8FC20475691457084257BC1D0F8AE3CAB2AC39271BE9529", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687868391, "uuid": "c7ea6598-2287-45a0-98b8-4ba1f9fca92f", "value": "12288:EHzyVZTtu7qQhHOX6TpEjnyezRzkG0xZNi:Cy/gthHOXV+ezRzkGwm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687868391, "uuid": "d3c9bd00-cef3-4d44-b298-e84d4d868923", "value": 507438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687868391, "uuid": "be670880-6456-48f0-a578-f88e4f588cbc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687868391, "uuid": "66424711-9b26-487b-a969-a2354568ee3f", "value": "Documents.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "411753ed-14ca-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1687856940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687856940, "uuid": "79ae5643-d3c1-4082-b557-41c2641fb436", "comment": "Malware payload (Stealc)", "value": "8863182c9cd611baf0d5bc775d91762d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687856940, "uuid": "85372eb4-4517-4cb7-a39d-8dceae12ac8c", "comment": "Malware payload (Stealc)", "value": "8daa9479001f99d143bdcea58fa91d3266edbff87399573d6e62aaadc2ca8941", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687856940, "uuid": "9bd6ad69-b8c9-402e-8abd-042d7cc00742", "comment": "Malware payload (Stealc)", "value": "1b92b62a93d8ff76b5edee33daf7f25327718c3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687856940, "uuid": "5ba23080-7929-4509-8845-2a65668e047b", "comment": "Malware payload (Stealc)", "value": "4c8337b9d0d509e2218afc3ad97938b11d358e0ab0e573ef80aa4e1ee222e4decbf1135ac020ad8549d106925223aba2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687856940, "uuid": "eb59afd9-8c1f-4d4a-967f-cc1a77c7675d", "value": "T1E4D4BE0175D1C4B2D53321370DA4EB7A5A7DF8300A669AEF67E40F6FCF70280D662A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687856940, "uuid": "b8f96a4b-86d0-4ca3-bee4-d78950c19450", "value": "33c13c7e2740049764c0170b710e37bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687856940, "uuid": "5a321916-dc35-47d6-9b6e-1026dfa83f9e", "value": "6144:IEO9NUuef5/JgXsg2GlV2fvAOwnWiG22Kxnm570Q:IEmRef5/jfvrdDKxnm55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687856940, "uuid": "5c2306ab-212f-472e-9bdc-801a7d8f6881", "value": 637952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687856940, "uuid": "7b78f762-4a68-4532-96f0-52f9b092996d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687856940, "uuid": "bf909f7e-2fd3-4289-9519-c69ff066b613", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3568e54-14a1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687839629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687839629, "uuid": "8d3a606a-f9cd-431a-b283-a1f77e0fd57e", "comment": "Malware payload (RedLineStealer)", "value": "de4f8edc5a860022f7c4e50a72457427", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687839629, "uuid": "d76c8ab5-ad9a-4513-a67c-67f40cceb0b0", "comment": "Malware payload (RedLineStealer)", "value": "8e8dc10b1d19947543e7337bb5f234fc44c83ffdccf3fc36ae7269481223e547", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687839629, "uuid": "6f65e6cb-1588-4f17-9914-f0142056abb7", "comment": "Malware payload (RedLineStealer)", "value": "0700d2475047dc09a17a2ed66f2df8e00de5e733", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687839629, "uuid": "1185207b-3151-40af-89ae-d24ca09d3d8b", "comment": "Malware payload (RedLineStealer)", "value": "d13980d1b2461df2d84d7952ff6f9399f6f6779d260c6fbe94d0ead4152e9f7fd263f2142a485211baf57fd9de11484b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687839629, "uuid": "ef794161-f8f1-4583-8c07-af2bcd847ef8", "value": "T16B64E0D27AA0C472D7564133C826CEF9253E78B08F93C687335C2BAF6D322D19A76255", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687839629, "uuid": "601d5729-1d63-42fb-bc6c-820f5a5515e7", "value": "6be0f5f4cf6bb40603faf64d65d5ff40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687839629, "uuid": "d1f14f85-e0e0-4f95-96e0-53b467b4985f", "value": "6144:EHePHkRqS0nAR0JrJO9IJYmK9vPEyHCTQvyM529uq1+i2Z:tvkQrACJgWYmKh9s0152sUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687839629, "uuid": "033a83bc-d680-4079-9e97-b75f33b8dfb6", "value": 321536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687839629, "uuid": "242c7cba-a174-49ee-9039-df460f8df945", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687839629, "uuid": "f2a0b40e-7a7d-48ab-bc24-1b1626fe6857", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67c75449-14bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687850562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850562, "uuid": "f07a499d-3d70-4696-9590-c47f82afcd62", "comment": "Malware payload (GCleaner)", "value": "a600b805f99ee57e0242e0eb2819009d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850562, "uuid": "40fe56c8-9b08-42c0-ba49-bea8176adeea", "comment": "Malware payload (GCleaner)", "value": "9077528d311bce83f07a94c5bcc2af2661cf0532be94c2fc34699da18770df8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850562, "uuid": "3fe55358-0f2f-4cb7-8db2-d4aca9740896", "comment": "Malware payload (GCleaner)", "value": "e4fd69e5fec8fed0a0779e0204712a7d061f1147", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850562, "uuid": "9ffee80d-0fec-4a32-bfbf-913b728d804c", "comment": "Malware payload (GCleaner)", "value": "21fd8d55a05e5d2c60ef3a6e4f0af7f5c50d8ca9b05da2e3d7332e339fdecf0f894077ac65d2ef35e916ea6d4f43ace0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850562, "uuid": "a2f76bc3-6857-4083-99f5-284f591d84d6", "value": "T1C464E0523AD0CC31D85AA1309872CAB9267FB971467499C3B7B83B7B5E713D02A34793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850562, "uuid": "89a7806a-46a7-4e9a-9bc7-6c14c83d294e", "value": "6be0f5f4cf6bb40603faf64d65d5ff40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850562, "uuid": "9c47eaa0-1fc9-431b-9886-4147f7318e24", "value": "6144:+UUXN4+uV2iw5EWT4OwVt9CbOSphM4kZy:VUd4+uV2iw5EWThwD9CbOST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687850562, "uuid": "6adbccfa-0ce5-4392-801e-c9759c6361eb", "value": 313856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687850562, "uuid": "0873bcaf-5ffb-4cf3-bf6e-455fd5f47ca6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850562, "uuid": "f4505e42-9a9e-4a97-9135-d5146cbcc8f7", "value": "a600b805f99ee57e0242e0eb2819009d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5914162-14b0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687845968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687845968, "uuid": "8525c552-c634-4fd5-9ec3-11fe999cea72", "comment": "Malware payload", "value": "fe9c1a7c8cd9db50872e08de314d2a8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687845968, "uuid": "91669092-b774-415f-b12d-2e6417d285d0", "comment": "Malware payload", "value": "90a00c2ce66fde8c51513ed3f8c31526b8b428de128b26254f63d87d51018a10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687845968, "uuid": "aea22343-4b76-4bdc-96f9-525bec967dfa", "comment": "Malware payload", "value": "709b5984c45dee5078aeedf929b93c49ffde6df6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687845968, "uuid": "2f303783-410d-4cb5-a2fd-b0159a1b0496", "comment": "Malware payload", "value": "72758cbe30b2e4bb1ca068039bcdcce843e0695c7c039af9e0182c423a77fe10a9f951f42d4f22447cd64ffc0a562e7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687845968, "uuid": "5dfa5075-1e96-4cae-802b-3aea330d9790", "value": "T1C9F48E37B1E09533D3732A3D8DDB5264982A7F022A28E94A6FE50C4C6F7978139253D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687845968, "uuid": "f77764cf-0569-45de-84aa-e3213a8f853d", "value": "44b6bfdd6ffd5450ebd675c84f22b9c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687845968, "uuid": "bd9a0273-3a82-4fed-b884-051afbb8de3f", "value": "12288:uXCY50vo8hpf5s53tdIVOOBFP71p4pCAa++0x/gu7TH8TNBqrEHeph/q/h:uyHo83Rs5sOsT4DHRMTN4rHph/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687845968, "uuid": "a3e9b5a3-d767-4d68-9d26-bcd19bbd74f1", "value": 748150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687845968, "uuid": "e562b723-17ce-4a5a-b99b-0591254f28d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687845968, "uuid": "025d6521-77ff-4398-8032-a0ef79dc28c9", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d62d61d-1495-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687834170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687834170, "uuid": "6c57b96c-e001-45d9-9606-52853d62defb", "comment": "Malware payload", "value": "1028c0eade56f61dd951f50f949ae6c1", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687834170, "uuid": "3426a4a2-8b3e-406e-a8a1-8bae8513a291", "comment": "Malware payload", "value": "917e29ff91324a6c3630f0eb392a6d1a5c394d7112b35ef29e7cc0269e4c1445", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687834170, "uuid": "ce23fa1f-de2d-4a41-8776-2b34c7cfa10d", "comment": "Malware payload", "value": "86aea1f12db8a4157192f62f3f69df910e3383a5", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687834170, "uuid": "1fc8199a-d51e-442c-b5a1-244841603bb4", "comment": "Malware payload", "value": "d484ce16b374155a7c679e48b58f668c96a949446a0f4bda39a6fff2ec0ae5ccb7b2f9fbc51caeada6871616d601e284", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687834170, "uuid": "df005b19-05b0-4950-ae34-2f1c6ef44692", "value": "T1FDD50182F758B42FC877C0334AB6077622568D598A46E3431959B36CB9FBEC44B85FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687834170, "uuid": "ee5664b4-2003-4f57-87b3-0b75658f8af4", "value": "49152:mfWG6hg3b/dAHQgY3E4ERoiBPeWp9AtCqy805sQwZt70lJ0NtxpUYK:tAL/Gb+iBPVjAtCqyHq9k0NbK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687834170, "uuid": "58b0d5d5-f660-4e1d-965b-3a79dc57ff60", "value": 3000963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687834170, "uuid": "3772739f-f6a8-4735-96a9-2ed48a499e0b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687834170, "uuid": "079574d7-d114-4c52-a4b7-99ea0e195034", "value": "ss-kids.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "443a3b19-1543-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1687908914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687908914, "uuid": "fd24f922-143d-4daf-8137-e9d2d71373dd", "comment": "Malware payload (AveMariaRAT)", "value": "a9303b2b7ab6ad374828613fcdb0f638", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687908914, "uuid": "5d90c09b-6134-4185-ab27-f9dab88f9a6e", "comment": "Malware payload (AveMariaRAT)", "value": "921c9c101860c14da3e87b47b03dbb367802578a19d80ac53f2c57fc1d0eb61c", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687908914, "uuid": "f8f79139-70ef-4539-9149-a12e9ed3d7f6", "comment": "Malware payload (AveMariaRAT)", "value": "139c26f2cacf2aeb54dbdb49f5da83ead4f8c979", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687908914, "uuid": "eb77f626-125c-4a29-955b-0a46582dbc9a", "comment": "Malware payload (AveMariaRAT)", "value": "3067e91a96a35f0942760a239111882e25eba28d370bc57a4dedd69109df826883c806875a9fbbcb16b8c7305b4af9ec", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687908914, "uuid": "51da11a2-4df8-4059-9447-63e8220c076e", "value": "T13AF301047A90C0E7CC6317319AF92647AAEEDA3601D5CB2B2B15974C3D617A1CE2F363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687908914, "uuid": "05a2c4ce-c078-4a19-808b-1f61ad81cd8e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687908914, "uuid": "43ccdd6e-7789-41e3-9baa-dc66bb74f872", "value": "3072:3fY/TU9fE9PEtufbEAylzh9LlnD6eF6l2/5QTOKqHpeRiVBH2gfwVXw0QMMG9PDm:vYa6tRy39LlD6ekExQiKOpeYB/fwlwyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687908914, "uuid": "d7178b79-7509-4cf1-9139-c6515dcf809b", "value": 168286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687908914, "uuid": "f262a0a4-ee03-42e2-8369-8bb3d9e52598", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687908914, "uuid": "bdbf3055-617f-4389-95b9-f4d9b8f2f753", "value": "a9303b2b7ab6ad374828613fcdb0f638.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34f98b56-14a4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687840599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687840599, "uuid": "a313a6af-2dad-4450-a238-532744b1bbeb", "comment": "Malware payload (RedLineStealer)", "value": "f3dec51e876515c8f8843f975d9d1aff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687840599, "uuid": "1b2b2dbd-7daf-455b-a361-1a7c3e0ee642", "comment": "Malware payload (RedLineStealer)", "value": "923ecbb2b0072d79eefb842e6e02ab6f3f8cb3e34a7cefa53368b8db06e40bfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687840599, "uuid": "2726eabd-3e4b-4fe7-be76-4221a520bc56", "comment": "Malware payload (RedLineStealer)", "value": "79a0567fe2e8eb9dbde508174211cf2fa4f9e54c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687840599, "uuid": "7bbfd310-6aa6-4c78-af84-0fb8eea76be3", "comment": "Malware payload (RedLineStealer)", "value": "5d7bf10b5f63ea428e6bffb70113dfe9a7aeda1c0434712ed59fbd48c6e92b1462e9b111033c6579a0f2e440047884b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687840599, "uuid": "d98c9ab7-2e3e-4e0c-bedb-e596ddac9276", "value": "T1A90512323D80F336ED9A7831A5D7C718CDEAF9316F66D1F3AB8542290B91383696E150", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687840599, "uuid": "c5e3b731-2dd7-451b-b853-710e4e40aff4", "value": "a3a98f4b8bad628ffa25a9afc0275971", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687840599, "uuid": "a0b36ce3-c42e-4fa5-a5cd-e319271f9dab", "value": "12288:soSy5c03zftAPHpODHE2mhhLhwyEXZLmypA4usUV5jg7Dx3Z3Pm+F0Nv:1Rc0zuOzEFkZdfs5jeDl5Pm+Fu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687840599, "uuid": "04d5c3a0-7b9c-4758-91bc-0dd190d5b5a2", "value": 817424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687840599, "uuid": "dccfdc17-79c5-45e8-a1fd-e189cd3ee435", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687840599, "uuid": "51cafc51-a503-4142-9953-8da349e81531", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4d81c5c-14f7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1687876461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687876461, "uuid": "2e985315-f394-4c3e-8e9a-e114eb0c7673", "comment": "Malware payload (njrat)", "value": "db8d4358bf3aed4e73ac17044e6e8abe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687876461, "uuid": "40e7ceb0-c240-4e21-85ac-6d549242f6cb", "comment": "Malware payload (njrat)", "value": "928a3c5d87ec081f300784485443336fe023c176fb549cbcd50df141447da09a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687876461, "uuid": "8f58978b-81fb-437d-9d04-867cf7f1cee8", "comment": "Malware payload (njrat)", "value": "5563beccce091c2818bc99fa492b5ab14a1150f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687876461, "uuid": "2a78b76b-45cd-4812-ac0c-4a707e92371c", "comment": "Malware payload (njrat)", "value": "5e2d8598e21fba693fd07ef63f8459944e2aa9fef2555260a2f46dce956e9fb6ff0ad738272d5ae09a1c48e7c8457499", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687876461, "uuid": "f526b5fd-478a-49ed-8d64-382bc466a4f1", "value": "T145E207067BE94215D6BC2AFC8CB313214772E3838532EB6F5CDC88CA4B676D00245EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687876461, "uuid": "4c2ec02e-483a-47e0-8007-74ef5277f17a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687876461, "uuid": "b1a8053b-99fc-400e-8f6d-424907385788", "value": "384:I0bUe5XB4e0XGODzw0Q0mS03AWTxtTUFQqzFyObbV:9T9BuVY55d4bV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687876461, "uuid": "fcbdc547-1f30-42f1-85d2-2f12f6a303cc", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687876461, "uuid": "e97ca33d-5fb9-4e8c-858d-fcc44ee93041", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687876461, "uuid": "4d746b70-25fe-4f22-8ece-c030327e19a4", "value": "xGWTOIchgkp2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef66633a-14aa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687843488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687843488, "uuid": "6309aeae-8c5f-4e85-a3ff-956be0481f94", "comment": "Malware payload (Formbook)", "value": "10fff05223ad6d1bb04774da72f1d815", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687843488, "uuid": "cff2b9a4-6cfb-4e6b-b0c3-1f51d2ea0d97", "comment": "Malware payload (Formbook)", "value": "94e3996206fdc70b2ed95a87672b3516eac8a41d25c2c3659ed7933399bfa287", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687843488, "uuid": "206bc247-4815-4706-af3c-53977619ceff", "comment": "Malware payload (Formbook)", "value": "c85b33926aafd563649ae22c6506212591d36b0a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687843488, "uuid": "32a5bc27-87a6-42b5-bda9-d90068549011", "comment": "Malware payload (Formbook)", "value": "36173a56f0ac9b6679696bc918f309365a988be860afba4d8ac2951193ae7f2cd41834d9e31f2b7cae7acd688ab52f6a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687843488, "uuid": "9da5740e-a74d-4a2f-bfc9-af1b454c5c1b", "value": "T120328D36DEC42C6EE306343980F01105F6A438AF56BDDD1ABA36E5D9CA791CDDA05398", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687843488, "uuid": "08c3bbfe-7c21-4c85-a763-0211eb65fae4", "value": "192:gya0NI0ZmW6ARgZVPCK44AG9xXSJ+Ej70JY6KwHKcpkWY8cWeZF:gyXI0ZmW6ANK4499xXSJf70JY6H1Y8eF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687843488, "uuid": "0557ff72-ade2-4716-9e43-050ee6966b2e", "value": 11082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687843488, "uuid": "b5a4e89b-80d9-4902-803f-7e009f6973c3", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687843488, "uuid": "da256b6c-73d9-4607-b1df-df11495d2ddb", "value": "INVOICE No. KTSPHI-AUDIO.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f2399a-1515-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687889164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687889164, "uuid": "67b81e22-ce38-44c3-a19a-be0c8172d378", "comment": "Malware payload (AgentTesla)", "value": "fe4ffeeec8472fc2d83d0c7177fa22f8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687889164, "uuid": "47aa7b64-14cd-4d83-bf91-0a32e5b0659f", "comment": "Malware payload (AgentTesla)", "value": "961ab3859a4736c22b134277d019a3788c1c5a6b8ffa6833178416bfd62cd5ef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687889164, "uuid": "19191708-0f93-489b-b9d1-5e4d0adc35ac", "comment": "Malware payload (AgentTesla)", "value": "fea6970335db34ba5fc249f011b9fa4f70e9743e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687889164, "uuid": "94be0435-daa8-43ce-b59d-3176bb340a07", "comment": "Malware payload (AgentTesla)", "value": "39d1b3390ba5b0374859754a332e2a5f7e4a30adc2f88d26bc2acca53531de8e02537b2b4b2cf51353f139d3e56c75b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687889164, "uuid": "2db96443-29ac-4330-8d87-8bc80757dc6a", "value": "T11A4412147A78C17AD0868E72C8BEA7965AC9DD249510B34F23F06DA93D61392CE0D3F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687889164, "uuid": "1816df21-48ba-4f13-9690-e292596968c3", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687889164, "uuid": "c5ca7e98-fae9-41bd-8dfb-cc3226dbb0f1", "value": "6144:vYa60WHBy3eKP/2geWvVComvpuqqBIMGK1uYG4ujI:vYqK45EvKInKjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687889164, "uuid": "b3a596bd-be06-40c6-80f5-5ee56af3f281", "value": 273959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687889164, "uuid": "409bd5b1-1485-48d7-aadf-8d519c760f32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687889164, "uuid": "27ae3724-931d-40aa-83ae-9a8ea7b8a642", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "853a64e9-14bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687850612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850612, "uuid": "da59381f-b1ba-468c-a14f-884d4c2c8895", "comment": "Malware payload", "value": "dd87e7d2165e48deb5b0c26e94abfbed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850612, "uuid": "7b91c4f4-6bb4-4cb1-9946-0114dd90ecd0", "comment": "Malware payload", "value": "9785e32632c3b6b652f3fd3e0d4624b23090140e4cd14f0ae85819f243d93615", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850612, "uuid": "86ad14fa-7ad6-4e15-ae5f-13acc271eee7", "comment": "Malware payload", "value": "9c19038926330176e6b28f1e1432c31bf99cc70f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850612, "uuid": "c8de78cc-35c4-4e16-93a4-4c085cd5d0c3", "comment": "Malware payload", "value": "c7a710b1ae25b369a452c7dcf14f749629ea9c0672ccfe3d571633bf8d6911b19ace74245ae4287b36fb3f8eaf49ea07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850612, "uuid": "e3c167f1-6135-452e-b64e-58d984cc9a53", "value": "T10A56121AB9608C64D593D4331014D6A39205D68EBA18DFCF23B01D0AFEF59EB4B16BED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850612, "uuid": "1d2b716e-f7b8-41c7-89eb-161d43deed4a", "value": "c6e51dda1622035b42b177c9afe67c30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850612, "uuid": "84f62c0d-5ae3-40f9-ad62-7067ce1e076d", "value": "98304:Qq21KaNjf5rBIZU86Ch3/NCFBdkPo3Tsy1y6Ifgk31fTmU3Gt2U6cjlWt9ja5Sk+:e1DNr558bhV8dkwDsb6M31fyU3Gt2Ulk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687850612, "uuid": "776571d5-7d56-402d-9832-ec183966838b", "value": 6242005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687850612, "uuid": "26e926b7-1edd-4c21-a3d7-3dcca49a7894", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850612, "uuid": "c836bea4-b745-4c54-8ad1-7dd37351276c", "value": "dd87e7d2165e48deb5b0c26e94abfbed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f15a4bf7-14b1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687846498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846498, "uuid": "abbe89c0-1307-4a33-88c0-99ffa041ae4c", "comment": "Malware payload (AgentTesla)", "value": "b8c31ee527b911264f607209af5f0a8f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846498, "uuid": "5c2a0d2a-5080-4072-a9e6-a1874da99a30", "comment": "Malware payload (AgentTesla)", "value": "9b5878a78bc3e0fc2bf39e470a02b77509ed5935ff1139270fb8c15158949849", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846498, "uuid": "6c39a472-5fcd-423e-ae5d-e6b774e88246", "comment": "Malware payload (AgentTesla)", "value": "b972619af50a5fc6f3e5ff9c58cbd2a17bc46a1d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846498, "uuid": "45f61b7b-fab5-474b-944e-578d3a193e5e", "comment": "Malware payload (AgentTesla)", "value": "286731adaad733f0f4be23c8bf66eacea13cd800665cce8513fbe397f6c3d2d6b20437cdc8a66b0816082cce51dd0d2b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846498, "uuid": "4b503aa8-afb6-4ddb-a593-4b37ab25e19d", "value": "T1DCE4373938BD5627D074D7E78FE3F423B278982B3021EA2568C657D5468AF1225C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846498, "uuid": "acecd4a2-9eb2-49fa-8d5f-1d3d918d29e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846498, "uuid": "83702b4d-6d6b-4b15-b6cf-23531845bc9b", "value": "12288:M5dPG2fjXbY+j1AtUSIe70gKPbfA4g+6UyrEx2rQt34:03Y/N4NcB+65rw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687846498, "uuid": "555053ed-b92b-4f20-8e52-e8747476d124", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687846498, "uuid": "6b5b79af-ce6b-4534-b1db-f7c5f100d02d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846498, "uuid": "166ff2f6-5597-4515-89e4-bfccad7be9b0", "value": "Pre-Alert Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03324500-152f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1687900215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687900215, "uuid": "f9e39dc6-1a6c-4427-8ce9-ca9b73898d15", "comment": "Malware payload (AsyncRAT)", "value": "07e1fd6f83b065d803c4a61a18dfbe85", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687900215, "uuid": "8b166c43-fd18-4342-9f6e-3ff0e2114d60", "comment": "Malware payload (AsyncRAT)", "value": "9bb11c24d64c54983dbd9a784d8cc01d5fe6d78d280e17a1e4899c677c28a5dd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687900215, "uuid": "99f62f5f-fa3a-4f8b-9e1b-f334c765bd69", "comment": "Malware payload (AsyncRAT)", "value": "85cbc2d8141e86b654f38124819b720c1d962c5c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687900215, "uuid": "46d30d2d-d44d-44d6-baad-4e3918fba23e", "comment": "Malware payload (AsyncRAT)", "value": "42887a401ed5edff400bdf764c4f21bfda1f46a9b5740e4c340166f93269c897de03021fc9019287dc280fa2a39ad2ee", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687900215, "uuid": "ceb7dd6b-e19a-495a-8db2-8910d8352f13", "value": "T184656D4AFF95AC05C8F806348C97724E63A0E84574FBA76F2C4DBB349E672834DE5621", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687900215, "uuid": "b8eb152a-c2ca-4d8a-8f76-9ef9f71bdbd0", "value": "6f543444487328d5966207cb412374d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687900215, "uuid": "c53744f8-c00a-4f8e-8489-2616e594ea4e", "value": "12288:jhiaQcOob5ruXuEq++p6xG5ssxODepysgSk9DyL1HUyIP9IylT8rhke6nwB/nqeS:jhkcg+p6U5U8ae6nWqL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687900215, "uuid": "f3f04c80-6a20-41bc-9072-e5214ad198f6", "value": 1545250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687900215, "uuid": "d48f3281-c53a-452e-be05-e2b475fe8319", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687900215, "uuid": "be2e8a93-37b3-4a23-b401-99ba48e02696", "value": "07e1fd6f83b065d803c4a61a18dfbe85.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e672f430-14a5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687841326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687841326, "uuid": "896041d3-62a2-42c3-9c73-83f1528b97c5", "comment": "Malware payload (Formbook)", "value": "40df500e4caa9265ef6bea269c34140d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687841326, "uuid": "746c1588-6cce-47ff-a21f-e78f7f170aae", "comment": "Malware payload (Formbook)", "value": "9e4d05b5c07d77f2bf1fd7a22c59b4932f096ad1e140a536a025b5c325683073", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687841326, "uuid": "68ea4388-171c-46e5-b1b3-dd11c90413db", "comment": "Malware payload (Formbook)", "value": "db34bb2e6dc20b945443faa9f5c5607a66638735", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687841326, "uuid": "947af74a-dfa7-400e-b697-0a4521d970d6", "comment": "Malware payload (Formbook)", "value": "2e97ec606ec414cc1c0abf63fac2362ecb004fb5ccead5fbd351963c57036ceb5a458a9fa147bc717a357a566f64fa39", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687841326, "uuid": "b94008d2-dc7c-4d7f-a724-5f27ec0a2dbd", "value": "T143E4473838BD5627D174D7E78FE7E423B278982B3021EA2568C657C90686F1225C763F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687841326, "uuid": "6ce18953-185b-4b9d-a24b-6cd9c0324699", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687841326, "uuid": "e3b66521-1c08-4ad7-b802-944cf23e12b0", "value": "12288:a5dPG2fJ4owKoZ4Ra6SeLDIRh+iq41d+RfgCyVN:yJ5oZ4Ra6SeXwA+d+FghV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687841326, "uuid": "659b1a40-1608-4be0-8ca6-2b5c32716b2f", "value": 677888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687841326, "uuid": "c044593f-b73d-451e-bd94-0eeb627e8152", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687841326, "uuid": "b8510abf-c975-40d4-b6e4-6112ecc06b86", "value": "40df500e4caa9265ef6bea269c34140d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6ef3c15-14fc-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687878639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687878639, "uuid": "e58ac09d-814e-419f-ab1f-593878bbbce1", "comment": "Malware payload", "value": "e199331f39785daa5f96c8b151ce4cf7", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687878639, "uuid": "cf4e2f46-e1f0-4ed2-8143-4a3d8c9fad6f", "comment": "Malware payload", "value": "9f068ff06f531e5e5ab40f6772feb6c1ddd2266c23614a9cbdcf3bfd8a1be2f5", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687878639, "uuid": "3e840e27-9fca-424b-8cda-f4e21d06fffa", "comment": "Malware payload", "value": "7a132a301ecc51e859c14fa436ca00c20e88f60f", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687878639, "uuid": "9fb92678-ca52-4822-b7a1-531b66e4e068", "comment": "Malware payload", "value": "b3f77bde11f9d5ccdb3f224cb3419a4a20026fee5eaf012fd6e6c50e153658cdc0f2ec05032de3677e1cae2352bbab84", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687878639, "uuid": "264883e2-f8ed-4ec1-9348-c2fcca583112", "value": "T1D9F42312DA5526C6EE00F533B8CFB82E89B55BF5DCC46F613B819D2814A07B3865C87B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687878639, "uuid": "ead91b6f-8afd-40a2-a878-cda4176d1ab0", "value": "12288:qFBl1rhllebvT4CafyvEoHxyk/yusgPuaIcdIzcPsCX1h7sGHeg3z8d8/j:qvzluknfTOxdPHPuaIBtS7sGHF3o6j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687878639, "uuid": "cef8b0e8-dd85-428b-afcb-6cc1b7d32e5f", "value": 729771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687878639, "uuid": "d094f876-3280-42af-91e6-ab29a5e6c0db", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687878639, "uuid": "7d27e16e-9721-44bf-9562-606899ae7dfc", "value": "CI & PL.7z.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32cf7349-14ab-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687843601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687843601, "uuid": "97626874-2710-4aaa-a62a-5000203ea5eb", "comment": "Malware payload (Formbook)", "value": "6aa2ee2bfaff750ab8266c41c6fda649", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687843601, "uuid": "856d56b4-8286-4b8b-a06c-02235cba7efb", "comment": "Malware payload (Formbook)", "value": "a15661ebcc1385f7f9dad588171f02e25fc5049b65f597e195d1feb71bd5c2ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687843601, "uuid": "d42df029-edc9-422e-b688-fea1d6c87aa3", "comment": "Malware payload (Formbook)", "value": "ab769fe01ed9ce1bff433356905e84a9c14279cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687843601, "uuid": "787f266d-77fb-4e23-b135-5b24ad235b11", "comment": "Malware payload (Formbook)", "value": "b99e2c164b2686cce0723a1f5aee2a91c15da9cb13497abb4caf6693b1d183188c4abfc6d935cd0df9b1140551a74e6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687843601, "uuid": "bdc4f49d-4d68-4b35-9a0b-0ca4eed698e6", "value": "T1A7D4231A62F1C8E3D09F0AB10D9E2AB939E55C23155C5F5BB364CF89BC3BB51C10E662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687843601, "uuid": "efa9479a-1edc-49c0-af1f-62528a7589d7", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687843601, "uuid": "3c558e3c-17f0-4eb0-8814-8910a2b37ec0", "value": "12288:ZYDPCt5ZeA+VjB2IiNXiSjjhx9NQhp/vwyhFXG/dFaoLSS6YN6gPBlhU:ZYDKpeZsNz5NQh1wa5GVFBSruDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687843601, "uuid": "8e8d5d9b-7203-445e-b086-ebb8c7c08851", "value": 643777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687843601, "uuid": "ed63ccab-a99b-44eb-bb6e-4ec97912f787", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687843601, "uuid": "907dffe4-aa9c-41e9-85cd-645d5a964510", "value": "Scan-02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ca63e2a-14b2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687846544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846544, "uuid": "2710f9ee-20a0-474a-980b-463a4587b6f4", "comment": "Malware payload (AgentTesla)", "value": "e1a4c414637ee00c7f2cfa7c1fdb60ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846544, "uuid": "6300a4f2-ca7b-4728-9767-6c5d5fc92d44", "comment": "Malware payload (AgentTesla)", "value": "a468e8655a9d53ceb02ef5b2208e6e77ec3e90c44b89030880914e45df166a8a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846544, "uuid": "37c096b8-c36c-46fd-a57a-6256b9d04b86", "comment": "Malware payload (AgentTesla)", "value": "bf97a6a40e368c7682362a7ab0193d7f4d2a3a33", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846544, "uuid": "76b53b86-6da5-42d9-a45e-5a92506cfcb1", "comment": "Malware payload (AgentTesla)", "value": "d2bc0f9a3fa188edb4ad4acad96b6ee272563ea63e6f410d6d8aa3dac07049c1f849ab36c82b8100ee5c3aa8b99f1fd0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846544, "uuid": "b2f8f05b-7918-483c-86fe-5f2a98865ab7", "value": "T1C5C4234CEECD46017BF6D17707B2497C629BDC67F3F09E2187624C9A3AF60C16628698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846544, "uuid": "c7ee9304-8600-42db-849c-bbaa03ce975f", "value": "12288:OK2NYNcDUQfDwO+BNZeZKtwhljW7w+mmePQO0iobAsRQ2:j2miDUiOBmThEE+mFP/x9sZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687846544, "uuid": "c8c23959-eed4-4740-a94e-7a99ca8a0cdf", "value": 545347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687846544, "uuid": "78364c4f-8eb6-4cf2-b90f-dd9df0047949", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846544, "uuid": "40b89dcb-3f9d-498e-8800-73483d4cbe3f", "value": "CTM REQUEST BIRTHSHIP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c823fc-14e0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687866613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687866613, "uuid": "7c3839aa-23be-4e3b-a27a-1db4fd30c07e", "comment": "Malware payload (RedLineStealer)", "value": "21d66fbf425b59e773e1535e30344874", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687866613, "uuid": "b549d06e-b96c-4131-b04a-5036ae606d59", "comment": "Malware payload (RedLineStealer)", "value": "a471bd12a017ae8eb354a3bf5f5c8524c58f71ed3cde2428db1d8dbb1ef199bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687866613, "uuid": "a0d16880-74a7-43c0-950c-66121ed3617a", "comment": "Malware payload (RedLineStealer)", "value": "a0050f4727ef843e56067f4bc1c11cc80eab4b2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687866613, "uuid": "dfa17ebb-cdb2-46a3-a1f7-94c3516d056a", "comment": "Malware payload (RedLineStealer)", "value": "371e2cc2c4a0145ccb7a473c3f859bd3d92e5d3cb0b083758d2020aaf429cfbe3752208acd962ad038b788f08dc123ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687866613, "uuid": "0ac04b0c-a66c-4694-b97f-48083a166064", "value": "T178D4AE162F44F652C676CA36AAC34500C2FDC90376B2EB4A7CAD22C52F72B51F61DE94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687866613, "uuid": "2352b11b-b7c6-4223-ac24-3191b6a74565", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687866613, "uuid": "d88f0007-e263-49c5-a99e-495a45a36195", "value": "12288:8OVY4S4cUrZscIAqjkU+1zIAS/NYrQtNfCBMo:pNSt2Irkfze+8tNfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687866613, "uuid": "c54c981a-2c45-49c1-aa7b-035c82a74c5f", "value": 654960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687866613, "uuid": "3c4ab885-32b3-4f8a-a053-f50f5767d5cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687866613, "uuid": "6f2e6279-547d-4b7e-bf43-fd2405dadf19", "value": "21d66fbf425b59e773e1535e30344874.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "511c57a6-14bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687850524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850524, "uuid": "24b55506-46c4-4a58-a748-7ad4290cb57a", "comment": "Malware payload (GCleaner)", "value": "cffabd2eeaeaa379c36a106376628726", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850524, "uuid": "5ababe3e-9c05-4ef5-afb7-493eec9d48dc", "comment": "Malware payload (GCleaner)", "value": "a51a484a19d1d73db9b296267d940766b28c2f5354ed723f7c43a23a3d290a97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850524, "uuid": "d0bdba68-e9ef-4755-9774-675feb025a67", "comment": "Malware payload (GCleaner)", "value": "4ac3fd6e5b348e0626bcd1e6d90714649d159711", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850524, "uuid": "6766aa65-a529-44b0-aa76-e24503d05275", "comment": "Malware payload (GCleaner)", "value": "9c61b7097fca6b8dcd31c69d0c73ed9fb158f7d88314ddff9dba78ae14a18a532640e57cb7c19fe08a66230ae389c4d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850524, "uuid": "cbf5b77e-7f5a-4117-92d0-b80e04a0f035", "value": "T1D9649E1362903C91FD255B328E2FCBE87E9EF6604F59776622689A5B88710F2F173341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850524, "uuid": "380d3e3d-47b7-4c8f-8718-f52c7a474f90", "value": "5dd5075fae5a59fa90ec50a1478e2ece", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850524, "uuid": "759dc08d-f49f-456f-815f-1ceb8f4cc68c", "value": "6144:e5G4dvW6uyT1cjUFfbe/MQi6ZqSD59zogtw+X:0G4VwI1cIfa/KcH9zac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687850524, "uuid": "ca7cdc08-bae7-4278-bf23-72a71e88686e", "value": 313344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687850524, "uuid": "0a277e60-f982-4fb6-94d7-addd2b05d400", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850524, "uuid": "5f541dc8-2cf0-4057-8905-1740612fca50", "value": "cffabd2eeaeaa379c36a106376628726.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb99f5a-14d3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687860828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860828, "uuid": "b96cb754-6891-4cd4-a3a4-53fac5c082b1", "comment": "Malware payload (AgentTesla)", "value": "550b3061b6460ce24727b1260aabcbf9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860828, "uuid": "c1f5c28c-b20e-4307-b6a0-06ecbe865df2", "comment": "Malware payload (AgentTesla)", "value": "a5d6cff22cdb3581530d6df4f7f679e27b107c8d439f83daafee88ff7db037bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860828, "uuid": "998df367-049b-4cf6-8f6f-e30e6796cade", "comment": "Malware payload (AgentTesla)", "value": "a41554351e8e42d5421b0c79c87206cd7110c84d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860828, "uuid": "50f179c4-1841-4cc0-8804-f234df46766d", "comment": "Malware payload (AgentTesla)", "value": "4d922619245d88ad39231d7f9f319b77fad3cc555425bd992edbc32302e45562ef2d95bd3272058f8730f56db06b2efb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687860828, "uuid": "28d9447a-2c7a-485c-87cd-fc2aae94dcb5", "value": "T184B423CDAA5D8F91603562EE540B15DAAE990DEC198E34F00E406BCF431F99C1FEAD6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687860828, "uuid": "ef88d4f7-167a-4ec1-ab79-1da0b97f06fd", "value": "12288:xLJ/tEmseJb7XY0fPSfOL/DMKohKjfMr3ss:xLJ1EmHJnF6OLbTohKjsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687860828, "uuid": "43c64249-8c46-4c5c-bc28-1950cb497b09", "value": 522003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687860828, "uuid": "3b50c299-b3fc-403b-a0c4-5a451f1ed1dc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687860828, "uuid": "9297ff53-a229-4927-bbf5-18d666bb6f4a", "value": "quotation.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9052e32f-14db-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687864374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687864374, "uuid": "45aaf987-854a-4f4e-8255-7c39f1d98cf9", "comment": "Malware payload (Formbook)", "value": "51a8f77855919d585cd9c018539933c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687864374, "uuid": "b3fc5d72-a31d-4b57-829f-49eee5509099", "comment": "Malware payload (Formbook)", "value": "a791e98f4bf9f167ce7cf02a053c9eb280969237e4aa0699a23525fd3cfd2013", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687864374, "uuid": "16aedb6a-0ed2-438f-b62c-6e92c3bcf9a1", "comment": "Malware payload (Formbook)", "value": "25976581b89118e8fcb8e32b25ffe97e6588aa44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687864374, "uuid": "3567e032-8abd-4970-9c3f-1f6cfeb6fb70", "comment": "Malware payload (Formbook)", "value": "6b5f1e7cc865a5a02eba817d662e8fb764eb196bb238f7174290a96f5b4e247500a9914281b020705c522f9941e66492", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687864374, "uuid": "bcbc4ed7-3510-4554-8fe2-86c03e2ed196", "value": "T12794F12983B48B31DA5F077A64850953DF758546601FEB19AE94E0FD3BB33239E013AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687864374, "uuid": "8871b96f-d1e9-4835-ab94-aa65e4a46bef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687864374, "uuid": "f3f17499-7a0c-4026-a038-359fdea7f0e7", "value": "12288:H/VhheOVLQ4ptPkYDL5bdlBoENhugXQF+cp:pJ9FhlBoENhuggF+cp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687864374, "uuid": "ccb26932-9667-4154-90f8-758a012cdb2e", "value": 440832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687864374, "uuid": "a6050cba-5482-4550-8003-4a3fd88058e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687864374, "uuid": "0fd122bb-5364-4202-aef5-c04e19a573bc", "value": "P-0176-01-S-RM-015 .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "def325f0-14b5-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687848185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848185, "uuid": "a8835d5c-04e6-4744-8415-0cb002122148", "comment": "Malware payload", "value": "e4ced733717eaaa8db78828249daa7f5", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848185, "uuid": "2aaf6325-2636-4efa-8180-78143f930bad", "comment": "Malware payload", "value": "a8171d4f06287238c44d5a0368746d8c6e135b708f9ee8461641f02f31cec708", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848185, "uuid": "50c9d4ba-1ab4-4e24-81f9-a748c95b5937", "comment": "Malware payload", "value": "4a40e144a68968b79939f162d047252e52eaba11", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848185, "uuid": "919b02fc-e6d0-483a-a6ca-e8464e761cbf", "comment": "Malware payload", "value": "f15085c24e199bbaf7cc7d14c19ed64caf826c284d572c267d62e7a9c42598554bd63146a8b5368fb5774900142baf0b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848185, "uuid": "bccfce43-c4c9-4431-b6f3-48cb67c99a18", "value": "T1AB71F965358C1CD6D3DBE5E2C944BE6B0717F22AC5CB4D5052FDF9B0087F2220969AC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848185, "uuid": "4ad8f109-f987-4464-98bd-22b136ca428c", "value": "96:KwxXce3+Hm/LYEFLsvp7w1pgkQdiFEyfFcq:TceYm/LYyQJkuOFF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687848185, "uuid": "63bf8bbf-0c7c-4516-9b9a-68462424c632", "value": 3648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687848185, "uuid": "26ab723e-dc83-414e-9b48-185ea3871743", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848185, "uuid": "959f5565-29d2-45d6-8dc2-a33ac6a9a576", "value": "PO26-06-2023.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c17165d-150c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687885305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687885305, "uuid": "31b39986-5737-43ec-a3ed-1fb21e3fac13", "comment": "Malware payload", "value": "4473996acb6e43caebfadb4554824651", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687885305, "uuid": "c39c93c9-e78b-4299-b625-26bd33a23b89", "comment": "Malware payload", "value": "a8773ff50a394aa3de203618f36e63f5c80c4b0815c8f8ab130a0db8715847be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687885305, "uuid": "53ad50c6-8c7b-490b-b7aa-e5f65d16dca8", "comment": "Malware payload", "value": "6266137ec3bb9b8e6da28c92aed64d1d74bce025", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687885305, "uuid": "906c3b1e-9050-438d-ade1-6eeab464a144", "comment": "Malware payload", "value": "a9cd29910b231c7c0700849e12fbb440d0c520740c78ff4b8ce236f743c65f3834e6b5094e6f00bbb0554d1b8189a57d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687885305, "uuid": "c653508c-5bb4-4ab3-85ad-27deffa57d8d", "value": "T1B8958E2177A1C0BAC2A33931951E53BDD6B59D301B3952F756902F3A3F701D29A383AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687885305, "uuid": "5189811a-8a1e-46a1-92e9-13acd383da02", "value": "bd002053ce543385f312df496cd35b78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687885305, "uuid": "ef576fe9-20ea-4def-82e6-3f09c95a1d8b", "value": "49152:dk57gBz9VIx80pMmm3lmKpzwVp/ODRR100ZUOw8gal6XwS4AdjXwCuwKy6Gp1T:OuBzT3rmm3lmywV9ODRR100ZUON76AP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687885305, "uuid": "f10f9246-a037-41a1-b165-8a1dc4d5a8eb", "value": 1929728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687885305, "uuid": "63857c0a-1646-4cc8-ba6a-1a40ea21d884", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687885305, "uuid": "10c0efa5-252f-4f96-a357-9cc48e33e990", "value": "chisato.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb3fcf7-14a1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687839321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687839321, "uuid": "c09b6c1b-ec75-4939-9c97-7160c7d4cd55", "comment": "Malware payload (GCleaner)", "value": "439f902cad5984cfede4df7e6db3089f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687839321, "uuid": "618e0b98-c130-45e5-bf14-711bb51d9c90", "comment": "Malware payload (GCleaner)", "value": "a966075818dd971effd37c47d3de59591064a7bc99f37296e04c6d8a63ce3ea2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687839321, "uuid": "c06b6504-fa6b-4290-8b84-5184e5458e11", "comment": "Malware payload (GCleaner)", "value": "71b8fda375cb9514ebee9a97b57446fb7d9ae79f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687839321, "uuid": "4d8d37cc-add7-4e29-abb3-6ca94c5973ff", "comment": "Malware payload (GCleaner)", "value": "bd6978988e1b334aa3998e1d5b368c24e1cd482fa8f7546b9e625d499ea2b6e99dce5453174a59ab50ea85746e904721", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687839321, "uuid": "debddc0f-15d7-40c8-b809-b5f4b3a94e4e", "value": "T1F25523912DD9D174D210AE70AA2A41217E1FB77178B0391EB08D98FE9F1E213CE79763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687839321, "uuid": "888646e9-ceb8-47d4-aa52-eff3621918b3", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687839321, "uuid": "d155d99d-2845-4bf4-a214-9f018429d245", "value": "24576:tfOy1LH9CkWEPU0phI2ng58Lt1uD2gR1nCWZtP/hNy:tGkL2gphQ5YkD2wnCg5/3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687839321, "uuid": "4868a5fd-3b19-47eb-99d2-a37dc9692766", "value": 1280660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687839321, "uuid": "2197c0fd-ecb5-4ec0-a75c-84e833556974", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687839321, "uuid": "6edcf4af-ffe6-4ab7-a026-5aa83cb0e2a8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57732933-14e4-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687868144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687868144, "uuid": "b315f39a-726d-4eb5-8d1d-dab0841aa88b", "comment": "Malware payload", "value": "36042728353232894585e3da52643df4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687868144, "uuid": "d64ad18f-7214-4da8-8dad-2655a83317fd", "comment": "Malware payload", "value": "aadf2b464f02523fc5d14aa38a2d44fcb45fc1d74bd7a862806bf9874df2adac", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687868144, "uuid": "3d72d9b3-98b6-4dea-8978-c3904c08b18b", "comment": "Malware payload", "value": "7bb5d48b554d35d86505d18e51c6e816633c7b0e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687868144, "uuid": "7822b5a6-4640-4f0d-8e98-3d2c2cd48059", "comment": "Malware payload", "value": "83b1686b6f3a3014ff6d4357a3bb02fff2ce830b2df749fa2016a4be4e80c8760c4deb3f47973b24d00ffe1d33e456a3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687868144, "uuid": "240f62ee-f834-4569-8888-70014273397d", "value": "T162D47B8AEBC1DC6BC41503B04DDB9725273AF498A383DF4B27A495382C6376A7F8564C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687868144, "uuid": "0445bf27-bb90-4f27-9e1f-5a47c838bd95", "value": "e9ef9b3a65dd6bf58caf965b2eb31e2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687868144, "uuid": "6c091bfe-54f5-4709-8c53-806798317bf8", "value": "6144:aQsPjChP/DWxDmFKP9VCUMrex0Ai/k8XFRFj75Gn39OXaK:Bs7Rx6FKP9Vyp175a9OXaK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687868144, "uuid": "7c5979f3-d932-4c22-95d3-25d1b7973b88", "value": 605523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687868144, "uuid": "2d3cab78-5582-43f4-8005-f72bf6a77c3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687868144, "uuid": "5c33d8ba-4dd0-43fa-aea8-3adfbe2c85f6", "value": "04993758883.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054cf06b-14ab-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687843525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687843525, "uuid": "95dac203-e9a7-41fc-9d81-a3fc03a4711f", "comment": "Malware payload (Loki)", "value": "b41ebd5adc847f4e96c1aaeb64d494e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687843525, "uuid": "0e9498f3-96c4-4c87-a33d-3a8b7bd01d72", "comment": "Malware payload (Loki)", "value": "ac6dc0a36b72587d81149bc0bb5755ff33f9d9d926cc4086e508f1086fe4a7c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687843525, "uuid": "32b7b175-417a-403c-830e-64fab0035422", "comment": "Malware payload (Loki)", "value": "2e45c19c11ff8b7cc57afa0152519b713ab64494", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687843525, "uuid": "30658b4e-8baf-4175-b582-ec89e40a6dd5", "comment": "Malware payload (Loki)", "value": "8b6ea62166c7d606660b9e406bb3da98bbfe51676dcf5054983ffe31c1c42d5838b46911475744384764d53156ca2b35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687843525, "uuid": "e61c85d3-af1d-465f-bac1-18008aed9913", "value": "T172B4483C1CBD2A3BC175DAB9CFE98463F414943F39225A32A0D797558706AA325C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687843525, "uuid": "95489b84-53c9-4b64-b908-4fcac93ccfac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687843525, "uuid": "e5687c21-5e96-4414-8971-d9b680f354c3", "value": "12288:wf2iNd/uIaeioGziBUsdLjmGYPPRwbv1vEQT:wf17lae7EilABuBXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687843525, "uuid": "a2193d5d-c5ef-40ba-9bec-0e8c49dc9cac", "value": 534528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687843525, "uuid": "f69698cc-3696-4e7d-9fad-c5ca89a6568c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687843525, "uuid": "53c8b5dd-8a7b-4c71-aadc-7f92a1ee22b2", "value": "LvYqxtRqiuVI2UK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "605240a3-14e0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (IcedID)", "timestamp": 1687866441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687866441, "uuid": "c1337f4a-2e00-4e4e-84be-23ca402b25f8", "comment": "Malware payload (IcedID)", "value": "9f008ed4394230c96e4d1ae70f01b637", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687866441, "uuid": "dfeb878b-1a77-494a-b9cd-12c2c6e5f2f1", "comment": "Malware payload (IcedID)", "value": "ac7886cc666943c2c5e44e3b87c60c7e0540454ba0b51c4bf2b7ea54c0fd083c", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687866441, "uuid": "1906ed11-8740-4bb8-9a8d-e58c7ded2d6a", "comment": "Malware payload (IcedID)", "value": "dd1108e83b22d21ba4b703472caaa162b1174928", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687866441, "uuid": "0485e747-f348-4c5e-81b1-29fe6f12675e", "comment": "Malware payload (IcedID)", "value": "75df90b9c6a4b1e0446ac5462079e638d5fc9acafda4598e046148f05548a4053eab547df92210da5d09b9adf4a8642c", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687866441, "uuid": "f255acf3-78b8-44d9-b2cb-df56823ee64a", "value": "T1D3F4B7C227EBFD4304174372335526F5993ACA69C9D994DCF6463D98F0ECE02BA982C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687866441, "uuid": "30680962-4f20-4029-8b20-88a265a5d021", "value": "12288:VVYBuZ0kC6mDEKZEA7S8m0N219zZH2LuLZEiUroOpqHCZFMHCcyZK5D2dBHEMBO4:VVYoukC6mDDZEA7SP9dWLuLZNOpqiZyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687866441, "uuid": "533b62b8-ba72-4a3a-8eb4-5c4462dd3d98", "value": 781499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687866441, "uuid": "1957adda-fcbf-4d06-875a-9822b1fd5d41", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687866441, "uuid": "3bc55fe4-0870-4256-a979-8e7f7db227ef", "value": "Scan_06_23_Payment(49).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d639c6b2-14d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1687862344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862344, "uuid": "57507297-1b9a-4f8f-9479-f7f62d4276fa", "comment": "Malware payload (AveMariaRAT)", "value": "0ad874f44f05f8c656852e0af60b73ed", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862344, "uuid": "d588d65c-a7d9-4800-8fc9-a4c477450bad", "comment": "Malware payload (AveMariaRAT)", "value": "ad83447b6d362f0bae733ae90166306dcc9acb8e379f3285014b78edbe9fe916", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862344, "uuid": "7303b6b4-ac0c-4c83-9ea7-1dbba05b9f3b", "comment": "Malware payload (AveMariaRAT)", "value": "31f2bd4633d384612cad897719a870c961c5c569", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862344, "uuid": "c3ddf121-b9b0-4b6b-b89f-17a8d461a3fa", "comment": "Malware payload (AveMariaRAT)", "value": "e9c0a0c4a77c8335edee28d06f801818df647dd71d6439bb4a010f048361df7f7a22d021c03a05d1ed80c404908fce27", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862344, "uuid": "f1bf98f5-6671-49f1-bd43-7f5bd0eca85d", "value": "T10F859DD8B7A0EBB2E15F257AE0305211A7F2F4CA9F9AB38F0986E5F461027549C4D173", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862344, "uuid": "2b729e4a-fdab-459d-9b72-f7609b44045c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862344, "uuid": "f8308a73-e2c6-41dc-ab8f-fa754e9bcfe4", "value": "24576:0GL9vx+n/tkx0dPvObVfi1rXoPldNvqkZrYgyvha:3Tx0dnX1rXY3NH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687862344, "uuid": "f377ace1-5faf-4fcc-a29e-1f094e13d5f5", "value": 1712128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687862344, "uuid": "150f2d5f-d6fb-424a-b90c-579bca7897c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862344, "uuid": "9b765c21-4f59-44ec-9cab-a84cc4f0d45f", "value": "PO2304001.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3377a0c7-1526-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687896431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687896431, "uuid": "c09305cf-2c4e-4390-b1a3-9cc5a86007a0", "comment": "Malware payload", "value": "69982de5c51a70ca22d7a26f245ff290", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687896431, "uuid": "c4ea854a-d777-4cae-8cbf-39c50ebcce42", "comment": "Malware payload", "value": "ade353c90b0b14adb0712b7ff96528d8df015004b283170c6e2bbb19641374b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687896431, "uuid": "5cfbac3d-3b96-42f6-baa3-7b2b8f7aa9e3", "comment": "Malware payload", "value": "f14d4ee78dcdb17062d8e163f1a912e63114ad00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687896431, "uuid": "8d6ce847-b69e-4571-bd97-8dc85262c820", "comment": "Malware payload", "value": "0b612f2f91e88af22ec9ac8c0163f30fb4dfdf5cce1c4ace8cac56d9a56d83e1c281692ef57ed080469ce7450b3d21b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687896431, "uuid": "4de4734e-36f1-4ed5-881f-308096be88a2", "value": "T17CD5C117DCC2EF97D93C4439DACB98656AA6E5402B867D07B74E892030237947BD3B2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687896431, "uuid": "a7ec4c5e-4bfb-4ed3-9cff-230789bbd876", "value": "08ece2b1700596744480c3e95a25d19c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687896431, "uuid": "75a2ed18-559d-4f4d-910c-441e70b23219", "value": "24576:l3fUmitqXfD/XMzyDDwLpFe5JFegJPOgfYhXWam3hmtbNU7yJrZ0FCVxNvhAC8uD:l3cWXfzoTefFTOPWamwB6742FSNpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687896431, "uuid": "1dea8b94-60cd-4792-b39f-45ddf36fa833", "value": 2921984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687896431, "uuid": "3cfce600-98ed-44fc-b0a5-9d723d2da1dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687896431, "uuid": "020deec7-bd16-49ea-8352-6cc3f7b08102", "value": "ade353c90b0b14adb0712b7ff96528d8df015004b283170c6e2bbb19641374b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56133f91-14ba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1687850103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850103, "uuid": "c55d8a56-7e4f-4619-b985-9ea9dc439d87", "comment": "Malware payload (Fabookie)", "value": "3542f9fe5e390665d0a4dd4ee99c7ac8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850103, "uuid": "d6bf3d28-2458-4be9-9011-b875d6faf3d1", "comment": "Malware payload (Fabookie)", "value": "ae2ad7775613965fcbfafe90396130afb9754433bc7f9bd24f5e1b63c4d51167", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850103, "uuid": "d2bbbc0b-c992-4833-870d-492d0e15a32c", "comment": "Malware payload (Fabookie)", "value": "2b36de8442838a880a7a26718d7c0b630008f9b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850103, "uuid": "7054130d-b683-40d9-95a6-1b57b0cc1ad3", "comment": "Malware payload (Fabookie)", "value": "f33a213bd301dde4cc9488bca2322ed0871c049365670b3facd9e17408c438cd41ca573e91fdc69c1e5074370c99daf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850103, "uuid": "d589db9e-9ab6-40d7-9bf7-dbccb9c13f74", "value": "T112346CA2F3E80069E0B7C23A8AB15375EB7278591F2187CF1164566D2F337E18E3571A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850103, "uuid": "e1d88af1-0c72-406b-bc43-ee72bfd61b4c", "value": "0b788e8ff3124c2dd648ac7a27e0b5d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850103, "uuid": "3b729f83-ef04-468d-82b0-425a456dfcdb", "value": "6144:aqkvUK8JRGHAoBWxiEEiEEsfByAwZZS4onQFiy:atB8JRwAogXIB7GjFiy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687850103, "uuid": "77708106-a6eb-44ce-b312-c5f612874d2d", "value": 248832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687850103, "uuid": "72162439-bc1f-42b6-b758-6a9364d6ce34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850103, "uuid": "1ed62d9a-78b0-44b8-9ad2-72698d9d1735", "value": "3542f9fe5e390665d0a4dd4ee99c7ac8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc6f4fd-14af-11ee-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1687845556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687845556, "uuid": "03a39efa-f6f1-44ed-a9f6-3e8eeca1e69d", "comment": "Malware payload (NetSupport)", "value": "f8016d355d590580d70266291da33e0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "savastijir1-com", "colour": "#C2673B", "exportable": true, "hide_tag": false }, { "name": "savastijir2-com", "colour": "#F97E62", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687845556, "uuid": "6afebfcd-307a-4663-bcde-cb24ae201552", "comment": "Malware payload (NetSupport)", "value": "ae49d8d6d68069696428ebd3fce5a003af4a6ccaf4f67331eea37a0cd4dfbb77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "savastijir1-com", "colour": "#C2673B", "exportable": true, "hide_tag": false }, { "name": "savastijir2-com", "colour": "#F97E62", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687845556, "uuid": "9738ef91-9904-4d53-a642-b811f488f7b6", "comment": "Malware payload (NetSupport)", "value": "3b3e527555d3ccc19f4c590fa962bedde184a81e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "savastijir1-com", "colour": "#C2673B", "exportable": true, "hide_tag": false }, { "name": "savastijir2-com", "colour": "#F97E62", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687845556, "uuid": "b611e210-8676-410e-9507-4fba251b69ae", "comment": "Malware payload (NetSupport)", "value": "eaa1ce191809e34d5958ab60d33272b2aa2bab292bb8a32dec99bb24747f01a4a966b3ea8980ef8a148e1ba23c7782be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "savastijir1-com", "colour": "#C2673B", "exportable": true, "hide_tag": false }, { "name": "savastijir2-com", "colour": "#F97E62", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687845556, "uuid": "f24947e8-f70f-4865-80d5-0b40cb24b122", "value": "T1E0F49F37B1E09533D3732A3D8DDB5264982A7F022E28E94A2BE51C4C6F7978139253D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687845556, "uuid": "3ca26bac-0875-40ae-8d75-df716069a44c", "value": "44b6bfdd6ffd5450ebd675c84f22b9c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687845556, "uuid": "9115a55f-fa41-44f7-ab8b-784434aa0cab", "value": "12288:uXCY50vo8hpf5s53tdIVOOBFP71p4pCAa++0x/gu7TH8TNBqrEHeph/q/09:uyHo83Rs5sOsT4DHRMTN4rHph/59", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687845556, "uuid": "714d36fa-fecc-4731-b65b-0cac6c9ecf5a", "value": 754552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687845556, "uuid": "6145d6ca-201a-4f4e-a21d-7fcf6cd117d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687845556, "uuid": "5a8068d9-b84f-4cf7-a16d-84c3ccf645a5", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de54884b-14fa-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687877819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687877819, "uuid": "9cef604b-b050-4069-bc23-83942b570d0b", "comment": "Malware payload", "value": "2b83cf264c82e40c02adebb5f93bf767", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687877819, "uuid": "464927c2-4b51-4dba-b805-85fa742a60a0", "comment": "Malware payload", "value": "aecb50ccad847175bc20bb89b888bc4518168249f3dabf9a57433f6a667477a4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687877819, "uuid": "5839b1ec-b870-4ea4-a5b8-554191f70302", "comment": "Malware payload", "value": "c871a42ad155bea735a43709c255fa6edc48c1be", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687877819, "uuid": "0e02761b-5bc2-4f9a-a52f-3da27e386d48", "comment": "Malware payload", "value": "5387617e6ca282122667cb0447baf0bc48c0fd90027bf0546ffab9adc0cfee82e00b8a4d02373abcdb6252e6a09341bb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687877819, "uuid": "451a67ca-3e78-4e76-9c2e-13f0f9fd8637", "value": "T1A281863B97A28863DF5A4FB90C9B482C77E4762202A7063537D445AF5FC5563F803A11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687877819, "uuid": "f9cca41b-e33b-4e80-a330-15c036cc54b1", "value": "703e2ec2ffc200713a423a3068187e63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687877819, "uuid": "735560f2-1222-475d-82aa-08eaa7dba136", "value": "48:S1y1DA5CDJi4Z06hxsabow8wzUcoeoRRuqS:DJtEGow8wz/Xwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687877819, "uuid": "66710c68-c5e7-42f6-9acf-34427f35c8db", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687877819, "uuid": "e12cb08f-5bf8-495f-9147-de365a73a375", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687877819, "uuid": "343ada6a-3ac4-4995-a0f9-064d8b7dfb22", "value": "SecuriteInfo.com.Win32.Evo-gen.26751.28933", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b6951e-14c7-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687855580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687855580, "uuid": "ebece91a-30c9-48f0-b12e-b6e59ee26f79", "comment": "Malware payload", "value": "68286b585d86972d0d1e2f521043a157", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687855580, "uuid": "0647156e-c3ea-4923-9e64-cdd233e2c3e9", "comment": "Malware payload", "value": "aed1529cdf69aa49fa516ba6cd476b1ef466f66880175f949ec18fa3ccf4dff9", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687855580, "uuid": "d4ab4bff-f85d-4d13-9cb7-219a36b64dd1", "comment": "Malware payload", "value": "93097cbfafa51ef2c74399b74d591c03a54a0390", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687855580, "uuid": "29327d72-cf7a-4f4f-ac02-9ed0754900fa", "comment": "Malware payload", "value": "e2a958cf0e7ce2cbc161d4985cd1810bad640734bdcd570a2c2f0062739fb7eed5a3951e2c4a58db15efae402ea049d8", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687855580, "uuid": "ba32f6dc-8584-4a1a-b256-faa32ac99858", "value": "T145642334EA3D226FE94C8FC63300D782E68E907E115FDE1549F676A225A0271E1C3F69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687855580, "uuid": "8408f8ff-60d6-43b7-852a-0cf357109749", "value": "6144:6ns1Eeyje+aUPigmxQJSzNZotPH1ZXB85E3VSpDNWkUV3Ozj6vqQs0g6Zd1lBCcV:6nsWeZ+awXJSZZ0Pz3S0V3OzjGq6Zr3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687855580, "uuid": "678eef34-e15a-41d9-891a-27429e4e49ea", "value": 323862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687855580, "uuid": "496d5f65-5a26-4e46-bbee-82363f308d01", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687855580, "uuid": "b678e9c8-beb8-4c0c-b444-dc9b89fba51a", "value": "SHIPMENT DOCS 4X2000.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ebe61e2-14b3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687847084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687847084, "uuid": "4e16e92c-5af6-42d2-b14e-7da5a5651868", "comment": "Malware payload (AgentTesla)", "value": "0a239cc4763a680c9357e83fa6967bec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687847084, "uuid": "8b1eb955-56c5-4b98-8f36-868d34635735", "comment": "Malware payload (AgentTesla)", "value": "afa235a1f44a5ee2575ac26858ec9166cb64aac8102e5f0bcab26c7b9f0cf234", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687847084, "uuid": "c7b178be-a2fe-4560-b839-2bca4f9bca71", "comment": "Malware payload (AgentTesla)", "value": "fccb4fa2357863d1708694d80d20657c5c241efb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687847084, "uuid": "7b8ecd18-7de3-43f4-aaaf-9705b872799c", "comment": "Malware payload (AgentTesla)", "value": "670f295ce4c475ef1a5783f33dd7495e7da4258904ca509e91264ea4c4812d04bb8feb444121ca3db62e15b6c19b4daf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687847084, "uuid": "5993c163-45a2-433a-b035-4d77af77a898", "value": "T1AB24F21A70858807FD1063764ED1D696A2DAFC026BF6CA8F7198F31F5B357C0491AB8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687847084, "uuid": "e9667ee5-f67c-4307-b06e-b916b2bd9e84", "value": "6144:IZ+RwPONXoRjDhIcp0fDlavx+W26nAnqvBHBi0pnRrk5jMnWltEgxS:kvvi4rkKnWlOcS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687847084, "uuid": "d173966d-88ad-4ed1-90ab-6004c97b09a2", "value": 215040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687847084, "uuid": "d1134195-2acc-451e-8d32-d3bc2535d435", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687847084, "uuid": "9b2f8343-371a-44cb-8142-f833e6b44836", "value": "Bank Details.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac421116-14bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687850677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850677, "uuid": "131d2640-a441-4d75-ad6e-84b65ab85972", "comment": "Malware payload (GCleaner)", "value": "373a960c0a441fed488493adeb8434cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850677, "uuid": "f9642601-6d98-45a9-a415-9281a5f9f5eb", "comment": "Malware payload (GCleaner)", "value": "b169606348e918e55540b849e5ad2b01e4dd7815d76df7179a46ccf64b6692f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850677, "uuid": "729b52aa-e1d6-4fdc-8a3d-9926c0a43fa2", "comment": "Malware payload (GCleaner)", "value": "4c24bb71fa8d094428f17481258124a4f758af47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850677, "uuid": "3c6b4a62-eace-4c71-840e-da10fbfc0cc3", "comment": "Malware payload (GCleaner)", "value": "1018cdc8276b8eab473369d83e365d6fcbb0366328de7d1618418c06172964b57b72b6f8fa441d8c993782cbd541f32e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850677, "uuid": "a5a3050c-5839-4262-b148-3de96cd4dafe", "value": "T1A064E1513A80CC75D85925348831C6A5727FB8622724DAC7F7B83B6E9E223D26D763C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850677, "uuid": "0ea056c8-139b-420d-a55a-682bc00b28a9", "value": "6be0f5f4cf6bb40603faf64d65d5ff40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850677, "uuid": "63d7e4f2-4e97-48f0-bd4f-03e7c5b74861", "value": "6144:97Z9WWuwH9nRYJh1QS+ykvIUyTDCK2Ghi:H9KwHgJ2LA724i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687850677, "uuid": "cb84530b-66e0-4687-9e78-bf49dc4505cd", "value": 313344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687850677, "uuid": "90e793f9-43f3-4251-bfca-a9926197739a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850677, "uuid": "6788ef8a-750e-406c-8ec7-39ea49218499", "value": "373a960c0a441fed488493adeb8434cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9bfe01c-14af-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687845626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687845626, "uuid": "9da456ac-b95b-43c6-a890-8b97aba078a1", "comment": "Malware payload", "value": "50857bc9c9c6bb9fa4d3c348a0839877", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687845626, "uuid": "061a2a32-4c24-480b-8632-d0354b967b1b", "comment": "Malware payload", "value": "b25e32025a00ac3fd8c76fb60828e7a56591ae4a200550a6a185e2998eaecba8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687845626, "uuid": "e7e4c05b-4a87-40a6-b214-cd256202370a", "comment": "Malware payload", "value": "251cf9d5f90d643abc8596901ec1c4bd461def8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687845626, "uuid": "58c33ea0-b31c-49ac-868f-76d2bbf55b1c", "comment": "Malware payload", "value": "57f7753a6453b180c9b43beebb837904f29185cda3fd83cb8d79305c701fecbb8cca2df242a151413e0d3400e14acee6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687845626, "uuid": "e0e1fe6e-f6f2-4f6a-ad19-7d43447530d2", "value": "T1E8853397F0A722EAD111E27C3B1523DAFE64C450894CD5A21A0ECAE2C7BF497701B673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687845626, "uuid": "6ebf1be3-1590-465e-a4df-ca86de75ca51", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687845626, "uuid": "28fc372e-a7d0-4dd4-bad5-b8c892500e99", "value": "49152:CRp38sFd4Bvy8k7PTQ25VHA8NlJz0JASO1F5fZhZe:4LFd+y8kfQ2XHAWlJzwHe7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687845626, "uuid": "a60b2a5b-6d4f-42a7-a84f-c461d148d883", "value": 1765376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687845626, "uuid": "dd443371-9a89-49b7-84e5-af2d2dc30b33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687845626, "uuid": "69668067-ba11-4b3e-8704-3be227dcabbb", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4936a89b-14dd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1687865114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687865114, "uuid": "c165fe6f-a174-4bab-b94f-491091244462", "comment": "Malware payload (Gh0stRAT)", "value": "b601c1dbed6ed50e586dd5aeea6fc00b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687865114, "uuid": "c6bb6583-801d-4779-96f0-d8dab6e862e8", "comment": "Malware payload (Gh0stRAT)", "value": "b3102f0bb65a4d43ca46c22c008a21fd3ff06db976e94ceb2a322d805b9ddddd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687865114, "uuid": "c79ac4d5-6f8a-4e26-b4e7-749a18563905", "comment": "Malware payload (Gh0stRAT)", "value": "e66361b2a056eac9b23b4ee60187c153bae2f926", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687865114, "uuid": "d5813dbc-07ef-4695-a537-6d1550fa9e79", "comment": "Malware payload (Gh0stRAT)", "value": "62a86e7e48013773078a34ffbb8c9487450ef879406d08053bf096deb67d1820dd2f65da18d748ae158eff1d57d47f70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687865114, "uuid": "7dd7e842-5f56-4355-87c4-8e06ee643f5b", "value": "T19F34239B60A6570ED79610F752FBE2F724413230AA92DF25F878039BA76BF9540C2533", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687865114, "uuid": "2cfaef4f-7c28-42ef-ac0f-690230e6a186", "value": "6787dbebaa6a4ca7a12a614fcca534be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687865114, "uuid": "92fef2f7-7cf9-44b9-9e71-e36cdd7e0757", "value": "6144:H2ynQQ4rk/OmGU+pq/Q5pimdzMpbOJKoS9:WycyGU+pfikuq0oS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687865114, "uuid": "91859805-8fa3-4416-8f0f-ba890e0b1bb6", "value": 239300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687865114, "uuid": "917226fd-8102-4e60-8766-31c432f4b6e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687865114, "uuid": "b4fe78fc-2bc5-4e68-a03f-21bb0654db0b", "value": "b601c1dbed6ed50e586dd5aeea6fc00b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b80de9d-14e0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687866379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687866379, "uuid": "eadf5ad3-7775-44dc-8b7c-b597c7864b61", "comment": "Malware payload", "value": "2d950809af05e59e861896e4a85d4920", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687866379, "uuid": "c4a49e19-2015-45c5-9f32-ed9fd4bed287", "comment": "Malware payload", "value": "b371a9165a5aba71ba38d8ddd6d25b72ccde8f0803a225c5a2502c54c7660cfc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687866379, "uuid": "5fff02eb-60d9-4d17-bab7-479e197fbfd2", "comment": "Malware payload", "value": "73618070c587ccd8c2d5db1b0e9dff9c9752721d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687866379, "uuid": "c5e65069-306f-48eb-b9c4-9f12896cc2c4", "comment": "Malware payload", "value": "4c760277881775d936fb75ec9d2d316f1fd3775a190c44143779a65e3975a4720dc8de214de7613b0de936753d62525a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687866379, "uuid": "81aad7e6-0677-4db5-ad62-88bb62c931c2", "value": "T150D47B8AEBC1DC6BC41503B04DDB9725273AF498A383DF4B27A495382C6376A7F8564C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687866379, "uuid": "23a0967d-318f-4635-b45d-f90bf16d86e0", "value": "e9ef9b3a65dd6bf58caf965b2eb31e2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687866379, "uuid": "92e508fb-d23a-4534-a41d-0cb7098e8b04", "value": "6144:aQsPjChP/DWxDmFKP9VCUMrex0Ai/k8XFRFj75GE39OXaz:Bs7Rx6FKP9Vyp175p9OXaz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687866379, "uuid": "0d141e22-bf0e-4d32-a921-f54aa9ec18cf", "value": 605518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687866379, "uuid": "e3d1dadd-61ad-4298-98f3-b67d1d07a0e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687866379, "uuid": "4ac33e60-4be1-4494-a74e-f885dcdb0be4", "value": "123567890.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "541003fe-14b6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687848382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848382, "uuid": "c2335644-3ccf-4b60-976d-6ae6287de8d6", "comment": "Malware payload (Loki)", "value": "0f3fc4b7e0dcfa111d1c31955c99d572", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848382, "uuid": "1ad8cc72-c5eb-40b2-9e13-bc72542f1256", "comment": "Malware payload (Loki)", "value": "b55d2b174334aeb67e0568c3b9262fa719382647326eb5428fdcff753b9a7643", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848382, "uuid": "22ffdf08-9ecd-4e15-9604-bc62b37f596b", "comment": "Malware payload (Loki)", "value": "1e63b31f165238c2aa3cd267e0323d5b50bd8aa6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848382, "uuid": "9dd4f99f-7409-45b0-a7b8-b52b38795c51", "comment": "Malware payload (Loki)", "value": "fd2a2aab196b680c74c5c99ae7738c6319771de32203c3291227025d3511db1a4087334a309f7959bf1e6b62b3327ec8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848382, "uuid": "95e9325f-2237-47fa-959c-d7b5cb52857b", "value": "T1CBC4053838BD5627D175D7E78FE7F423B278982B3121EA2468C257C90696F1225C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848382, "uuid": "f188697a-159b-4a83-92c4-d27966119f72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848382, "uuid": "e91ef87c-b59c-4dc4-9090-a2dd24bb8082", "value": "12288:K5dPG2fHIcL99X110noRqil+Rhj3xpL+v2syy0R7usRE2:CHiIqRj3xpLgyyEiN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687848382, "uuid": "e5159ccf-2376-4690-a48e-3b5e248f1f32", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687848382, "uuid": "b4ce8b00-cdff-4ad4-b820-9bdbe8d359fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848382, "uuid": "df09c68f-f5cd-4384-bc3f-ecdce9b9b626", "value": "UPSCBJ190517000131.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ad083f-14da-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687863764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687863764, "uuid": "e3b0de86-092e-4c0c-a092-19a59dc98758", "comment": "Malware payload (Formbook)", "value": "dfd01aa50f0e19abde522cff89a56e5b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687863764, "uuid": "b3586be6-35f0-4144-b5dd-20f7b7894113", "comment": "Malware payload (Formbook)", "value": "b5eeb2909baa7f6e691a681665de9bf944e5b60566ec55a451a633877d372884", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687863764, "uuid": "fbb138d8-d20a-4ceb-bc10-ba46eff0d2d2", "comment": "Malware payload (Formbook)", "value": "a9f688cdef845dc5a820e0b5e91ad18094ca9216", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687863764, "uuid": "a97c9f2d-e5fe-4bf2-960d-53c6ddf39eec", "comment": "Malware payload (Formbook)", "value": "ec32d5e584535d968e66b9967ba02670d20925d7b0928246efab8468d23e6c7234519989c273840a272aa299f96a1cd9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687863764, "uuid": "41e6063a-6ba9-4f23-9c0d-0a3e16114bf9", "value": "T174B423FFB2E4C1FC5D2B7F4492AA89E6B26B755432BE2043432BF5443ACBA06C565C10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687863764, "uuid": "f293ab29-3e67-4012-8ba7-1e989dc69dfd", "value": "12288:wdStGZooWaoD1pC7A7jql6NLRoodBtdnxSDJm8RoE/rd4KuY:wdSsZoTdD1aA7jqYRdDtdx0p2EDd4KuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687863764, "uuid": "8b213970-5f2e-48b5-904a-dd78c0e4f372", "value": 528965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687863764, "uuid": "08cba901-c23f-4d23-bdc4-cc03aaa8cdf6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687863764, "uuid": "d4fec87d-2b45-4438-b65b-ae63b29c1a05", "value": "Enclosed (SOA).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5821afb1-14ab-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687843664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687843664, "uuid": "0ec8fc95-9b47-4524-8ad3-e42bc9e36d7d", "comment": "Malware payload (AgentTesla)", "value": "b796e38c482448f701956276a3a0d0e6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687843664, "uuid": "0e3b4e42-32e7-427a-b48a-fef753a49fa6", "comment": "Malware payload (AgentTesla)", "value": "b732593ae4c3d533d3ec021f91be15f52dc0f9799fae9ec7fdcddf4155e1c110", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687843664, "uuid": "9dce83bd-d1a3-4c0b-a6c9-141832bb4e52", "comment": "Malware payload (AgentTesla)", "value": "0d4ef72c89b7794eb5c4e23d636d39a8e38481be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687843664, "uuid": "2f5da81d-5059-494b-8b92-855a581543e5", "comment": "Malware payload (AgentTesla)", "value": "0660fd3038d7bb933029e30dc5ed5dad1de6be242d9ff13f86709f754b33a3494d1631517a76b83647f3fb2c5a80b314", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687843664, "uuid": "0057e7b3-37c2-4fd1-b5a3-929eed3bdbc4", "value": "T11DD46A3C18BE1A37F078D6B98FE48063F514947B392A5932A1DBC7516746EA328C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687843664, "uuid": "7af65cfd-1ab8-4682-b177-16b1d13b54c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687843664, "uuid": "adf7f28a-5b68-407d-bcad-fc49170de764", "value": "12288:GBlP14nzTX4tPFwVR2+6irp0NAPXy9Al:a514nzMtWVInZ2Fl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687843664, "uuid": "3102a0a0-23bc-4d8a-a193-ee08a31d97f3", "value": 603136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687843664, "uuid": "cf7eec54-c632-487b-a278-29b178b4d26c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687843664, "uuid": "6de37364-de19-4f34-9f8b-88e431859250", "value": "AIT#Slip3409748inv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "179eedc8-14f2-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687874050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687874050, "uuid": "43075e91-6e93-46d4-b15c-632450859d06", "comment": "Malware payload", "value": "08368db0596a802be93d06d8208cbf0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687874050, "uuid": "684db43f-179f-4596-b3d5-efc094e12137", "comment": "Malware payload", "value": "b7cb338abb490b1cc110d044049d5b5402bdaf411989d84bd739b7fd6974571f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687874050, "uuid": "a6f66730-ac75-4815-b6f5-2c0454a27153", "comment": "Malware payload", "value": "9ceabbdb8540a2f636e529a58291cee9cf30ffc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687874050, "uuid": "9acc9950-1933-46ee-8a35-7ee703995ec2", "comment": "Malware payload", "value": "82ca521533814019cd7e4f289804f9610d4b029fdc6abe47fe50b06f1eb340e6f98b1b513472d73b58142eac3f0f0f9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687874050, "uuid": "08082445-d422-4663-a647-84d9686c5c0c", "value": "T19755AE9E6DBFC42FFF32F47C58CCD09B0999893B90A09CF1AAAAC65F53404AC406556D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687874050, "uuid": "30e9ea57-e1a4-44d3-be36-dba65cc1e956", "value": "7d9136e63096821b46a9500baaecb5c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687874050, "uuid": "53a1ce26-725a-4d4b-9adf-1972df5883d4", "value": "24576:FdH9whcv0chkb+eVcM6S2l0+C17GuXCOPr8zFmfLpdKRUB/S:vHOh0S22J7dBP/QUBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687874050, "uuid": "e19cd9d2-a71d-430d-a265-92c09ed08bb9", "value": 1318536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687874050, "uuid": "858cec1c-68bb-4993-858e-cf5f1a3330dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687874050, "uuid": "c10a471d-7e1a-4f3a-b784-79448311712e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e13035-14bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687850670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850670, "uuid": "7f61afe2-d0c7-4776-90dd-73c8bdec8586", "comment": "Malware payload", "value": "79b8eb1674365a607baa86f8274b8f7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850670, "uuid": "26711983-81bf-4a9c-b1b8-a8d91a5a39ae", "comment": "Malware payload", "value": "b8b75479747af7f1297ea932b29ff54d25b11e473d40054ddd5bfb2f1f709f27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850670, "uuid": "ff623483-11e2-4c87-b768-90a9d706f267", "comment": "Malware payload", "value": "c9e82a4be67bf69f176ec505fef9d417b4c5b5f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850670, "uuid": "0dc7af35-5468-42ec-ba3e-b8c4ae8d664b", "comment": "Malware payload", "value": "c093b4a68322f6da458dbc98a45a4ce160e796e13fe0176f7697cdfda2a99329ac91b70e1d7f8630a2f829be452dca3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850670, "uuid": "a478d01a-027f-4915-ab90-48a9bb115901", "value": "T1A8B402123640F336ED9A743196D7C219DCEEF8315F9380B3AA4D627613E11C3996E279", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850670, "uuid": "cd5de7e5-a0b6-43b9-883d-a87d9a6ea0a7", "value": "a3a98f4b8bad628ffa25a9afc0275971", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850670, "uuid": "653c807d-e97c-465b-b6c5-ccf1c3398a91", "value": "12288:aMnO803zFaxxVR9UEXirp4zO8cllkLX0ot:aMO80Za1R9UEkp4CFkLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687850670, "uuid": "7313740d-6ccc-4c2c-b1ae-d3cb58967440", "value": 508688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687850670, "uuid": "27407afd-073a-4f0e-9ad0-ab833a742afb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850670, "uuid": "442f7d3d-4fc1-403d-8c93-44c4fbd2aba9", "value": "79b8eb1674365a607baa86f8274b8f7c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0f0cf6f-1544-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687909499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687909499, "uuid": "b359b92e-7d2a-4453-ac2b-21ec28c2ea92", "comment": "Malware payload", "value": "aabf6e287e6c6830922c5aa016b95231", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687909499, "uuid": "27d7be3f-1ab5-4c3e-8c05-80206d9aa8d6", "comment": "Malware payload", "value": "b8bf944c2eb350b766d8576c4d07a223051701318fcbdaede3e97f7868052a8e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687909499, "uuid": "9f84a92b-14f3-4d22-8460-47b2d12711ee", "comment": "Malware payload", "value": "e0de5d3849030af6a79c0db1770dc0efbe4b8f6d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687909499, "uuid": "e1c6e94d-9817-467d-8619-6ff34336b0a4", "comment": "Malware payload", "value": "462ff8ced57ec7148c478e0b8d6933ec8b919f3f7e0872b9d5efad42afdce5b5aaf5f7a25fe200aa75dbb36771af1a99", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687909499, "uuid": "eb568fed-d4c4-46da-8ac3-6577d44b5681", "value": "T13F336BC8D683D5F9F81615B1103BE7379AB2E579142ADF87C7ACD532EC12A01A21638E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687909499, "uuid": "58b77fdf-651a-4089-9797-ddc15a4c8c2f", "value": "1536:qZMizl22afYt0Y4F4Ht1z+Lqwgy5aWVwrP:quiFtJ4F4NdwDgCVVe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687909499, "uuid": "c6750141-23e6-4854-9f8c-4fa5ca8dfbf4", "value": 50444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687909499, "uuid": "7a8ace96-78ea-4231-9d30-5243c65dc6b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687909499, "uuid": "91885bc9-0b53-4d15-bfc6-8a8b80bb720f", "value": "aabf6e287e6c6830922c5aa016b95231", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cb6b17a-14d2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687860342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860342, "uuid": "18f71c17-bdd4-4e6a-b910-11c93e011472", "comment": "Malware payload (Formbook)", "value": "9439bb88c4eda6de98057cbce925dd52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860342, "uuid": "275089d7-cec7-4464-824e-bf2eaf60e9fb", "comment": "Malware payload (Formbook)", "value": "ba5cfc9373499678bbd2a9ca62e554be9c114d913cf97c00822917226df0bbe2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860342, "uuid": "96e3c104-c98f-4fc1-8ff3-dbdb042dbd3d", "comment": "Malware payload (Formbook)", "value": "0beaf3d600f2874bf92c279f6def6dc3994689e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860342, "uuid": "98133c5d-d554-4ec2-b1d1-6f6f933de12d", "comment": "Malware payload (Formbook)", "value": "e89b64985e1b24cebec373db0ad696315e68d5de480b5069a0adb5112a33368f00c73441235e8be2a8afe6f7601ef91a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687860342, "uuid": "89e70d78-9182-4f7f-b85f-01e0892949c6", "value": "T18FD4693C18BE2A37C175D6BACFE584A3F450843F39226A32A4D79755474AEA325C313E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687860342, "uuid": "9d324256-9fd6-4e59-a7ce-04e68200c581", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687860342, "uuid": "5f390241-d3ae-445d-a01c-d06b51f85a08", "value": "6144:Gun2GhNKCzapU14omvOrnsFD/1z1lKsQtOmKTmmQDl+oXLBJAV8GiPsKEZ4eWLES:H2iNTrTmYslh1lKqTnwtu8OJWLAAIV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687860342, "uuid": "4c07d41c-a57d-4275-8237-971cee47a076", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687860342, "uuid": "f4038854-5f21-4b73-834a-895ff0f37012", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687860342, "uuid": "dcc93918-04ab-4d68-b3ac-bbd239503818", "value": "\u0421\u0410\u0422\u042b\u041f \u0410\u041b\u0423\u0492\u0410 \u0422\u0410\u041f\u0421\u042b\u0420\u042b\u0421.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb4be69a-14a2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1687839965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687839965, "uuid": "c5b50b2d-ba49-460b-bee2-73b8ff8b4062", "comment": "Malware payload (Fabookie)", "value": "f28dac36f06299a8be8446ec1399bfc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687839965, "uuid": "f649d966-89dc-4770-b803-1a05b56d0dba", "comment": "Malware payload (Fabookie)", "value": "ba85ef6668b8a930e39c0f5988187d1931209706999c70aba86a635ac8c5086f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687839965, "uuid": "34650a6b-155d-4678-9eeb-eebcde79f137", "comment": "Malware payload (Fabookie)", "value": "42e53a9c744bdf5397ac0a73997d0d8fa5f98856", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687839965, "uuid": "f88476a4-e4d1-4e93-86bd-0f729d497e5e", "comment": "Malware payload (Fabookie)", "value": "72a1e40e232f24585111ba51a85a49eaf50b8e98f9f5815a0e27ed7350a7dec56b658cacea7795172f1a02d3997d40e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687839965, "uuid": "3c99638f-a834-4fcc-b29c-694285d8c992", "value": "T19615AD4377548885E04D45348DABCBB9E6B17C207B2C43A773B2BB4F6E32AD16512F4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687839965, "uuid": "45a4876e-b9d1-4423-bde8-dec861bb3dba", "value": "de5ffdef0b7fe6105bfe44941d62fcd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687839965, "uuid": "3355fa51-7b53-42bb-8fe6-d65803bd65cc", "value": "12288:77214bUY0DpDE3T51qviizQBODAFZCYylk25ZERX7s5Zx5Z25ZO:H+3wT5kRzAFncToc5Yw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687839965, "uuid": "0a074618-5b4a-4e1a-8dd5-f56b1a6fe4d9", "value": 956928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687839965, "uuid": "24b7f4f9-6c0e-434b-82be-822f1e6d80aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687839965, "uuid": "5ff3ee2a-2cfd-4203-b7a0-99d9fef386d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fea604e-14ab-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687843704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687843704, "uuid": "643d09a9-8ee1-4bc6-a9f5-d9b12bc38f15", "comment": "Malware payload (Formbook)", "value": "0f24969f6ee318933274f77d6d6ff7b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687843704, "uuid": "cea856bf-e0c1-4b77-b24e-768cf7c6b5cf", "comment": "Malware payload (Formbook)", "value": "bc1639de9b817b9d369cae27aa956d74339e106bff317c9c1c2bca4310fd1403", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687843704, "uuid": "c39116ab-1a36-4cde-8f08-55cffedbe3c9", "comment": "Malware payload (Formbook)", "value": "f4af2d842027698d049b173c84fe8f546cee500b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687843704, "uuid": "668b8840-8d5d-46ef-b187-32c99d7bed5d", "comment": "Malware payload (Formbook)", "value": "4fedbdc9ea5bd0678fb5cce1aa1be21e16c742b6c97564978223ccef97b217796ec7fd361de2efbc80305cb7497d40b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687843704, "uuid": "a3d9d202-fce9-48ca-a295-b8c15c44352a", "value": "T12825CF57A2C088BBC9A266785C8F9674FC15BE243E78B805FED03F5C6E7624174192B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687843704, "uuid": "a982c3e4-4ada-4466-82b3-cb9ea2292e0f", "value": "b2ffe640086070c19351a52301f6fb90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687843704, "uuid": "677b2b13-2198-48fe-9e43-c607cd3d87f5", "value": "12288:zWI+n1cF0p4WhPQbXfu/i7Nx29T1CWaXqIov5n0fc8MMvdgV25wqYyEyHcsbOonK:z28tWhPKXf9PvXqgfvcQrEyHFbOwd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687843704, "uuid": "b7706052-8474-47ac-9abf-937450ac5100", "value": 1007616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687843704, "uuid": "1edbc710-4053-46a4-b082-9df2c8bbcce5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687843704, "uuid": "aa49b21b-ea7d-4f06-8b2d-092cc5722dd9", "value": "BEFEHL pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e36626be-14f1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687873962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687873962, "uuid": "fe73060e-b4bf-429e-947a-cf161240150b", "comment": "Malware payload", "value": "bf3514efe0fcc8a29e1eb8bfd137587d", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687873962, "uuid": "4d4d6860-ea2b-4e33-bc9c-03fa229695d5", "comment": "Malware payload", "value": "bcb3d97c0b2b1bd986ab4a3a93527cdbb8795f7de71b236072923989331dbb5b", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687873962, "uuid": "17e0f903-f5e2-418f-95bc-0a68b96c905e", "comment": "Malware payload", "value": "0e4ede444b07220bf753b9772a1e96788593e3b6", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687873962, "uuid": "711358a8-db27-441c-922a-52e654a8778f", "comment": "Malware payload", "value": "8e65ce83161d602c41222dcb5f78df61725035a85f52ac482ffd76d13ff9da8765fefd1604a6c0243ac6af12a643860b", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687873962, "uuid": "99437e10-5559-4ae6-ae30-117331d4cedf", "value": "T1A6352397E637B271F81FC2FD48590FD047FFA9648959E1E821E0672BB84B6F4852021E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687873962, "uuid": "a0911f59-ecfc-4495-a63a-00219bff9749", "value": "6144:kxlPDRVbvyExlbM8/syRl614CD08JmAlWSE4dau3xCEN6awmFhgTtjr:kTPDDxbM8pRl61DmAl33bx5w0GTtjr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687873962, "uuid": "5baedad5-a958-4fa8-9ef6-d763af042f37", "value": 1086216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687873962, "uuid": "2d308073-93dd-4781-9ac2-9bae96ad17fd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687873962, "uuid": "4dac9817-f028-4f89-881d-91a701467e2c", "value": "infected.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20ae25da-14b2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemoteManipulator)", "timestamp": 1687846578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846578, "uuid": "9d09e9f3-14e9-41bf-8017-eaf7d30ed1e2", "comment": "Malware payload (RemoteManipulator)", "value": "dce162d5bc1003f01964b0054898a785", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846578, "uuid": "9092e83b-3278-4310-9c5a-024d18415d58", "comment": "Malware payload (RemoteManipulator)", "value": "bf1c63b89d75f1a8dec193761bcd3f7188bd5c520c435698645874fc5e24d5f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846578, "uuid": "475a73b6-5643-43da-96f9-a96145c05ec8", "comment": "Malware payload (RemoteManipulator)", "value": "30eda012b307cb43eb9521b64b3ddfad1d295df4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846578, "uuid": "d6765584-287a-410b-8d97-39b1bd307e2a", "comment": "Malware payload (RemoteManipulator)", "value": "e66e23aef5789601ca09fb6cd353cd2e1704a724aedfc15164acc4aeb2a1db36e0aba12a1c386f92638470fa340a5540", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemoteManipulator", "colour": "#F73CCE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846578, "uuid": "51272aba-a4b6-493a-a168-c4dc459d4c3c", "value": "T1C976338BA6DF6375C4D647302279836B3B327166223D8F13281B5A88E7B1447137D6EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846578, "uuid": "f50ff2a8-d36f-4086-a2a4-f83d0d28c305", "value": "2339ac77bf9371500ebbf86df3a10d43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846578, "uuid": "1120ed73-9dc8-4e63-9651-7e94d6f4e513", "value": "196608:TVAKtrkR9HveD31pCLNav2qoSpxixx2UtPaZ:5AKskz10LNav2qoSjgsMSZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687846578, "uuid": "32af6612-5764-42d3-bb4e-c977527d0862", "value": 7454720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687846578, "uuid": "9b030866-fb57-4cb5-8ae5-d254e830d041", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846578, "uuid": "f56bb04e-7528-417a-8d09-948d3196d06b", "value": "dce162d5bc1003f01964b0054898a785.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b39cd1ac-153a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687905236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687905236, "uuid": "e9f1653b-dfad-4cbe-897a-91b4d0620d50", "comment": "Malware payload", "value": "da6f499c62099c6e640b72bf10341af2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687905236, "uuid": "4ec9d4d0-249d-4e9d-bc7d-27d04289a679", "comment": "Malware payload", "value": "bf80d0ade33c140feb3b19e668c37125781377ae748f49cb34e43abf17c09223", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687905236, "uuid": "37d95183-011c-479f-9964-1dca248a3d22", "comment": "Malware payload", "value": "0e2f39c28931a0253efbe64a5edeb8b24946ad49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687905236, "uuid": "2fa8cb2c-db37-4d1e-82af-03e6acd47e0d", "comment": "Malware payload", "value": "a6b91f2898bb986d4775f8b2961283f4f3e4c02ec3ae35b4c60e7d8cce7d941a11bfb1de2532c675f72cb2b47dc58a40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687905236, "uuid": "b2abacf3-0724-4b5a-9b6f-4f0af5faf839", "value": "T115A6296BB2A4C129D15EE27AC4AB9F40993370B91B37D1EB529003660E56EC4DE3F770", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687905236, "uuid": "e7eafb36-bcb0-42c8-887f-39f74ebb6cb2", "value": "8ad3c8f2befbfbbb7ed7c3ff64c30859", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687905236, "uuid": "9f3064c9-f11d-478b-90cb-667ae144b784", "value": "49152:Gcm5QQHJhTVcpMVX/CZlq57SKfNfREGjtlkUSoV+9J8Ho1EIqERLIHQepqtnMQtZ:Gc0x7I+933Ho1Et/+zxtcs820", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687905236, "uuid": "f8f0c04e-eee2-476f-8df9-11c265bfb6e6", "value": 9975808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687905236, "uuid": "8720e42a-764a-4789-93a6-5531717bfd3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687905236, "uuid": "5dbe91e2-e634-4bd3-8cbb-68ff25ed557f", "value": "SecuriteInfo.com.Variant.Barys.434263.5093.31846", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94106a03-1481-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687825726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687825726, "uuid": "0a611915-5891-4f58-9a9f-2d8852984932", "comment": "Malware payload (RedLineStealer)", "value": "b2bd05386c45b15e5c1445313f8ec9b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687825726, "uuid": "9e5be7c7-f76d-4ce0-b1ce-f7b54dbf6257", "comment": "Malware payload (RedLineStealer)", "value": "c02bcd0a9954efc757843ed7cb05da07385ead554d57e140e712095fb6984361", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687825726, "uuid": "b888b45b-8a4a-40e9-a420-431337c18524", "comment": "Malware payload (RedLineStealer)", "value": "daf20204e659fbc9db63b29921b0a13034f11f9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687825726, "uuid": "da654873-0e2b-487b-bfca-32352ed1161b", "comment": "Malware payload (RedLineStealer)", "value": "3d22b4f2ed30fb03d332b52cdae8db906358e9293c0386e18f9a488cac10c7eb98696a6950f60be21cdd5671c04f00a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687825726, "uuid": "e6086a09-50b1-49c6-9753-83f2a93a1e8e", "value": "T130B412327540B335DC19703199ABC265DDFFB8311FA3C0D3678D627A1BA12C78DA9269", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687825726, "uuid": "de6033f7-366b-4de3-af76-e5df9e55c0e9", "value": "a3a98f4b8bad628ffa25a9afc0275971", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687825726, "uuid": "170bd63a-73e7-4f1e-bcc8-37fe62cffbbb", "value": "6144:3ZXZwA0q6Zwh24HVvsrlnRyq3BqAJv3uxxiDVTco3Ty2qf25MEJKtOjW+pA3v9cJ:RqA03zw7AJGhfu/MuWBlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687825726, "uuid": "f1e39610-e686-43e9-bc8d-876da61a093d", "value": 520464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687825726, "uuid": "52621813-5d82-4be0-8b18-93b7235f75b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687825726, "uuid": "0cb4c875-21dd-4a28-942b-d130c78024d0", "value": "SecuriteInfo.com.Variant.Cerbu.183612.8808.18744", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce1d5b84-14ba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687850304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850304, "uuid": "b9ef6965-d528-47da-bcab-949c13f7463f", "comment": "Malware payload (GCleaner)", "value": "d4a4c05ee98a2af57f701aa55eff53f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850304, "uuid": "24b25446-835b-43dc-8bd6-9fc230db15e4", "comment": "Malware payload (GCleaner)", "value": "c1239caa69772d9d7117120e13438637679a5dfbea4f7426b1e70e5cdb07da10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850304, "uuid": "c9ab740a-0a2f-4200-ae39-b6354bf691f0", "comment": "Malware payload (GCleaner)", "value": "082cc22f76dbfe7f63efa10376ca0ddf9bbf0ed7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850304, "uuid": "4516cb2e-cfbe-4af9-a909-74256475f1af", "comment": "Malware payload (GCleaner)", "value": "445dfe7766da813f849c2da72a07a62e466c65d21419ef5c95e342d511f00147c52e9f1e3f9863c941694efdda2cfcf6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850304, "uuid": "d61e71c0-9b5c-4bcc-94c0-368f05c0902d", "value": "T10954CF5366D03C61ED25A6318E3FC7A82F1FB6204F59BB966228562BCD710E2F532342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850304, "uuid": "ae351e32-baf0-467a-afdd-ec037d7ec387", "value": "beb5a90def3136cd5678402095e4e39c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850304, "uuid": "12fef17f-fcd4-43cd-a004-0452cf76e6af", "value": "3072:208rNnSlNaLbofRuuA/OUvJEuuUL6LPpjTS0tE6cI4cT3B0rKC95s6fuBla7RcKr:p8pnSl9MuA/PvyTHZh4cTmrjX6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687850304, "uuid": "9391dfd5-afdf-4ddf-a64a-b36755a9be41", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687850304, "uuid": "0fb067ab-eb82-4519-b54c-e5633edfd152", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850304, "uuid": "d036178e-cfc9-4837-93d6-ed8c5233f8b6", "value": "d4a4c05ee98a2af57f701aa55eff53f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea450bf-14b6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687848265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848265, "uuid": "91f3da7f-903b-43f9-b276-23460e907564", "comment": "Malware payload (AgentTesla)", "value": "d0a6a049834612331506f3f296b22185", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848265, "uuid": "d6462897-bd98-46a2-911e-d7ad42adc9e8", "comment": "Malware payload (AgentTesla)", "value": "c1c41ec1f495a0b825d766f3cbff298777033bb1447d7ccbec6a03bbe0bd54ca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848265, "uuid": "67f9f367-2656-4a65-9226-57d3cafa249c", "comment": "Malware payload (AgentTesla)", "value": "0fff94995240878958c1edc0b305dc73bbd98b20", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848265, "uuid": "3e1bd6d8-7373-4266-8106-1a70485a08e8", "comment": "Malware payload (AgentTesla)", "value": "cfb38d6e78e2723f9f4b46723c4584d0eaf4202087e3967c32d581282f0d667740955c58ecb413df888ceaaa38785fcf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848265, "uuid": "fb5ae159-a5fd-4351-851d-b24ac89551cd", "value": "T17DC4BE1136E8AB17C53AABF44971917107BBBD1B4A22D20E6ED476DE5BB2F01CC60B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848265, "uuid": "b9257d62-6717-467b-bf31-822c4421cba1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848265, "uuid": "f899156a-2aa1-49ec-9e42-55d1f4d9104d", "value": "12288:z4esyKPUz5ZKXqkn1OAeD7JAOSMfNQJ5mFvcy:z4eXFzvKXqqAAeD7SORNF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687848265, "uuid": "1ab1f6c3-33c3-498e-95a8-35f52bf8a189", "value": 562688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687848265, "uuid": "0284a46f-e61c-4c78-afe6-4497ca482be2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848265, "uuid": "902d2c28-e3fc-4a59-8aef-db19cab47537", "value": "Halkbank_Ekstre_20232706_075616_005737.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed116b56-14ee-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Vidar)", "timestamp": 1687872690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687872690, "uuid": "5d83ac54-0bc7-4d06-a3a8-b1e11dd2a6ae", "comment": "Malware payload (Vidar)", "value": "1845537ec71c2e5b01523a9f80b4c87f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687872690, "uuid": "3d74bd99-b930-42d9-bf66-9c07dd3e3aac", "comment": "Malware payload (Vidar)", "value": "c1f234ee29062e05c71fbb29d43b75e4a73aeccc95201dea7956fc6e6a5949cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687872690, "uuid": "fe35b50f-b074-4cc3-9545-101a9834f76a", "comment": "Malware payload (Vidar)", "value": "43394dd0e14b0ae5869e1d52d2ec5f8535f9c3ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687872690, "uuid": "d231c0ac-361c-486d-84de-3223d329b254", "comment": "Malware payload (Vidar)", "value": "e0247bb1f41537b4e467327e74a41c80c9938ac11545a5c336e6aef651e4ccffd097b5296cebd10a967ef04442e3aaa4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687872690, "uuid": "ab73b767-f39a-4de5-add7-1e4ec110674b", "value": "T1C96612632194E985E8FF44BC86376E61B5F38767C609D478B5DD53E70B338AAB223042", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687872690, "uuid": "238e4164-93af-422a-9404-e72df6b8092f", "value": "1d6c410ad90082df83010d78a0e3838a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687872690, "uuid": "bb0aa5b9-47dd-4802-9be1-24c96173e6cb", "value": "98304:1Pf34UZzFjK5mepMW08/xrrbPy7WGY96lQzwudnzv+Vuxx0ZbrRvs0143Zz7:1BzcmOMin8yYl8wugVuxxuRvsz3x7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687872690, "uuid": "a67213a8-cf77-4c61-8de3-f574b5b3cf46", "value": 6507184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687872690, "uuid": "cbe8902b-900d-4f76-980f-b52727ca5681", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687872690, "uuid": "e83b13ae-d7f9-4a3a-81ce-4ebbed2ab073", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cae8641-14ee-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1687872367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687872367, "uuid": "50f26e94-bf52-47c9-ac7b-54865d72cf33", "comment": "Malware payload (Fabookie)", "value": "5d63359bf8e2f5c2e842770c3c6c8b5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687872367, "uuid": "f0cf277a-38b2-425f-bcf4-e5769347f534", "comment": "Malware payload (Fabookie)", "value": "c24dc008827ad34ac3465f1af91e84fecee078966d5035dc0d4e43e58204eea3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687872367, "uuid": "be6ff1e7-0414-4e7d-9e90-d41adbbace66", "comment": "Malware payload (Fabookie)", "value": "0521591459e3bbde2efe1882a195a2abc7118dd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687872367, "uuid": "e88ccf9b-ef00-41a5-b2ac-20605e06f875", "comment": "Malware payload (Fabookie)", "value": "b41378154f70c64b308e9a7ad75ddb164e9a9418ae815194a81fa73a31b934fa1e877605d41c1d5ddd66ccbf97cc956a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687872367, "uuid": "63b87858-49ec-4a4c-8ade-6f67e8ef9766", "value": "T1F2941749FB7408B5D096C531CDBE8376E272BC831B25930B8641FF5E2FF362169A9681", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687872367, "uuid": "b9e5a7ab-7990-4dcf-86ce-0e245bd373a8", "value": "ff082fef3d15cdd142534440e54d6a28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687872367, "uuid": "c918ecec-d8b0-4818-862e-05cd25993bdd", "value": "6144:mycE7sQLwDiHMOoiT4MKBz3IBJmGerEhgVIXFML:mfeUDARVrKivZerLIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687872367, "uuid": "f0155b68-e277-4823-bae5-b9eee2600a4a", "value": 427520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687872367, "uuid": "cda16d9a-edf2-4944-b74f-4ff57ee51ec3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687872367, "uuid": "b4a914f9-68d8-4c72-b87f-4952314de852", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ec5a5e6-14d3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687860962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860962, "uuid": "3fbd9db5-64c6-47f3-bbf2-6b31eb850bf3", "comment": "Malware payload (AgentTesla)", "value": "5be0a1f00aa2aa0243ff9d82e6e69f7e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860962, "uuid": "714095b6-a7b4-4b9e-b80d-fc73fe5caf29", "comment": "Malware payload (AgentTesla)", "value": "c2de40c6b794f3fc02d265e7ffcdd5a9f0ef0c6eea2d9d12c3026b77e5996b1a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860962, "uuid": "afd2d018-82df-4c31-bccd-6184c58728e5", "comment": "Malware payload (AgentTesla)", "value": "00edab0bc5aa1d13a8b33e0b275dd25530ef2e46", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687860962, "uuid": "1abd600a-9280-4899-bb2b-2c7e64789e87", "comment": "Malware payload (AgentTesla)", "value": "9e1f71695bb4b5d05c372617e4461b85ba69c4492ddb9a8f316a5a24d5df67c509cfa372539b84daebc0660ef197f185", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687860962, "uuid": "ec8f980b-bb43-43a3-a7a9-16f133d6b2f0", "value": "T1D3B433918F8E0D94FBFB11B634B5AE931E523EEDF80183C82765988B9427258650D7B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687860962, "uuid": "26d29eaa-187c-4792-8dc1-93fc068019d7", "value": "12288:pXRmhchnNHcJQ+hh5442BCfNkjl7N6/N3ArvYdYWXX:pX4hanY57fN02NQrvYdbXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687860962, "uuid": "876c4d86-a67b-43d2-a35d-f5fb189d4e2d", "value": 496184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687860962, "uuid": "76dbfa57-9bfc-45f9-9fcf-45de56355e1f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687860962, "uuid": "ef5019e8-c067-4ac6-aeae-e69dd163c6cb", "value": "ORDER 80470-4-6847584 2023.R01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4566adf-14a5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1687841242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687841242, "uuid": "4c03dade-b13b-42f3-baa1-0bbb98ab21d9", "comment": "Malware payload (CoinMiner)", "value": "f72c5468c3a2533bbedbcec608f50b72", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687841242, "uuid": "8d878667-ac45-41b9-976a-b503f5184b1f", "comment": "Malware payload (CoinMiner)", "value": "c393f4266b3411f9de7951fe1a2deb8e7bd37387e6c6a5b814f822df7633b76e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687841242, "uuid": "ace646c1-06a8-4665-8065-7199dc941104", "comment": "Malware payload (CoinMiner)", "value": "369bf03e676d1b2d7fc3657220388aae39b5c273", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687841242, "uuid": "ceb8437d-2cde-4f55-9af8-c5ad0ff4576b", "comment": "Malware payload (CoinMiner)", "value": "856faa1b2227f2e12673f521f59f5b950b4c23b5abf37a9bed765dc3bb5c40309382330dd24ed0b2f44ca727e778459b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687841242, "uuid": "c3f62092-239b-44bd-a324-fcbf0adbcbec", "value": "T1C6445C1362F17C64D5364B728F2EC6E4361FFA508E5E3B6622186AAF09B01F2C673750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687841242, "uuid": "967b46e9-6b7d-4d23-9e37-d24fa8cdd253", "value": "6697fa255a05fffbb8331cc121287cb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687841242, "uuid": "13262e53-d4f0-4d59-b42a-ea3584ce9200", "value": "3072:+M1Oy3n2s9UrwKbOpuM1+seYKkAat/cRNxmrG/u/LRKx:LO5s9UrwKbmnlepm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687841242, "uuid": "53be17ce-ea53-4bec-84ef-3903304cae7f", "value": 266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687841242, "uuid": "1f08e3ce-42dd-4a30-8b9e-ddde2a4070b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687841242, "uuid": "a7460ec3-69a8-475a-9e4a-fbfe5d0c9d92", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b58d81-1481-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687825727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687825727, "uuid": "e7abdf0a-0b60-49f4-b4b7-ecc700b26ac0", "comment": "Malware payload (Amadey)", "value": "e609d62d8d48da3d205b632cd2fc52e8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687825727, "uuid": "295e7ad1-32e9-4ba1-acff-0951ba6216f8", "comment": "Malware payload (Amadey)", "value": "c475ad88a8be90ba3e04a8918cc1a9380252e0781744e5c6412751dda1adc032", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687825727, "uuid": "1f167333-3eb7-49cf-9bf4-fa9725132157", "comment": "Malware payload (Amadey)", "value": "ef8bccd642d0a9186e2e205ebe3888cd8aa071e3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687825727, "uuid": "548af37f-3ad8-4e87-9011-90ed2c7eb35c", "comment": "Malware payload (Amadey)", "value": "d6049243407f12722d955f0acd98c210921e6e5c5b0ffb1b01584781b1a087865fcc371b431d7476cd384dc8e89843e1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687825727, "uuid": "9054dc01-cc23-4a5b-982b-e36c75e3ce1d", "value": "T1D0B402313640B339ED993471979BC726CCFAB5320FB7C0E3EB4CA1660BA2187965E255", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687825727, "uuid": "3be1cdcd-8bf0-454f-a42d-bda4ff1cd277", "value": "a3a98f4b8bad628ffa25a9afc0275971", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687825727, "uuid": "683b431a-0635-416f-91d7-8c1cec153460", "value": "6144:fdHpZSe0q6Zwh24HVvsrln+y1gDhN41TkLIsOk28joWyoW2sH98COzY8POERnLqn:z4e03zPiDhN475Dd8PNL1/xmdAqnwzk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687825727, "uuid": "d7048962-5c9b-4d1f-9c65-a63ee3540712", "value": 509200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687825727, "uuid": "7d2d157a-e439-4cc2-8179-b3398048ef18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687825727, "uuid": "156dbca3-90c7-4c40-a08d-fec47d6226b9", "value": "SecuriteInfo.com.Variant.Cerbu.183612.19220.22038", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bbd0c52-152c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687899075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687899075, "uuid": "e1939d34-7a93-4d6b-9223-7b50694c01c7", "comment": "Malware payload", "value": "e6eb5608e7571e4c3e5246cf1710a219", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687899075, "uuid": "502d5c16-abcb-419b-ab46-1c18b18f843f", "comment": "Malware payload", "value": "c48177607548a8a841b1ed90df3c0c65f0cc160ccec0371db9948589fb2c4f95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687899075, "uuid": "7ff16fb8-ce8d-4f63-bc84-3dab4c27fcca", "comment": "Malware payload", "value": "aa0f2955bad5fec294263f1980fa9d25ab94bbbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687899075, "uuid": "805c5a51-6624-4582-ab80-075879c60b90", "comment": "Malware payload", "value": "a0b07193b65044a22b57b46aa672b8d512f477b5b8e0bc80a13dbb8bd71b352c3ac22142affa899949c5265fb4b39272", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687899075, "uuid": "a2d025f0-c495-4b77-8ea5-2cb9528c64fc", "value": "T156D47B8AEBC1DC6BC41503B04DDB9725273AF498A383DF4B27A495382C6376A7F8564C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687899075, "uuid": "8f4b5a5e-6053-4c21-a40e-8f3770af58c7", "value": "e9ef9b3a65dd6bf58caf965b2eb31e2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687899075, "uuid": "45a59f4f-2026-4a25-82ae-2c936ea806f7", "value": "6144:aQsPjChP/DWxDmFKP9VCUMrex0Ai/k8XFRFj75Gq39OXac:Bs7Rx6FKP9Vyp175j9OXac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687899075, "uuid": "87f0d071-df77-4f98-bb04-d1c54111129e", "value": 605527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687899075, "uuid": "59704bea-73c8-4512-943f-b7b4f600e5fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687899075, "uuid": "d355cff4-92f8-4351-b9cc-947ce58784c8", "value": "c48177607548a8a841b1ed90df3c0c65f0cc160ccec0371db9948589fb2c4f95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "335f5579-14b6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1687848327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848327, "uuid": "31521f34-c611-45a5-bc97-70b95b5070f5", "comment": "Malware payload (GuLoader)", "value": "0b44cb7992c7a98d26399f48ffa997d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848327, "uuid": "5100df0c-056f-443c-9517-37fc8dd1faf8", "comment": "Malware payload (GuLoader)", "value": "c4c5995d02155064515c33697c3b1acb8e822a4220a17da4079e5570e6a740e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848327, "uuid": "395ad0f0-a30d-478a-96e8-cd2d7bd7a4e5", "comment": "Malware payload (GuLoader)", "value": "eb2f7abdbaa4db16c0b618a2417220b1637b8c54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848327, "uuid": "952ce2ef-c520-4357-a85d-5aa36e3fc117", "comment": "Malware payload (GuLoader)", "value": "bb3745eb76ae3a6398db7209062e4453b5a25fd6db874a32a349ac07f20d08bdbe599d398cc9d81a08a83024d626f66b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848327, "uuid": "02948795-36e9-4f81-a897-ad6bae06ea0a", "value": "T11CF423ECA65288BBCE551A356E7319B517CFE03782B6750B3B1897AB770BCD5480C4C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848327, "uuid": "634f0cf6-cd2c-4f27-aa89-505300007d8b", "value": "ea4e67a31ace1a72683a99b80cf37830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848327, "uuid": "54261cb9-cbd8-44b7-a03a-5317985f28b4", "value": "12288:nEciykRRS1rgpeMP6y8ZGPIsoMjwV3AOxWD7KFpOPlQZ4CeHqA/vVOgorqOdSDhn:EciHOCeMP+OIxMEV3n8D7spOPm4C2/dL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687848327, "uuid": "b8a77583-02e3-43c9-bbf5-f20f362e8240", "value": 764337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687848327, "uuid": "a2e0ab21-23ec-4ebb-b7ed-84dcbcdf6366", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848327, "uuid": "52cb9136-6c36-4642-8de4-938e4428a66a", "value": "E-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc9e5d2f-1506-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687882917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687882917, "uuid": "c7daafb8-0922-4dac-bb64-ecc2f52030a9", "comment": "Malware payload", "value": "9a3837f56b6883b8e5f32f37ca32f312", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687882917, "uuid": "bdef22f9-6184-439a-9a63-2cb4730db6cc", "comment": "Malware payload", "value": "c6eff3d235c6b6674c16168b1752d95939b1322953ccc409b74eef6fbf3c1820", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687882917, "uuid": "dba05a3f-8123-44e0-81be-d7640bcc162b", "comment": "Malware payload", "value": "9e819007e26e7743043640291153f11bab10ab8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687882917, "uuid": "2f083d70-ff2e-4229-9f1e-7c9c9204ab0a", "comment": "Malware payload", "value": "0b3960e239c340180f22a59107b1d6db29cd22476c38b945f4739fa3bced2d8d0bd261c7bd38d73e39c3cb7c375a0cbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687882917, "uuid": "4d3bd98b-6aeb-48af-987a-191304cb32ed", "value": "T1F566338BB3F10AE4D527807CD5829889E676343707F9E78703B951AA1F53892687FF12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687882917, "uuid": "38abf6b2-a4b3-483b-84a6-be1abed0adca", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687882917, "uuid": "dfabc2d3-a736-4c27-ab7a-664b26269d4e", "value": "98304:3wzTX4Pf1N2zIh3ET9Y9MxVMOPUh3PdWPEUrJY6AOxbHPS2zh/hQqfvsJ1YPwIu/:3OX4FMIZETKwjPePdrQJ/BNOqAYPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687882917, "uuid": "b9ce54dc-5bbb-400b-b98b-92067c3c6e75", "value": 6931039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687882917, "uuid": "b279f711-63f7-4b4b-b137-7b3f72f1a733", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687882917, "uuid": "b6e53256-c63f-41d3-adea-255451b6fe81", "value": "DiscordNitro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f63bddab-1519-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687891174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687891174, "uuid": "159e69c9-a99c-4300-b07a-3ba1f2f3dc41", "comment": "Malware payload", "value": "ce76ffe3af0866cf7f5fc681c3344af9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687891174, "uuid": "66acbf24-f8a0-472e-81c0-e560a683cf0c", "comment": "Malware payload", "value": "c930f4ea6b9c1181dd0fc55fc992bd7af498446dea5c7d544eed7003ba683102", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687891174, "uuid": "57456ae3-2957-43f2-b581-a2975079baa1", "comment": "Malware payload", "value": "796e677a01c21922a3cb9e6ff3364566c43ed118", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687891174, "uuid": "241e2383-7a88-4904-94f0-2b2d8cf00db6", "comment": "Malware payload", "value": "7897ce2920c35efc7eeab37f99cecb106fdd88f3a9dd3b09d4b764356120605caaf9e113af3b105325472df14fa94698", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687891174, "uuid": "d694db2b-6d19-4cee-8108-d5a72e813482", "value": "T1E6F533F94D487CF7CD860136FAFE4912C44C29AC829109D8852D589678EB6F87C9B3F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687891174, "uuid": "68a3d0aa-b336-44c4-ad55-452938f93f58", "value": "49152:wWEKQJxkNwvojiQkuw3Up22bau1VZODCC7nY3FPzadzZFAWwDZKTh:wWIJmOvo+s5IAauPZTC7Y1L6zMmTh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687891174, "uuid": "82a139a5-1842-4368-ac1b-fa288a8f526d", "value": 3406023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687891174, "uuid": "b52aaaf5-4d58-4cab-9a41-8486f5638b03", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687891174, "uuid": "f31b946f-4d7f-4add-b68a-d2105c51731f", "value": "Archivo-PDF.704654vyint.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4789ac8-1533-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687902311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687902311, "uuid": "caf729b3-6cfc-49e2-ba2a-0b0e14f8c0bb", "comment": "Malware payload (RedLineStealer)", "value": "11df871909c85e2c2d6ab13b86937749", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687902311, "uuid": "a8301b7b-20b1-4ce6-a679-f60c7f0ad81d", "comment": "Malware payload (RedLineStealer)", "value": "c93de4b5c5e1c242456a82be1287bafe7d6b8463e7e36a06add1d9b79134c3b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687902311, "uuid": "af58ee37-f51c-4b2e-bee2-388fb0222a5b", "comment": "Malware payload (RedLineStealer)", "value": "f5dd29398f01468a66993b430999715ccb54489e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687902311, "uuid": "8dfc1b80-23eb-4487-a3e2-0bd313688dd0", "comment": "Malware payload (RedLineStealer)", "value": "c510fd2b5e388e3f9b612803e9b98f778a170e9882c51b173085b8e4cad583e0fbf3522d159b758f6598aab34ab3e140", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687902311, "uuid": "339f94ea-8274-4d9c-8251-fb53f5ebdbc7", "value": "T13F05BF017EC8DD12D1760031DA645A4ED724961313A39E5B7BEDB32B0FB2B82AE1365F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687902311, "uuid": "e949c7a3-1646-4b99-a8be-7cdf9234b271", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687902311, "uuid": "6d32306d-4db2-44d3-b738-8fc841aac5e7", "value": "24576:Kb73jm6LiRN/LiJy1F6eQ+bVMBLHgZpJkB:KCi0/Li81F6eQ+bVALHkJkB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687902311, "uuid": "f22f1345-be86-4b04-8bf1-02683f483049", "value": 838304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687902311, "uuid": "0d34eb53-b734-4fcc-93dd-350dd69fab3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687902311, "uuid": "534dd244-3a65-41af-80f2-97152b77d2a8", "value": "11df871909c85e2c2d6ab13b86937749.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e382ed96-14e3-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687867950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687867950, "uuid": "f0095226-ef23-4d21-b0be-6eeee2e6bdb2", "comment": "Malware payload", "value": "35d055836f88c2ab13dcf48ee51b95d1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687867950, "uuid": "aa169561-45d3-4a4d-8bda-724bf813ec34", "comment": "Malware payload", "value": "cd0181ffe1205cda370b318244296507f4d14aa598a5707039b6f3a3ab8c659a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687867950, "uuid": "a51062e9-9412-4c0e-b946-7a9956dacc73", "comment": "Malware payload", "value": "c29bb2d2036ba2126286fee4f6632e208f99700c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687867950, "uuid": "88e826b0-841b-4b49-b52d-b1fcb329ae41", "comment": "Malware payload", "value": "f02b68232b4303c6b81903fb1ee06a2b1b8618abacdcb3ed16ced37f084eae4eef277eb5bbef53f52bedfc71b28d30a9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687867950, "uuid": "5a7e2748-241e-4a47-905f-2832cc08b8ea", "value": "T112D47B8AEBC1DC6BC41503B04DDB9725273AF498A383DF4B27A495382C6376A7F8564C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687867950, "uuid": "2ed97e3b-d0df-4a2f-b418-6f1761aa9501", "value": "e9ef9b3a65dd6bf58caf965b2eb31e2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687867950, "uuid": "35893402-0617-46bc-ba05-37a5a518f880", "value": "6144:aQsPjChP/DWxDmFKP9VCUMrex0Ai/k8XFRFj75G739OXaU:Bs7Rx6FKP9Vyp17529OXaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687867950, "uuid": "4637c594-c79c-4788-b442-8a64a9bee933", "value": 605519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687867950, "uuid": "3407d360-5e32-480b-8904-31d34a0b6c01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687867950, "uuid": "6c4e2848-8265-4927-8e8f-6c5e9948b784", "value": "04993758883.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef031f22-14e4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687868399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687868399, "uuid": "5e620e0e-45a2-4bc4-8397-5870e1220add", "comment": "Malware payload (AgentTesla)", "value": "abdaa0010572ab5f9d00aef0ae1cd992", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687868399, "uuid": "a2250f96-1cf4-46f3-8677-a238b429ed03", "comment": "Malware payload (AgentTesla)", "value": "cd1e64756a988d66cfeb50852a5449f30c77a731fe4379549d2259454be34ac7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687868399, "uuid": "beab9464-d6ce-40d7-9605-893acca696e3", "comment": "Malware payload (AgentTesla)", "value": "1cd89901eba3bc3dfe6e5f487439298cd9cb10fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687868399, "uuid": "6d06461c-7744-4750-8b2b-4d48643468e3", "comment": "Malware payload (AgentTesla)", "value": "67d6c75e0ff992d7fa64aa156101478e3e966ac07b5b5d5b531a8ddf5d9521edd48d309ef26e1e63d22648a4a7294dc8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687868399, "uuid": "5099c70f-8fc0-443b-b70a-c5e5b5305c7d", "value": "T1D8B423063E282F67DEFCC8FC905162560BB46216B420F3DD4C56A1DA95F7FC0858A6EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687868399, "uuid": "cb9af516-671d-4739-a6c1-6c61d6382458", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687868399, "uuid": "a669b521-e27e-4e73-b724-857786cf0f1b", "value": "12288:SrbxlpvQsqCwGqOEVO14oVD4tRIJZNLDZclsqnZjiLK/XqVGNQf:wJQ7CwG1EviEeFLmbZjgKKGNe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687868399, "uuid": "4c469d79-2058-4423-94ae-75ce1c88b46d", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687868399, "uuid": "6bdb1176-cb2e-4b3a-ae40-a956734a6e42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687868399, "uuid": "cd8f85af-943a-4106-bf7b-30dc1734f6ec", "value": "Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd9e071-14bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687850703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850703, "uuid": "ef055051-806e-42af-85d6-aa654914b3c7", "comment": "Malware payload (GCleaner)", "value": "d794a900d67c12d1983fa15fd327037b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850703, "uuid": "3e2507c8-a503-4d13-b1da-03ffb889ad93", "comment": "Malware payload (GCleaner)", "value": "cd621988496f0c54d5e56cc9d0f1fd944c82dcab5eb66b294e456b85a962aaad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850703, "uuid": "a26554af-70ef-48f8-a0bf-08014801ff42", "comment": "Malware payload (GCleaner)", "value": "e3a277a85b617244f997d69dd17ba2d7d7d36a0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850703, "uuid": "a8f842c1-8e21-4b27-9419-18f99e3b6ea4", "comment": "Malware payload (GCleaner)", "value": "7d622280b363eff50f93c1864f277a0ddc336b2036fcc6a6b37af7ae3b271aa0e159ae790398d7e9bb2951292108d141", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850703, "uuid": "450ef1bd-f0d9-4f41-95a4-fcbe05bec2b7", "value": "T1E774BF13A6F17C74E52547328E2EC6E43A5FFA608E5D3B66221C6AAF09B11F2C573350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850703, "uuid": "79c94127-8eb9-4d28-a099-30d53b4ae77d", "value": "6697fa255a05fffbb8331cc121287cb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850703, "uuid": "dedcd9cd-6fb0-4304-adc0-003f2713783b", "value": "6144:2ibs9uHWBe3bHotiQHDsurnQRfmMS18zN3t1v/:2L9jBe3DotA8nQgMS6zZt1v/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687850703, "uuid": "74e6e7ff-721d-424a-bd12-8d2406abd911", "value": 350720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687850703, "uuid": "c2550790-45ab-4423-a3d4-eefaeec93f0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850703, "uuid": "d775249e-fdab-4d2b-a036-8f16d4034955", "value": "d794a900d67c12d1983fa15fd327037b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2536b2d9-1514-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1687888676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687888676, "uuid": "d397f3d6-4c12-4b73-929c-dfb1435045e0", "comment": "Malware payload (SnakeKeylogger)", "value": "577517acf0bd0fb6900d4b918312db37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687888676, "uuid": "91476b96-bfe5-45cb-9a7d-66f8dd9050d1", "comment": "Malware payload (SnakeKeylogger)", "value": "cf358405f63e05e76d34cc5c20f120d2a9a142ee9e82379e5ce869ffa4ab2428", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687888676, "uuid": "3bbe7ab7-8abb-47fc-b544-bd32238efd1d", "comment": "Malware payload (SnakeKeylogger)", "value": "7bcd977a33cf869e7684371bad7467b5cc3be98a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687888676, "uuid": "d19a33b4-9fca-484d-8be3-bd1e0683c46a", "comment": "Malware payload (SnakeKeylogger)", "value": "44314fd2fd69756b8ba066c180fef0eef9a66a260b758314bd9df265b88c2c5caddae9d9208458c49ba281c0a79479f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687888676, "uuid": "cadfe898-1145-447b-82f2-4e75647492b2", "value": "T178333A1372A84BB7CEDE03BDA92245401BB6B77B5306E21D0ECF7CDB28A57705606693", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687888676, "uuid": "228b6f10-f16e-4158-a455-c71126059d4c", "value": "768:1wuKbMfPzVtaT1NH2g6MX3d6h9OIZd0zrh0whZ+Pwn45EB0BN:17PzC16Wd6hUoUWwhsw452GN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687888676, "uuid": "0f0b7ec7-9d23-427c-bd29-0bf43df62f1b", "value": 51200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687888676, "uuid": "d5fd6f5b-2078-4f66-b291-82b9b4c6f8e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687888676, "uuid": "70363aec-6f33-4a9d-ac2e-e77865ff0795", "value": "payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8622b1-1509-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687884207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687884207, "uuid": "3fe422d3-bdbb-4d90-a50c-4011b8dc46c4", "comment": "Malware payload", "value": "12cca745448444aeef46aff938029fa4", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687884207, "uuid": "8e5e83b8-0dec-4a37-b698-d21584192d43", "comment": "Malware payload", "value": "cfb193575a675558b2153cac33ac2b06543bdc94116d34880507b45f8ba26457", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687884207, "uuid": "c34f0314-1994-4b5b-b79a-4eb180255714", "comment": "Malware payload", "value": "bcfe8da048cfaf8ba8e7c66e9632082cd1ada246", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687884207, "uuid": "28222198-c12d-4206-b96c-3aded107f8eb", "comment": "Malware payload", "value": "ee11d52638bbfe95d8cf9b1efad96cb8687c5e6a26d1954a37eae0c514cd7a5116ff7724ff2aca9c1c083fb35184d79f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687884207, "uuid": "849b4acd-9ca5-44e8-a9b5-b7a9079235d3", "value": "T13A646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687884207, "uuid": "096e1337-4822-4f6c-8e43-41e62c935cad", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687884207, "uuid": "f52b73ac-1d70-460e-b119-43c040f6800d", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9mF:5xb8ZqekwkJPaThgyDChXohRRw0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687884207, "uuid": "ea152627-8030-4fe9-906a-0054a5cce38e", "value": 320529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687884207, "uuid": "e858c612-91af-454f-b84d-3222cc34b4e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687884207, "uuid": "9731215c-2907-47c9-afd0-93be855bcd6c", "value": "12cca745448444aeef46aff938029fa4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "341bb766-14bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687850476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850476, "uuid": "2d540354-31e6-4adf-9ef1-ad542c10eddd", "comment": "Malware payload", "value": "9873d7a24b69e63fee428d9fe75b9a32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850476, "uuid": "bc3a7f08-dd89-4939-a847-d8ad83038bbc", "comment": "Malware payload", "value": "cfc0211f77f88db3550e7c5816a6b61ce5efe626deb9c344bcaffce695c82e38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850476, "uuid": "a4e36aa7-d302-4aa3-b470-0646483e2c05", "comment": "Malware payload", "value": "798935318e9c3d1ebdd19b2ed9b247a671ff37e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850476, "uuid": "304f9daf-a6d8-4cef-99e0-45304f5bce8e", "comment": "Malware payload", "value": "aaefcd6ecd91d1ea4ee57ca2eb04e90a5dbfda63a26294b978dbcc3e26db174456b9b90b238902c0f0557cc8be633129", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850476, "uuid": "9081d0af-579f-45d6-8a69-a1c09fbe6556", "value": "T15803921FAD8A64FCF865C23A41163132A4A0F83157B56AFB03E6A7200851FDC75FE85B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850476, "uuid": "e2664c01-eef6-49f2-b298-3094ef928fb3", "value": "4c84c8ba374cef8f76250c04631b14fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850476, "uuid": "dac9c4b0-d829-4c16-9d7c-dbfdc749b77c", "value": "768:HyTSTZYHw/zmdFAVwVeV6Zln00EqWoCWXgs7a4E5R6XFKnID4CS:HGSBuQwF2zyFDS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687850476, "uuid": "4273e572-7eff-4e7b-a944-ac47318138e2", "value": 39424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687850476, "uuid": "4dbfc9c9-d22b-4be3-94cb-6bdbf18cf77b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850476, "uuid": "882fb8ee-a4f0-4c93-8b88-a6216e0e6356", "value": "9873d7a24b69e63fee428d9fe75b9a32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d26c490f-14d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1687862338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862338, "uuid": "6054d4ee-d7aa-4918-a60c-612c117a9f4f", "comment": "Malware payload (AsyncRAT)", "value": "7f01f3211ad2ccd0713f6033a78e991f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862338, "uuid": "f4876f53-8176-449b-9c08-7c0c2384c197", "comment": "Malware payload (AsyncRAT)", "value": "d180e20ca8775318dd5236e00e6216dcb05ecf8d8125c07627727f7d2532d5b9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862338, "uuid": "5da226a6-9805-4898-8e8c-55d2e0178518", "comment": "Malware payload (AsyncRAT)", "value": "948bb173bf337fe297e238beec81b1c6fdda31ca", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862338, "uuid": "9ade96f2-5593-455d-b626-a952a0bebdfd", "comment": "Malware payload (AsyncRAT)", "value": "d8a6fc25be1d0f99af8a85a81ca3167bdd28f3de4f1b946f6ea470e2bfbe429f7d764083adc88ecfbada4467c7815e45", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862338, "uuid": "551beb85-fb5d-40cc-aa61-a2e4edead7ea", "value": "T13005F89DADE86DD7E066F6B08C31F5950429EF5845285E093C6AF0E7253229338FAC1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862338, "uuid": "b6209b15-3cdc-453a-8b96-99ca408ae83d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862338, "uuid": "ecb93178-af39-4dae-a72c-e9a0b96716c0", "value": "12288:jopktjVABGBiYufySwdftVtWRGs3H5KnjxEG:UlYiYuaPzVtWgsC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687862338, "uuid": "2b19804b-8388-407c-af89-997e2a16e8db", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687862338, "uuid": "9ccaa8e3-4afc-4e22-b370-5afa7ec6a96f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862338, "uuid": "c88593a9-ad12-481a-83f9-454304204a07", "value": "7f01f3211ad2ccd0713f6033a78e991f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "972b2091-14e1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (IcedID)", "timestamp": 1687866963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687866963, "uuid": "4d9e8e77-b652-457e-8509-20d744e3a898", "comment": "Malware payload (IcedID)", "value": "5f4cb4b0da656a03c155c8f66c431826", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687866963, "uuid": "a1651e29-edc3-4af0-8a6c-bb9f381ece72", "comment": "Malware payload (IcedID)", "value": "d4a69a6a68e105c1757fc667b0a67fa46628dec97f29af4649a958feb1f37b23", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687866963, "uuid": "2f115f24-5295-447d-8f85-68bfb1937b37", "comment": "Malware payload (IcedID)", "value": "af9559af3950c6d05282701e9775e90fa1c9e6c9", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687866963, "uuid": "625a8b6c-449d-4214-b7d9-d73d2bf7ddab", "comment": "Malware payload (IcedID)", "value": "026ea34248559d36a582488f747c7e090b762f0e9ced79190907f90388aac21761284947e88e93487975ab1f7f4aaf86", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687866963, "uuid": "4b68dc18-4575-4c14-8aa6-8e616fda2d7a", "value": "T167F4AAC223EBBD4304575372335426F6D93ACA65C9E994DCF6453D98F0ECE02BA982C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687866963, "uuid": "2a3abf04-93e4-4cc1-87cd-d06fe142d8bf", "value": "12288:DBeYy4Q74mVTDSpiD0CFSjhGpnXo8SYC7okiiJzjx7KzpCGdGEx1aqNoAOo9itwT:VeYnQEmVTDSpiD0CFSjhonXo8SYC78iO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687866963, "uuid": "f87c2c35-9058-4cfb-9c2e-6e8bed6339be", "value": 770573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687866963, "uuid": "414c753d-5925-44e5-8d05-8e7e80808631", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687866963, "uuid": "e27444aa-e7f1-427d-884e-afc322eac4eb", "value": "Scan_06_23_Payment(123).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9f4e7f9-14bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687850700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850700, "uuid": "55d8ce04-6456-4659-b53e-3e3cb7e93b96", "comment": "Malware payload", "value": "cef16323bb12be6f5e3f7858951c7fa4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850700, "uuid": "61a39ba7-edef-4c9a-8fcf-28cff8b50a2a", "comment": "Malware payload", "value": "d59997a8f0e1f108c43c3370041fa149402c460e27049c0e3b5c6781eb8f2b76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850700, "uuid": "fac00f80-4c53-41b6-8a89-ca9ffc52fe74", "comment": "Malware payload", "value": "f2b41fd9b71eb87c580c497b2c194815fadda6d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850700, "uuid": "1de9fa95-0ca8-46d8-bcc5-ddea926ba040", "comment": "Malware payload", "value": "419c2698806011d04430826b26f06b1e523704ad6d35c84077467193241857a27c091783124f3224f54e38305f8fd261", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850700, "uuid": "f562b904-e5e8-47b4-b6b9-bef76c8ebcf4", "value": "T169163312B7A284B6F1D3CDB05586D3E0242F7173A66540CB29558BCEBA34BE1A30F75B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850700, "uuid": "4092ad69-737e-4b80-a1cb-f151b26aba00", "value": "4445a9c40cd57bf375b0390e0363e60a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850700, "uuid": "841ccb1d-e106-477c-8ea1-f6d5547f4570", "value": "98304:2RRu7JlHIqCfORsvc+0by6a+tN8vWZ2P1VDRDL5tTNz7:2RQtlo9WJCqN8vgI11z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687850700, "uuid": "2a54d5f4-f272-4b92-966d-41f7a970032b", "value": 4282327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687850700, "uuid": "0ba324a1-1436-4679-a720-f0d826a0971d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850700, "uuid": "7ff9e5a7-efd2-466f-92c7-1b96f40fcf72", "value": "cef16323bb12be6f5e3f7858951c7fa4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e99fe78f-14c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687854216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687854216, "uuid": "12ffc8fa-81d6-48f6-9e48-ad58978bec5e", "comment": "Malware payload (AgentTesla)", "value": "f8df246da55e0c7e43658645a414c8fc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687854216, "uuid": "6c010ebe-dc63-4b3a-bfbe-a9830468e24a", "comment": "Malware payload (AgentTesla)", "value": "d5fae44ea8cf440ce935e20ce06cba23c3d9e203ed2fec1f66e48dfa0512b767", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687854216, "uuid": "b148faec-8f42-4131-9d0d-07e28e9ab60d", "comment": "Malware payload (AgentTesla)", "value": "6088d71a17cf1c6ab662f573facc91fd4862b587", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687854216, "uuid": "1a46f025-7fdd-4d71-8b06-86d08e43c4d2", "comment": "Malware payload (AgentTesla)", "value": "7fa759389f9b053d2f3d2620da856425e5f1e34d9a7c18761b3783bc6ad9f9c6268b911a8f641d31d8545a68d4255b46", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687854216, "uuid": "7466d37e-8bed-49a6-9941-8b656384b36f", "value": "T156B42376FF7EF2688D3A1EE5ED4747DB87E606032C5541CBA09586DA34828DB83BE044", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687854216, "uuid": "6e492041-e441-4945-abfc-4c2b7a775ba8", "value": "12288:eB8LjCz2yT9QOzGsw++chJAV7VFVv+gfc3CZtl+fU1ZZ7IE7kY:E8/byRLNw+LhJAV7BvLc3C+s1Zzl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687854216, "uuid": "ab9a19e7-93af-4768-afba-d23f7d2144cb", "value": 532258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687854216, "uuid": "1d2c8090-ce99-4c22-96e0-617395d1b1bd", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687854216, "uuid": "f122ae0f-9074-4d01-9094-1a60aa50c1eb", "value": "soa.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb1696ec-14ba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687850380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850380, "uuid": "6106e483-40fe-40ee-9f6f-6671365a3e7a", "comment": "Malware payload (GCleaner)", "value": "fa399d8d86aa365e3e3f774d82a1e179", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850380, "uuid": "b4da7d7e-5084-4dcd-8af5-9f30c6562d42", "comment": "Malware payload (GCleaner)", "value": "d630316432923a51c222ce0c0b35758d559105b0bab95989d0b4c68be61be7c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850380, "uuid": "5d84f353-8310-4cf3-a964-e24fc21c47cc", "comment": "Malware payload (GCleaner)", "value": "7f36f4bc33619417102feda3a272800b151bc7b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850380, "uuid": "6f68ae03-6938-40ea-b241-ec5245504a41", "comment": "Malware payload (GCleaner)", "value": "eaabeae40656b93635175abd87776f1b99af07ce4049305b74d3022842284d5d317fb1dd7833244205d64babcd433626", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850380, "uuid": "5fa26e8e-b189-48cc-abc2-b479a7eb7142", "value": "T10E64AF5352D03C90FD255A728E2FCAF83F9EB2204E597B6662689A1BC9710F2F133741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850380, "uuid": "a629f008-e81f-4e4a-b912-d85bc41f4dcc", "value": "beb5a90def3136cd5678402095e4e39c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850380, "uuid": "1d45abb3-4db7-4984-8f52-61a9f6d833b8", "value": "3072:De08rCVX2hTu2eQ6zxZzSYvstBNHF9qGm8L9eW6j9H3Ev12M1DT8b7+g7RcDvT/r:N8GVX2ldt6jzSHtPP0uwh0n1DkYD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687850380, "uuid": "f6cdf58f-313d-4a69-9cac-5ae67f84b05a", "value": 312832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687850380, "uuid": "5ecd8b0b-7d03-442e-9706-a104777280fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850380, "uuid": "625f3fea-f5df-41fc-b0a4-aa0a57709322", "value": "fa399d8d86aa365e3e3f774d82a1e179.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ad73a6c-150d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687885732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687885732, "uuid": "763ab9b4-488b-41e3-a6c7-6a64f99310ff", "comment": "Malware payload (AgentTesla)", "value": "68cf198a297fa53b7c16db727e467873", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687885732, "uuid": "b2de267e-dcb0-418a-8482-cb6437321dc2", "comment": "Malware payload (AgentTesla)", "value": "d699b78d72ce231d7135f8cdfaacc074fda40d644cb7c0f089987cd502bea3f0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687885732, "uuid": "95aca2e3-abf4-4220-841e-9021b8338037", "comment": "Malware payload (AgentTesla)", "value": "a53c526b2bfc70e6097a93397a53a6769a924749", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687885732, "uuid": "64d26c6f-56e5-48e2-9bb7-1e4e4688dc0e", "comment": "Malware payload (AgentTesla)", "value": "8b18cb202cde316266d4e28e3ab7f1186747ddb795ea4bf2b29d6825e145f61a4d1bbcd6a3029934bf06cbf6c966ae46", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687885732, "uuid": "5d85cdeb-e6b2-4a59-b80b-cdf886fb2531", "value": "T162E47A3D19BD2A37C074D6BA8FE5C463F554D43B3922A93268D787A44746EA321C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687885732, "uuid": "d2efb82d-01a4-43d0-a4f6-7a22026e5c9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687885732, "uuid": "69ee9dd1-c389-4359-9f34-209e5be175df", "value": "12288:2RAs+k9Rbv4FHbal+SgVaTj3iQuIaXFtvU2Tog:bs+uCk+STXerFUg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687885732, "uuid": "760ee315-575a-4301-bb81-6bb196f96439", "value": 668672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687885732, "uuid": "053d053c-cfb9-4129-9deb-f60f25a262c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687885732, "uuid": "6c466962-bf4e-48c2-855c-c017669294d7", "value": "COTIZACI\u00d3N-00468.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "816c22ec-14c0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687852753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687852753, "uuid": "9c48a806-2e79-45c0-abfc-219f37d2b2ed", "comment": "Malware payload (RedLineStealer)", "value": "58c867b6280648039f05f3702e565474", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687852753, "uuid": "816f12ba-f51b-4132-9b38-f343c6adb124", "comment": "Malware payload (RedLineStealer)", "value": "d6b5e39bcbf51127c1f73ca3b28d4d3d2520614bf7ccfad2383132826010c435", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687852753, "uuid": "fc676787-2528-4564-bcd4-08868f065c3c", "comment": "Malware payload (RedLineStealer)", "value": "94bf81624faa3539c4b04ec64b2f0b0ac9f0084b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687852753, "uuid": "afd9b328-5ca9-4d20-81f4-8042e8fee0d6", "comment": "Malware payload (RedLineStealer)", "value": "fffbb0890e9d1b9d0cb09e6b7c3eca11ec0e4df20fa9477225538dad8264198812495562d4046e99fa3797c3b140492c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687852753, "uuid": "eb776bfe-0714-40e9-a88f-dcf0573e3771", "value": "T1C7946C107843B07ED0528032865655687DE86D94B7E4AEFB23D4DBBF4BA1DF2EB30294", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687852753, "uuid": "7e314e85-fb43-4c63-8d53-503bccb8af28", "value": "9af3e93e35221a2c8c04a3cc05e589b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687852753, "uuid": "096e465d-c397-49d8-9d70-05749f9ed905", "value": "6144:SQeFkAE/kiQY4A69E8gpthuEt0M2ywAO+imU9h3uT+t70eKAgw:ShFkP/XQDA69EJtWYIh3uT+t70eKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687852753, "uuid": "602116eb-b354-4451-853f-df5117247a8e", "value": 412160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687852753, "uuid": "fefbe354-630c-44ae-b4af-1913583acfb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687852753, "uuid": "ae83c7aa-5370-41fc-891d-fa033af9399c", "value": "58c867b6280648039f05f3702e565474", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e339d4e-14e5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687868666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687868666, "uuid": "dccda784-a133-44af-b0a5-d28179d551ee", "comment": "Malware payload (Formbook)", "value": "e13a293f2ff28ed93bc0cd61757ce5f3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687868666, "uuid": "a4bd3729-7f45-40e8-b679-43536cf75545", "comment": "Malware payload (Formbook)", "value": "d7d071ad05ee690b5a3fa9a70496571a501c0a844e64051cc75398ead0d26abf", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687868666, "uuid": "65b33756-578d-47d4-87f2-b7af9b6489a9", "comment": "Malware payload (Formbook)", "value": "fc5c47da58b5b1541895858b60d09ca754fbe125", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687868666, "uuid": "a70c83b8-4681-42df-83f4-13aa83644f31", "comment": "Malware payload (Formbook)", "value": "bb4486689b26d9d4b6b8a040451c672dfba4b0fdc543b9be0461c32a15ee49dcec77ec96b26ea5a7fb8c6c2c59fe4d86", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687868666, "uuid": "9c05c6b4-db29-4b2c-a9b3-9b6d22acacd6", "value": "T1C2B4235D6EDC21BE90BE0AB18ED0219F2717FB2DC2E07CEC5AD869821F4575E8783106", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687868666, "uuid": "f3899232-c362-41cf-86bb-d01434299214", "value": "12288:fQ+4/qvX2QdxDyiMxG3D+UDaFR75vaRgdozrc:fD4ivPGiMQ3JaFR1vaUkc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687868666, "uuid": "da5718a5-c55c-4300-81d9-46ffc6878a6e", "value": 541206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687868666, "uuid": "51969838-0683-4a74-8fa7-7eafad08fc3e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687868666, "uuid": "7482b69b-40ba-44b1-9041-8e25408e8668", "value": "Bank Details.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "662eed8b-14bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687850560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850560, "uuid": "1b9bdfa8-dad8-4ec4-b081-fd79c68c4e34", "comment": "Malware payload (RedLineStealer)", "value": "cd584f4ac3012b10f152d703f15c4060", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850560, "uuid": "68d59379-9a79-477d-84ce-1ba2242da002", "comment": "Malware payload (RedLineStealer)", "value": "d9d9c314c029b02087cd28124df3253c533532f122b3ede2f0a1d1a9a267425e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850560, "uuid": "24aeaa08-a7bb-4cfe-b296-d4a7a55fd8f0", "comment": "Malware payload (RedLineStealer)", "value": "c5a0d0d0324544f7483432f582b21b3ef7052069", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850560, "uuid": "60863187-3214-4f15-ac9c-8be390231142", "comment": "Malware payload (RedLineStealer)", "value": "6e1647fd41f20e483821118100309abd32517a5e7d278bb5012fa5dfb5fe968be1e3a0f488f85822bd23c9c027951be7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850560, "uuid": "de5fad6e-3b1e-4d45-a1b7-9d4a1020a64a", "value": "T116B402323540B335DD99747296EBC626CCFAF8320F77C0A3EB4C9275176028796AE265", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850560, "uuid": "4cef5204-b431-4404-aade-60ccb4607773", "value": "a3a98f4b8bad628ffa25a9afc0275971", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850560, "uuid": "be5dc771-3bc1-40e7-b6f6-0cd83572dcfa", "value": "6144:+Xn80q6Zwh24HVvsrlnrd0fqRVRFFqRClSkZ7j0Rp3ssBlKQ+NMMkv/AppF23PKo:w803zrTRVRNlSi74qZkvCs3PKcxhH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687850560, "uuid": "ed59c62d-fc49-468a-b39b-008d76b7cf4a", "value": 519952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687850560, "uuid": "225cb030-bd56-48b0-b320-ae2fa9e4d08b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850560, "uuid": "74e3a780-06f3-4706-a6e1-a26a63e01311", "value": "cd584f4ac3012b10f152d703f15c4060.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "193f6eee-14d4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1687861168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687861168, "uuid": "b0efcd7a-fef9-47af-b8bb-9df6189d62e9", "comment": "Malware payload (Amadey)", "value": "fe318e5a5ae6de46bde1133f50995d94", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687861168, "uuid": "2dea14fa-4d2e-4058-ac00-7a8bac7de68b", "comment": "Malware payload (Amadey)", "value": "dc8937522d65ff038246923019eadc4851da4ac755c5e130f888dbb321adb1e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687861168, "uuid": "f19f2c13-6fe2-4807-8265-60b0143b64ee", "comment": "Malware payload (Amadey)", "value": "36444fdd6d6356d8410de850f50205390d217afb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687861168, "uuid": "e8725feb-baeb-41f2-8396-f1f55cc924bd", "comment": "Malware payload (Amadey)", "value": "799ea4e9cd741005051636e7e2d70ffeaf27a9c8b1030a8b260410e2e4d4de35adbc87b36aef2ba1fa460c99c282ae96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687861168, "uuid": "c2bc4756-e748-42e2-9911-59cd5754f1eb", "value": "T15BE412223D40B37ADC48B47295E3C11ACDEEF5321FD3D1A3FB4992760B61283AD5A256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687861168, "uuid": "0f8673b7-fd1e-43ea-b316-76485ab477bf", "value": "a3a98f4b8bad628ffa25a9afc0275971", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687861168, "uuid": "da8b661b-8ac1-4e76-bd9f-ee78bfd10019", "value": "12288:bih03zf/x5OyE35/h7m6IYVfgMe8aEAIYjh27ED4gl0V6wJgSOSdTsfbTlkvPJMm:+h0LnEJJ7n3Vfg78bgsU4ywJg1aojTm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687861168, "uuid": "064b65d2-b5c1-48d1-8648-ff559b331c12", "value": 690448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687861168, "uuid": "54538732-05b9-4600-8cc1-d70645873656", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687861168, "uuid": "92c8bc26-90b1-440e-8cc6-9f441db27bbd", "value": "fe318e5a5ae6de46bde1133f50995d94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0291c1d1-14d0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1687859412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687859412, "uuid": "6e66d279-c2ac-4a7f-9cb8-e69368def6f6", "comment": "Malware payload (Stealc)", "value": "b39e78e8dc2c983b3587fffcfd242f05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687859412, "uuid": "cecec851-53e7-4789-a87d-c99c1b2d6bd2", "comment": "Malware payload (Stealc)", "value": "dccdb6e16d2f01e46e021c8887b7353a841d7fce133ec2cb37a5781230ade52e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687859412, "uuid": "242d8e17-12d9-4331-9550-8356a5ce9c87", "comment": "Malware payload (Stealc)", "value": "4648b28f5a8596687e6ad8f20e4ab7642ffc346c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687859412, "uuid": "d6365c27-db94-44b9-b9ab-dc7c7ab094eb", "comment": "Malware payload (Stealc)", "value": "f3d50bad806111a456f2ad2f7720d6c47b1927e05df71aaa0179e87779aa1d5585de6d932ad614bd8992ce0d39521735", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687859412, "uuid": "c5af4471-315c-4bab-ab5b-2f348fb04755", "value": "T1DC444CC3E6A27C61E526CB729E1EC6EC761EF560CF59776E2138DA1F04B00B2D163621", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687859412, "uuid": "573b75ca-2d40-46d9-bed7-7cd3810a1162", "value": "b007a513e8535ccdc15870a09f4ce9bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687859412, "uuid": "612d88d7-0769-47ac-8943-189f52205c5c", "value": "6144:yU2rW27We/4m0cy2MN3hLcjC9mUWpzTIW:KWul/kX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687859412, "uuid": "b2879a10-f7a5-4732-a523-71510c1c1c96", "value": 268800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687859412, "uuid": "49726c09-4e70-486d-845d-e2d2ebb53bfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687859412, "uuid": "cf9e2686-4f26-47fe-b518-cf1f7159270b", "value": "b39e78e8dc2c983b3587fffcfd242f05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f47a3e6-14e3-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687867594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687867594, "uuid": "c05a9fef-7376-4325-b83a-1b62ac65242f", "comment": "Malware payload", "value": "ad60bae464b7de29cdc7cd00cd7cf806", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687867594, "uuid": "d73853dc-471b-452a-85c6-d4bf0cd69299", "comment": "Malware payload", "value": "dcea01bcdf759e26eb5644b31931af24eff447062976e3936827c86c34bd563e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687867594, "uuid": "94ee8c85-f934-4872-9dd0-6114c0b70791", "comment": "Malware payload", "value": "a008afd82797fe3b1acb23232666862c8c2867fa", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687867594, "uuid": "5914514e-4cce-40ac-920a-0fee13c6abaf", "comment": "Malware payload", "value": "5c0dfddeb217336c34feda74448568abfdf74664e68aad459087f9b4998900fe9aec29eaf93acea616e00bff89f3b91f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687867594, "uuid": "251565de-77d7-4d7b-90a8-bede4481fa39", "value": "T146D47B8AEBC1DC6BC41503B04DDB9725273AF498A383DF4B27A495382C6376A7F8564C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687867594, "uuid": "bf0a72e9-d006-4cd5-b9e5-8cb6b8e8285b", "value": "e9ef9b3a65dd6bf58caf965b2eb31e2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687867594, "uuid": "d616db1b-4d82-4e00-ba1f-99bcdfe4f8d0", "value": "6144:aQsPjChP/DWxDmFKP9VCUMrex0Ai/k8XFRFj75GX39OXaP:Bs7Rx6FKP9Vyp175y9OXaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687867594, "uuid": "83b23cb5-04e5-47ac-adc3-9baba678f24a", "value": 605529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687867594, "uuid": "3a5fb024-a553-463a-ba11-ef4c5e9f8339", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687867594, "uuid": "a5866ecc-6892-47e1-aa8f-7623eb2f3366", "value": "04993758883.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7c5786e-14d7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687862776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862776, "uuid": "ae23a6cf-1bef-48a8-b203-2ab7bc3f11a7", "comment": "Malware payload (Formbook)", "value": "2ad15282c425304c70080baea784bb28", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862776, "uuid": "e95e5308-db1b-47b1-ac63-ec45255b8edd", "comment": "Malware payload (Formbook)", "value": "dd078c70a17e8ad87c590947b29bcab4c7961274557dabe6b38e5259cd285e85", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862776, "uuid": "1850bcfd-073d-4fa9-894f-30c2d1a3003e", "comment": "Malware payload (Formbook)", "value": "61a4fdee0abe0402b4ebf2cb3b65c64d63c0f444", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862776, "uuid": "ba1e2d3a-24b8-40c3-b975-76c69645eeb6", "comment": "Malware payload (Formbook)", "value": "136439030e6cfdec96a85076dbfd40b95c4819ce195e601f275ed15425d310fa09a4f7a0a6b058ea8aaa665f5f31aad0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862776, "uuid": "e6009697-5605-4d08-9726-63018a144f93", "value": "T189B423FFB2E4C1FC5D2B6F4492AA89E6B26B755432AE2043433BF5443ACBA06C565D10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862776, "uuid": "11afdd0e-4269-4ffa-b6be-8ba2914d3a0e", "value": "12288:MdStGZooWaoD1pC7A7jql6NLRoodBtdnxSDJm8RoE/rd4KuY:MdSsZoTdD1aA7jqYRdDtdx0p2EDd4KuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687862776, "uuid": "9aecde01-8012-4981-bc86-f646a7eb3802", "value": 528986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687862776, "uuid": "46951a06-8f6d-4480-92e6-d38869a0438a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862776, "uuid": "c96cc066-b68a-4519-a0ed-bb253222a070", "value": "Mirus Packaging GmbH Purchase Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e36f3c33-14b3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687847334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687847334, "uuid": "e1d01d77-7bf8-42b8-aaed-232b7637e4db", "comment": "Malware payload (Formbook)", "value": "2af4d7d7255cb2e719ade02f0c21a41c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687847334, "uuid": "9f4987f7-650d-4d15-a0e6-b30383120c79", "comment": "Malware payload (Formbook)", "value": "dd625949ce3243dc01eaf5d1d270bef6d4f75a66995271553ea53ed8d3ba0a56", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687847334, "uuid": "40f803a2-9870-4d50-9e1b-081018e6c5b3", "comment": "Malware payload (Formbook)", "value": "836f880b9b17ed529d7718b109b3251f5b98fe37", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687847334, "uuid": "6d488c49-545d-490b-a52a-00c9f9e474d9", "comment": "Malware payload (Formbook)", "value": "8aa768b9d17286bc6b6e77dae742ac25e42c1c4fe1399b6b2eb055741e4a85adba955935363ff37292f386959d4ec641", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687847334, "uuid": "382ee0f4-8080-4fc1-b991-199e3f9d7ab5", "value": "T117137F5AE79F02A48F511273531B0E899ABDB63EB35151B178AC837433EDC3D02666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687847334, "uuid": "bc3478c9-ad5a-4933-833f-6aa89a7fe61c", "value": "768:HFx0XaIsnPRIa4fwJMg1HqKGFbLGGVyxZjeMarLsqYIb:Hf0Xvx3EMQEbLfVyxZjeMaXew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687847334, "uuid": "837303f4-96e4-4917-9800-26a8eae3e388", "value": 41743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687847334, "uuid": "1b00e7c9-2af1-4f5a-ab5d-a777042bbf73", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687847334, "uuid": "b93a3c92-21f2-4750-b23f-addfad91fbe1", "value": "2af4d7d7255cb2e719ade02f0c21a41c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e13371b8-14b3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687847330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687847330, "uuid": "5d41f10e-7e32-464d-93d3-4a553700ae4e", "comment": "Malware payload (Formbook)", "value": "8001fc3355e347ebeb82daf3170e884e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687847330, "uuid": "0e6b61b8-ed2c-494e-a180-0097e82d8adc", "comment": "Malware payload (Formbook)", "value": "ddcfb1ba424e8b10bc83301942845f50a4e5ada39250ba706a9ecbc7ee9e63e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687847330, "uuid": "bbc1c4bb-5103-4ec6-b2b9-5508eb5f66ce", "comment": "Malware payload (Formbook)", "value": "13ca31e5a9af8e3200f0f7b4a75b6e87450bed1b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687847330, "uuid": "d9d0c8c3-09d4-4458-acad-f27bc0ac7a0a", "comment": "Malware payload (Formbook)", "value": "c52dfb3abd09eb61b7ae2a85c97431e42c6668bea97137e188f298d6377410cadf5558757137914288fef2c73ad2da82", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687847330, "uuid": "aa85d464-e10a-482d-84ce-660b29bb2048", "value": "T1FE3412502AE0E037CAD281305B7B2B9D97E6ED2754B4671F13A0866F3D37291BD1D3A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687847330, "uuid": "067dd00c-d25e-44fc-83bc-32215b1685f5", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687847330, "uuid": "f6408383-df95-441a-b1a2-4eaf5eb965ec", "value": "3072:HfY/TU9fE9PEtuMbMDLzhZnItT0oQ/Uaz2Tc+D5whNWoW9lPNn644T2fU36/c1+G:/Ya64MzhVI+h9S4Da9lsK8N+u4uL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687847330, "uuid": "3ec879f7-57a3-4182-8e80-76040bd2940b", "value": 245307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687847330, "uuid": "73600813-a558-4128-9a42-3ece7353fee0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687847330, "uuid": "06179736-b4b9-47a9-a101-ac99fa62e0de", "value": "8001fc3355e347ebeb82daf3170e884e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c396839-14ba-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687850060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850060, "uuid": "0f352f8d-db4b-4c1a-b447-e84954909861", "comment": "Malware payload", "value": "c5c45ace4ae6f6a3ee0b9828e48acaa8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850060, "uuid": "5e9e8dae-579c-423b-a76c-50c7d0c15788", "comment": "Malware payload", "value": "ddf59b798762b14ce9e758a7db1ec35c62b5245e5e74b9bdd10096e5afae3622", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850060, "uuid": "a4851a64-83eb-4db1-8f18-9dd64ef7fcca", "comment": "Malware payload", "value": "0de07af83512683980a6fc88ea1fe77b0d435bae", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850060, "uuid": "bf28063d-8939-4ff1-bea2-a949df50899e", "comment": "Malware payload", "value": "364cd8c28524547130807e924eeaf5138fda5e64f6a5017bd3072009a139c200abe1efe047feff44eed522fe64cf0952", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850060, "uuid": "7625fa11-e468-4537-aec3-359fcfa3bb52", "value": "T1DF23F23E5F29D864CA57CBF98AB16D94C41F5EC2D5E5A67B03DA081763C802DAA00CD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850060, "uuid": "4e339545-7096-49ed-a1f6-1c2ed3e32352", "value": "768:B49VDw94UbN5JNbia0eAfPryn5QzShaPuChbhFbHRu/lCw3mlzqGPTb1BYxs2ijw:BqmayjtiabAfzyneSMPuKbvzUlXmlbYx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687850060, "uuid": "ac215d34-1b8e-40b3-81ac-e39b3ec2b845", "value": 48557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687850060, "uuid": "80c0cde0-fbec-45d5-81f0-d0ea43602837", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850060, "uuid": "25c8552a-ad62-4a55-8f51-655f8d8c8935", "value": "ServiceApp.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dab1e4e-14b2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687846760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846760, "uuid": "5248e91b-0fb4-4038-ac5c-3509ff9ea054", "comment": "Malware payload (AgentTesla)", "value": "f3d359592cbbec6885c7aa08789967ff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846760, "uuid": "e5c98266-1652-4fc5-bf46-55bd4d6586c5", "comment": "Malware payload (AgentTesla)", "value": "dfff9bcbad94fc403e28323a087e4631c0c2d2c72669636b3a822a87f119c914", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846760, "uuid": "b36ed77c-7d8f-4f60-8f06-75d638ad65a0", "comment": "Malware payload (AgentTesla)", "value": "6c6fde1ad317fbfb89c8e03c706420fae327e657", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687846760, "uuid": "97bd5fb7-0a42-489a-94e3-d28f618e7dd1", "comment": "Malware payload (AgentTesla)", "value": "6d159bf0cda336aa8bb1acf2948e9bbd4ecb61048c995a69d34c4c365a04cea9358fb902e2f0d81adfd3b7d7c43a7b76", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846760, "uuid": "57a2f3fb-1c01-4924-93f5-33ffdf3d88a9", "value": "T101D46A3C08BE1A37F074D6B9CFE48463F410947B39299A36A4DBC7516706EA269C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846760, "uuid": "380296a0-79bf-4b48-809f-2cf26818afc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846760, "uuid": "8ceb3cea-dc65-4273-896e-3c7bcc03e026", "value": "12288:TwC9YjjIaAjUmtaFWOl2zUHQTyK9uq0E8PYIQ+7:TwC60HgWVOl2+Qju3E8PYID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687846760, "uuid": "01447c57-19a3-499d-925b-e97d7e09785b", "value": 603648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687846760, "uuid": "2a8b1dd2-9901-4131-8b20-dbb8ba99c784", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687846760, "uuid": "cd11506f-aa1e-4fe3-8971-0e75451ee626", "value": "Invoice-04884.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceb8fcc8-14d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687862331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862331, "uuid": "7f4f1a02-4a3d-4e69-8364-5f79c6b18874", "comment": "Malware payload (AgentTesla)", "value": "074ce449c01fb1b9066746b870794f4e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862331, "uuid": "4e6f3564-7902-4843-b9bf-bb08b6a24a8d", "comment": "Malware payload (AgentTesla)", "value": "e1836520ed6edb7fe91462076fdba7e96174e4506e7fd2df69de260199e5c020", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862331, "uuid": "cf9d9217-42f9-4270-ad4b-0d66a43318a9", "comment": "Malware payload (AgentTesla)", "value": "8effae8c164f577b7558476c551ade76e041a4a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862331, "uuid": "b6a7c210-c3bd-4880-abb7-05d68aec81c0", "comment": "Malware payload (AgentTesla)", "value": "2a14e1d0ca25393c5d7e54015dbccff249af892044d04ea7343a6a0fa5b1fa21f69193fb5d2df26d879248f3570dc612", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862331, "uuid": "79186115-943e-47aa-ac6d-2118705b1355", "value": "T1C2C4693D1CBD2A37C074E6BA8FE48563F560D43F39219A2264D797958306EA325C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862331, "uuid": "e8c02f64-8fce-4d5b-89fe-2d75eff01de3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862331, "uuid": "e6263cc2-4d18-4bef-8e5e-642ee6a81563", "value": "12288:MiwMC121C/KzAY908WbmzpZqLP1ll6xuU6EI:pgM1C/Kz990lKzpg5llWuTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687862331, "uuid": "8ca4c9d5-482a-4a3b-a047-f010b1e7776b", "value": 586752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687862331, "uuid": "1088c620-1470-4ab8-bd12-2ca869ea088c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862331, "uuid": "f1622d28-4603-445f-80f7-0e9f2911c701", "value": "57m\u00b3 LPG SEMI TRAILER 7 NOS.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e295c0-14d9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687863288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687863288, "uuid": "3c05b27f-b2d7-41f5-b88f-75d05a3e9344", "comment": "Malware payload (Formbook)", "value": "7ec88736894dba23a886e0dde43baab5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687863288, "uuid": "859b37fc-f0e3-4ab1-9796-e5ffbef808e1", "comment": "Malware payload (Formbook)", "value": "e2ceee53e039eaca503c58bd2be1b268bfbc1f17a7568e70bdedf5ca8d1bd637", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687863288, "uuid": "4e039a53-df1d-4e51-ac36-57bb1f6b3874", "comment": "Malware payload (Formbook)", "value": "a9c9a984c3d3e6fdee3a326ec10b91a0b31d9065", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687863288, "uuid": "bf48c8df-5817-41f1-8895-24d6c3ad5f25", "comment": "Malware payload (Formbook)", "value": "0ef2973065a9aef13da560748c02e19b1f4a4382b3214ddccda34bc92efd5ef61a15d5a724c374b2501483372c20e9e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687863288, "uuid": "c170494b-8149-42e8-9c34-2ff49d956523", "value": "T107D4693C1CBE2A37C075EAA98FE58463F550D43F3921AA3664D797954706EA324C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687863288, "uuid": "445ddcd1-ded5-4538-902d-2357e7e39bf7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687863288, "uuid": "2207dc28-f067-467e-b229-36fbc217d9b5", "value": "12288:UsQlBqhCdX0o8U9ipaySKo/Qj3XudQZOMUNgt4:UBdTv9K9jnudQVt4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687863288, "uuid": "ccceae5b-0979-4548-b9ef-42072ab9fe43", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687863288, "uuid": "81d93993-bc69-4136-8832-b376045e7ac9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687863288, "uuid": "65dd95e2-9801-43a3-91a1-77d630d2eb47", "value": "rRemittance_90633_03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f4fd41f-1516-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687889659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687889659, "uuid": "a5008d85-974a-4e73-822d-da12d8c55b0a", "comment": "Malware payload (RedLineStealer)", "value": "a2013cfe8484dbf0ff43dda5fa838bec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687889659, "uuid": "e97790d6-9b91-4a61-9b9c-97df0ab77745", "comment": "Malware payload (RedLineStealer)", "value": "e2f75ca08fa958f8a4fa25f2e0e76cf63f6af45bcff1166fa67f4b2e561f9bbb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687889659, "uuid": "a0e1f89d-c08d-44c6-917d-d8cfa63bf34c", "comment": "Malware payload (RedLineStealer)", "value": "7e64a56daeae7a52fbca2f03bef2274af7b8c957", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687889659, "uuid": "dd559e91-7eb4-46b2-ab63-359aca567a8e", "comment": "Malware payload (RedLineStealer)", "value": "508c9bb0dbcc477daf1de53442c3d7fee1378f5148f4e11196e1e9e8e3632c4a97dc96f03afb702060ac017cd5fe5f69", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687889659, "uuid": "9855e5ef-ba38-472f-b687-8911afaaa85a", "value": "T1C5947D3392F17C54E5258B32DE1EC6E87F4EF6538E6E376622189A6F05B01B2C263750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687889659, "uuid": "fc4e40a1-a2b0-4039-bcb4-e55e58731b61", "value": "435e7ef59b3c6347cf62e2c58eef72c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687889659, "uuid": "e9863376-3440-43ff-a134-e52ce3676c21", "value": "6144:wIgxHtB8mOQzCA+7Z8EdYM6gkEGwDb98QzTy16XJ:w3NB8mBB+F8EdYbqb2AJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687889659, "uuid": "a8f5ee3c-b9e3-40f8-9a4d-8e3eef1dff63", "value": 408064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687889659, "uuid": "85ef629e-3b49-4110-936c-4a110a43a8e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687889659, "uuid": "581970b1-dc60-4d68-a013-dbcc3a269bad", "value": "a2013cfe8484dbf0ff43dda5fa838bec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c59e30f6-14c2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687853726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687853726, "uuid": "db274ea4-896f-4a65-961e-62993c3bd7c3", "comment": "Malware payload (AgentTesla)", "value": "ef374fa6c2bb72b11c96b5e62d962bd5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687853726, "uuid": "e941a3f8-894f-49a8-9e76-663a6ecd62ef", "comment": "Malware payload (AgentTesla)", "value": "e2fdb921382bde611e5595d4d0481d6a2b35b1975ae07f2ecbf9b2302ff8adc5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687853726, "uuid": "64d19b06-ce0e-4113-bcba-f465ed62dbad", "comment": "Malware payload (AgentTesla)", "value": "3bd2e9243691e2030ad02abbe134551d6a141662", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687853726, "uuid": "cab089a4-e504-4b6f-88a6-751d8db2a6ab", "comment": "Malware payload (AgentTesla)", "value": "b88fe4a02621d872a6092d0ac2f3a5f8baef1cc98ac8be4c7f71afff1285e5cd752c397cccd3c9429f596de70b9d9f2e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687853726, "uuid": "e5d6a665-2028-4876-b05a-90c6c117e8e0", "value": "T1491311657596DA41C8860F764CEFAAFA6332BC21DFAA4347338EB31D5F31B454A02706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687853726, "uuid": "72263d04-620a-45ef-b416-b713d4a48bb7", "value": "768:WPKJk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJDKrJDStXyDO+LXTLEUU0i+B8O:qEk3hbdlylKsgqopeJBWhZFGkE+cL2NX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687853726, "uuid": "54b7ab55-41ab-48d4-bb9b-f1e9275fb534", "value": 41984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687853726, "uuid": "e214b144-6283-4715-b724-4e5243ee0277", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687853726, "uuid": "8494bc13-8b6c-4d1e-b48e-fdd793061a00", "value": "INV V001295802.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36db1440-14a1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687839313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687839313, "uuid": "32dafc40-172c-46d5-835d-4d4e71b35d0c", "comment": "Malware payload (Loki)", "value": "eb5557974b72b71c1d31dbf9911843ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687839313, "uuid": "bb3a42d5-31ed-434f-92cc-94660dc39df2", "comment": "Malware payload (Loki)", "value": "e3a60c9d44679aa4a97d4a7d8c60e56dfc63243c126a8e92a92ba527dc4f5ee2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687839313, "uuid": "e0a20469-c49d-4c3b-a14b-f75d1bce0900", "comment": "Malware payload (Loki)", "value": "7d66fcd70b78bfa6e1638dd8d0a0e50c15d9a828", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687839313, "uuid": "de3a604b-335b-4ed1-b7f8-475fedf61ea6", "comment": "Malware payload (Loki)", "value": "d5cdc5e0f8680cb85bffd4b26a3d53109b12f313e5af2de200fbf90cc855ace8373019e7d405a8ef9c041318a49ef1bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687839313, "uuid": "773c0ba1-4257-4cae-983c-caf9735d43d5", "value": "T12EB4473C0CBE2A37D138E6B98FE58463F444D53F39221A32A4D797654746EA264C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687839313, "uuid": "862eee5c-1832-43be-8e7d-69fe23f5b10a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687839313, "uuid": "1874b3d8-4793-4d7f-bf70-b0156a3d54ff", "value": "12288:rI2iNvzKi/mpJGWisa4L/vS7pg2gBbcWFflArG2Q:rI1lOfQ7pg2gBbcWPA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687839313, "uuid": "a06ff972-7e8e-44d5-a9a0-c26af99c5dcf", "value": 535040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687839313, "uuid": "ca099ca8-2fdc-4b2a-ba1e-7395f770aa44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687839313, "uuid": "40d6843c-c7e8-4f0e-b4e6-a4887de558ba", "value": "ZVQR8cVBH6eqhuG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f034608-14ba-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687850038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850038, "uuid": "a7b4fbdf-85cc-4e58-b8e5-4c1f92950b30", "comment": "Malware payload", "value": "fab096efdb13820a5adf3f4bb3a86c25", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850038, "uuid": "25a2e395-a05a-47ff-872a-10df146ab2da", "comment": "Malware payload", "value": "e472233bce7dce703930e6daa615b9a4fc6ea428cb3bc5e4901d79cbd3cdfdf8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850038, "uuid": "9385f955-b15b-4cce-8a7a-ccf1a66932d8", "comment": "Malware payload", "value": "a687bd048342ecd1dc4ee76cf1bd155176713ce4", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850038, "uuid": "8d8573b9-0edc-4a6d-87a4-dc14a7cccf03", "comment": "Malware payload", "value": "e2057a81a5979f9b1f0181d3cd62df71ed9a22b31dabb99e6f7c917b7597decf6130cc273a6a86b1c46842ae3a828245", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850038, "uuid": "d549b773-a30b-4703-9879-7e6dc592d516", "value": "T10A23F22E6F2AD420C7579FFC8A706D84C52F99C3D5DA6F3602EA0916638C01EAF11DD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850038, "uuid": "b8ef1484-7f8d-4302-8bdd-3683e858c7fc", "value": "768:l49VDw94UbN5JNbia0eAfPryn5QzShaPuChbhFbHRu/lCw3mlzqGPTb1BYxs2ijX:lqmayjtiabAfzyneSMPuKbvzUlXmlbY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687850038, "uuid": "e3004071-e3d8-4182-9f84-7d07c3523978", "value": 48528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687850038, "uuid": "2849786a-06bf-403b-b1e5-6ae865459632", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850038, "uuid": "7650ec09-ef46-4dba-b82f-fbdc30784444", "value": "MicroApp.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa858314-14eb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687871424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687871424, "uuid": "b04df73e-6ae2-4c4e-b7e8-ec75435d10bd", "comment": "Malware payload (AgentTesla)", "value": "153bed9772c83355fafea2e3671a540f", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687871424, "uuid": "ad35c0ea-519f-47d2-accc-e4ccdf5a5a30", "comment": "Malware payload (AgentTesla)", "value": "e5dbce139ab26dc9f743ca4161894d49adddd7c9bd0f1ac4adf4177aec479b69", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687871424, "uuid": "a94611f2-a68c-4dea-8629-45bdc23b9c8f", "comment": "Malware payload (AgentTesla)", "value": "63d150d84515394da50a5355a2a8cf84163fcef1", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687871424, "uuid": "c7d48dfc-5920-45da-b488-f76d62028e0f", "comment": "Malware payload (AgentTesla)", "value": "df8f6eeb2400cbcd501b34174682b25d3900cb2961a1bc917b0f92df4a1352a2358c6aa6b06ade0dc5ef7c58d3f62710", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687871424, "uuid": "4d90fe46-f93d-4020-b86d-688a48ca6ab7", "value": "T1C8C4693D0CBE2A37C170E6A98FE98563F550C43F39219936A4D78795474AEA324C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687871424, "uuid": "e51e46ad-d046-49db-bcc7-c3a6eb7ab3d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687871424, "uuid": "0e415e51-b073-4c9e-a785-23952ca5dbb6", "value": "12288:B0pNxBRzXjZBXm2Po0AWQpwdyufZwsivoa1rOL9sz:B0Jz9NARJw1Zwz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687871424, "uuid": "6441a2e9-716b-4506-9f0c-7cefd6b6f176", "value": 588288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687871424, "uuid": "9583ef66-8687-4063-8942-527384dcb583", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687871424, "uuid": "5a68bc40-ea75-4c7d-9da9-a8039cac5cd0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dc06933-1481-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1687825527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687825527, "uuid": "b3ea26bf-d21c-46cd-9609-01993a257d87", "comment": "Malware payload (CoinMiner)", "value": "ebf830587e4df50f0a886fe4bf05bda0", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687825527, "uuid": "cdcf0232-eb57-4986-a7fa-4b65485ca352", "comment": "Malware payload (CoinMiner)", "value": "e669914a28ffc4b51c1f4e54efb0e9d6bd74a97fe293c7c8ba30b50ae4c508d6", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687825527, "uuid": "de5ce859-f57f-4e9c-98d9-61e5366e7cd7", "comment": "Malware payload (CoinMiner)", "value": "3c0217098ca7b191d146b770eb366a9081187a66", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687825527, "uuid": "9610ad21-cddd-4d6d-b6fb-50e5bbaf389f", "comment": "Malware payload (CoinMiner)", "value": "3298a5ea78574d48f4028591bf37569de87d2f3620dbc35bb7a6154d1509e58bc4635a443fa4fd65e4d636aeb06f1486", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687825527, "uuid": "2fd3a3a4-360f-4609-946b-edfef8937538", "value": "T173B6239A3184335CC42EC4308033FD55F6F51E6E0FA59AA576DFBE823BBA950A503B49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687825527, "uuid": "805d9359-15b9-4667-be07-21267a265d8e", "value": "68bb64046c4ae293fa9bf2c0c4917162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687825527, "uuid": "28c9e9e7-8368-4ba8-8573-67e27f4537f1", "value": "196608:5v0YiLEnZdj72+W2xH/WUUWc1HoTqAqxcwN4ZRIGAk0kZB8hhC:GPwZVi+BPZwxcSZS63C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687825527, "uuid": "a983b12e-406d-43cb-a7b9-515f1580bf52", "value": 10797568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687825527, "uuid": "6500f135-f744-4df1-ac81-b145aae73e3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687825527, "uuid": "c9a58ff1-db0e-4324-904e-f2972abd73a5", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd23782-14ba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Fabookie)", "timestamp": 1687850034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850034, "uuid": "e69ea857-f3b1-48ad-9332-530e3ea6fa5b", "comment": "Malware payload (Fabookie)", "value": "e0493eb151609418846b7b9f85b0e828", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850034, "uuid": "a9dac7ec-b18d-4b64-aa8f-c514aeb18d9b", "comment": "Malware payload (Fabookie)", "value": "e760a431ae112201eafbbf9bda09a4edc3da36ec92ceef57eb76d587e6693eb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850034, "uuid": "24cf5074-24cf-41f9-9c23-4b650ea91fbd", "comment": "Malware payload (Fabookie)", "value": "32cbf270b44eefdd76ce40b9a07e8fca69e284f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850034, "uuid": "fd9c63cb-a644-448a-b767-50b70cfb4a01", "comment": "Malware payload (Fabookie)", "value": "24b472ea86b324bd0260ccbf1fd6fdd044e70994ebcb61b45c5a705094e01f4e7c6bf20ccc9cd78b0386a69367b9aa0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850034, "uuid": "7990067f-1bab-4b87-986f-a02187c87cdb", "value": "T1A2346CA2F3E80069E0B7C23A8AB15375EB7278591F2187CF1164566D2F337E18E3571A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850034, "uuid": "4f55f6c2-fdd7-49f6-9c1a-b0a2e3a18f0c", "value": "0b788e8ff3124c2dd648ac7a27e0b5d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850034, "uuid": "8afa60f7-a25f-4239-a821-c41de64a58c7", "value": "6144:aqkvUK8JRGHAoBWxiEEiEEsfByAwZZS4onQFiy:atB8JRwAogXIB7GjFiy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687850034, "uuid": "5cdf989b-9f6c-4052-86fb-f159196823ab", "value": 248832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687850034, "uuid": "c8762e09-a171-41ce-ac13-b013505fcf08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850034, "uuid": "c0cecd5e-917b-4339-ae10-63222891cc1d", "value": "e0493eb151609418846b7b9f85b0e828.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5216e50c-14b6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1687848378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848378, "uuid": "25316f68-48b0-49c8-b11a-305d46a32d08", "comment": "Malware payload (Loki)", "value": "9bbe59527ca393e1ac5d95833d220aa0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848378, "uuid": "60f69102-cb0d-4571-95e5-d2422901c871", "comment": "Malware payload (Loki)", "value": "e9cd9696e6bf493ed5be1c9099a5181593f585aaccb80397f02e6311ee3766e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848378, "uuid": "bbb65497-add6-40cf-8825-7a29bb5823b1", "comment": "Malware payload (Loki)", "value": "3a040b42e0e5fe845947aa2b101e7e2f9ff56754", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848378, "uuid": "ca26b238-2b25-4e6e-8a85-1ab1d419c7bd", "comment": "Malware payload (Loki)", "value": "7a68f546638dc5b6142e8a7f21d2c443496759f3f696837e45edb09f1a7bb624d67cf5f2598f3bd621a673620d09090b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848378, "uuid": "4690e578-3472-4319-a050-9d7d459d0e57", "value": "T1D5B4473C18BD5A3BC175EAB9CFE58463F450943F39229A3260D79B558706EA325C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848378, "uuid": "fd4a927d-2b82-4ac6-8e47-e7d306da3341", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848378, "uuid": "8084f2bd-a7f4-4267-98f5-1882c0691af6", "value": "12288:cr2iNBEo6a0EmRzTxaUZLziQ0C+5zaXIQX2AOgCBHOT7:cr1bYNFdaEW7X527mfpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687848378, "uuid": "103468a9-1bcb-496f-9226-8e15d6522349", "value": 533504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687848378, "uuid": "036ae8e3-849a-4f24-bbce-c8ddac57e3b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848378, "uuid": "7b434f9e-77e3-4afe-bdbd-997d832d03f0", "value": "UPSCBJ19051700131.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c072a5a-1482-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687826008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687826008, "uuid": "84b2a336-1ae9-4aa8-b077-a1f1baced901", "comment": "Malware payload (RedLineStealer)", "value": "aa3a55571be334651a04862a061f6b2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687826008, "uuid": "b2aa79f6-9590-46ee-a50a-037ace1da05a", "comment": "Malware payload (RedLineStealer)", "value": "eb2723d97df6cf5db266cf6461d0fd63c2c3d686297c9f503ebc24fbd5529d37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687826008, "uuid": "d041d6f4-ab6a-44fe-85c9-b7a9ffd3d16b", "comment": "Malware payload (RedLineStealer)", "value": "e148e9bc5b930f7c5df1d14a9d7cf59870c7e0c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687826008, "uuid": "8f61450c-5463-44b5-800e-a9c2153272bf", "comment": "Malware payload (RedLineStealer)", "value": "ee9c988a43a6b84ef6d6a6760a59c968d67f0df739149561743f154df1a9dcd420e33d31dac80446f964f4ed0b74d5de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687826008, "uuid": "62f93aee-bb65-47c5-a2c5-87817bb75bc2", "value": "T1A3246A296680F7ABDC2D373425BFC1AE96E373318A224447F954FD690F5C6D0762CA88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687826008, "uuid": "aa1f7f82-0379-4094-a2ee-3d928cb9232d", "value": "89591827d8fa86937981d5b74d9dafb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687826008, "uuid": "fc5cda51-8358-45de-9bf1-484a92bbdf13", "value": "3072:pu7FhihjyH+3T6JeN2hvW/wVXOZwgyzvYN3rJZUglHumnC0xu:pQU1TrUhMwVeGgG60lmY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687826008, "uuid": "8bb532cd-34e1-42c1-9508-9ad2a2b5b708", "value": 228624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687826008, "uuid": "8b829365-5516-413e-a213-976bac359270", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687826008, "uuid": "327602e6-446d-4ae0-84dd-43d1bc032b15", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8357d34f-1502-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687881103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687881103, "uuid": "0fb51566-d54d-4018-918b-dc6cc73d3b17", "comment": "Malware payload (AgentTesla)", "value": "590212d15463e5e0c2085dd5d9671797", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687881103, "uuid": "7cd6c8eb-8e7e-46ce-8d31-7d1e083e77ca", "comment": "Malware payload (AgentTesla)", "value": "ee107422042138c607247628f16768ba6b6238c4e5b4d29f80f9e82202836c56", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687881103, "uuid": "89f81501-13a2-4fc0-86f8-066f913e2368", "comment": "Malware payload (AgentTesla)", "value": "6480f7e8b34b37465055165b0d4c9bafd3a7385d", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687881103, "uuid": "06dff397-ce4a-4ce2-86cd-3da1955f1813", "comment": "Malware payload (AgentTesla)", "value": "0622f890a1c0409085eba58c50ab4ccb6fc30c017e6f3a3afd78d2bfac027249595b4998f7c58c27f1c194dca616b551", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687881103, "uuid": "9cdded07-55cf-4712-8be8-677e6979c0bf", "value": "T1A1A423A6F6644753C6F652A69037245C83ACA11F6B930C22C27FCF860FD2FEBB149564", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687881103, "uuid": "7c460894-7e3f-4617-9696-44a340b48ba2", "value": "6144:BR52ZmRbSuVcllTfqV9wQyKnnbr33IqY4cuV8/angQSrhs39km5GUcEyVdZ0qJTp:D52mRbdallTfA7q4bVIaTmhQ5clHeqVp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687881103, "uuid": "5692db90-158e-4faa-99af-cc10cfdf41c8", "value": 488706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687881103, "uuid": "50bf4634-386a-4c82-8d79-ecda6b819654", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687881103, "uuid": "a2fd5d1c-a0a3-48ad-a461-94e0897cbaab", "value": "CSID 270883.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0ebfe4c-14b6-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687848537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848537, "uuid": "871ed81d-7e17-42d6-ab14-8fa9efbedf8f", "comment": "Malware payload", "value": "e077d17b78bc51fb674d283ae98ec5a8", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848537, "uuid": "9425c021-345e-4df6-8717-e3fc2b3bf1c0", "comment": "Malware payload", "value": "ef4930b5b0a30a1cc493f4b7f72fcadcd109d21956d2aced6e85e4c6f5e69fb0", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848537, "uuid": "faddeb8b-5d7f-48c7-bfe4-7c1d1f8fb2cb", "comment": "Malware payload", "value": "8beda4153d46e4ba35ea1c7497018903c664127c", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687848537, "uuid": "da38c06f-f7ad-4790-893c-f35e670e5323", "comment": "Malware payload", "value": "e2617c0a4f072fb267844553440dbd4752ee462c88e75c1360859e9ce5b9c5f3465d8360458d806973adf96f313ff77d", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848537, "uuid": "962072cd-12c6-4fe8-921a-3441d73510e1", "value": "T19C749B0263FA0108F2F36B49AA7645784B37BEA6697DC55C418C290E0FF7E448D65BB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848537, "uuid": "b9e84819-cc64-4354-b0fb-d8ea9e111e62", "value": "3072:FRr+dxPr+9gr+Ejr+gMSlctO+Jxq3udcXQh5n5G5XNsni+zcg4K20MxzaktI1vsV:8l2ZnP5Mxzakp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687848537, "uuid": "66ef5988-68a6-42e2-be94-f4031d564e32", "value": 358344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687848537, "uuid": "6480228b-3345-4ec6-84b5-1efd0e01b7ca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687848537, "uuid": "886e008f-24f8-41c0-af3f-9b7591a46de0", "value": "Company-Profile.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2c912f1-14aa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687843494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687843494, "uuid": "31e12b3e-6d92-4519-9291-ae3b083d9873", "comment": "Malware payload (AgentTesla)", "value": "821a1894e3f0a07479cf1c9dbe3bd560", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687843494, "uuid": "e6cca352-1c3d-44de-a849-cc6726eb00f0", "comment": "Malware payload (AgentTesla)", "value": "f03d67ed2031e2139d12a96b4a43b4c4b871711329d74472f8a97ec8f2e8ed8e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687843494, "uuid": "afcc8657-1055-48cd-b999-756f1ee04c96", "comment": "Malware payload (AgentTesla)", "value": "4cfe3789538c92e1e42094722774b5ec1aee908e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687843494, "uuid": "32ba0a6e-aa6d-43e7-ad31-ff40721f4ca4", "comment": "Malware payload (AgentTesla)", "value": "7dd4dd685e5efbe86bdc304adb3af8ee4429a758d891d27e9d81c01fe9cc37ea8a575665ba01d3d74799160202ee083d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687843494, "uuid": "7d2f8c30-f2fc-4bee-8f10-0e8e54d958ea", "value": "T18ED4693C1CBD2A3BC174DAAACFE98563F440C43F39225936A4D787558716EA261C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687843494, "uuid": "9a9f0c9e-f918-4fe0-8e8c-7605b7102648", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687843494, "uuid": "1cee74d1-a25b-4acd-9387-f0f9fa820362", "value": "12288:0A2iNFOaNxLUGONE8DU67PiHqb7PcV1NemukmPZNXr:0A1BxLwaBKbrcvNeU4ZZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687843494, "uuid": "bb339fb3-e1cd-4728-8e8f-910e44b3c68e", "value": 608768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687843494, "uuid": "f02bad0f-6014-4e2a-9f51-6c2a8af2abd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687843494, "uuid": "71209814-c3fd-473a-ae06-385244377131", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26778705-1503-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687881376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687881376, "uuid": "bf7120a7-eca1-4441-992a-a0162dd7a1c3", "comment": "Malware payload (AgentTesla)", "value": "c9e1925c37d7fc710856fa2e1649e77f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687881376, "uuid": "06d366e4-b81d-4856-90b7-b1f16d34dd0c", "comment": "Malware payload (AgentTesla)", "value": "f0c9ad9383d8bb7e01074d6098d110440737420cb6ec7c00d1392de80e36bf0b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687881376, "uuid": "a99cceae-6bc1-4b7e-8dc7-3283fd2812e4", "comment": "Malware payload (AgentTesla)", "value": "715134b6c91c04f9a0d35114533209666a715f2a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687881376, "uuid": "8478623c-af51-41e3-a9a9-9b078d67ccec", "comment": "Malware payload (AgentTesla)", "value": "f85c911ce90d22386379e4961bb05c1d186b52a88702feb63c113cf3a4f24247adc7633b913e00273e53f6bbf7497169", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687881376, "uuid": "440db504-59a6-4841-96d9-74ec174e34ac", "value": "T12DC2815AE79B03B44F910272271E0BC9AB3DB12EB35155B17868833423E9C7A46766FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687881376, "uuid": "0c39c887-e4bf-44f7-ae88-eea9973dba2f", "value": "768:nyFx0XaIsnPRIa4fwJM9JvVWSJ8DOR3Xw:yf0Xvx3EM9oDO6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687881376, "uuid": "7a116748-30b0-4b62-af74-0ae7b2a43278", "value": 27466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687881376, "uuid": "56e0fe3c-4e87-482a-b54c-a820edbc6694", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687881376, "uuid": "b22deabe-dc70-43cb-ae24-1d79b75cc994", "value": "SecuriteInfo.com.Exploit.RTF-ObfsObjDat.Gen.23522.11901", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f5308f7-14f1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Zyklon)", "timestamp": 1687873714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687873714, "uuid": "e53bce48-5f09-417a-aa2e-a80dcaf10772", "comment": "Malware payload (Zyklon)", "value": "08bd9f40d1e009c3ea0475aed29e597a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687873714, "uuid": "bc12a75f-fa4c-45f4-886f-d6e66f11d63e", "comment": "Malware payload (Zyklon)", "value": "f0f756cdd6211e7ccaa203844abf95f2993dd2c1033fde42f5e17ba10adb67e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687873714, "uuid": "1d6bc2e9-a3ab-4619-9949-50e9d2196154", "comment": "Malware payload (Zyklon)", "value": "93eb930b3b54dce404916daa9d7761aa7f23bc4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687873714, "uuid": "f2bb96b0-7514-49fe-aa02-57315512c780", "comment": "Malware payload (Zyklon)", "value": "3136d358460a8b4874329a0561c7cf3e99da307929a8c7522153608ffe3753421fd9ee35776bc27bc567ab5a3f23e6b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687873714, "uuid": "91f422c9-3829-4e2e-8582-0e4413d2e7f3", "value": "T1B38518563E95886ACD5D03F2D4B30655AE90CCC56709C1AF3ADD7BCEAB2C2CA790D243", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687873714, "uuid": "93fd400c-9729-4c25-a6a9-87afb887e3b7", "value": "49152:3JfC7C2mJOTXP3NWpItn+id8pq+Z6Q2Xr7oX1f00/gZv+1X2J+lX:7XTU+1X2JG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687873714, "uuid": "27993d42-f36c-4396-8680-d86a9c1f432d", "value": 1873072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687873714, "uuid": "8bdc6145-8a67-4bf8-84c1-26f0283b6650", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687873714, "uuid": "7c64eb5f-a69e-41e0-9fcb-7aba0c0b10aa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de53df4e-14d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687862358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862358, "uuid": "7c0e04e2-017c-4236-a966-84523919bd8c", "comment": "Malware payload (AgentTesla)", "value": "0f4301d20b7b9c7e68f97fbaebb36d87", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862358, "uuid": "5b9783d3-e71a-406f-9ac2-fd398b9461e9", "comment": "Malware payload (AgentTesla)", "value": "f275589bf659f7805e2be779ef77334af3e914e57530c5bf241c8de6e22c6225", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862358, "uuid": "9ef9890f-fcba-416d-96eb-c3e57b46a44b", "comment": "Malware payload (AgentTesla)", "value": "3984ad3730df2f597e9c903fa3caf329d5076235", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862358, "uuid": "084dac85-be76-4f68-81f2-711db9833f15", "comment": "Malware payload (AgentTesla)", "value": "2ab84fe5a0d903130f8adea48004b9c21539da34475c7adf9ac28b772f1c3b71684387200d495c9e1c1c45ca0f1acf83", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862358, "uuid": "e38600b6-e12f-46ff-aa14-6b43689b5b15", "value": "T16C749E0263FA1108F2F36B49AA7645784B37BEA6697DC55C418C290E0FF3E448D65BB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862358, "uuid": "91264bd0-eedc-4f94-af4c-9dcaa3ddc11c", "value": "3072:FRr+dxPr+9gr+Ejr+gMSlctO+Jxq3udcXD5n5L5XNsnf+jFxJfz8MxzakNh0vspr:8lGnE6MxzakJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687862358, "uuid": "c962f86f-cf1e-460e-bde5-e36edeb848bc", "value": 356924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687862358, "uuid": "d3ad470d-fbb1-4676-9800-586bdc44379c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862358, "uuid": "10a1ba2c-bf63-4f35-b6bd-c838c7fbd3a9", "value": "Order-78473321.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b21e3cac-153a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687905233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687905233, "uuid": "fc5afb43-8eb5-44df-985a-bb6e7dc14c8d", "comment": "Malware payload", "value": "5e60c84e08acf6637557984210c75ce6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687905233, "uuid": "278699f6-31eb-4723-9195-eea4fde4df27", "comment": "Malware payload", "value": "f6eab414e7024726ac1c05c06f0417574cc669d7471aac1a849a0a23d7ffd3cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687905233, "uuid": "912ae056-f669-44c3-8f27-a40210796734", "comment": "Malware payload", "value": "a7a0bc32f6ce9cef85a8b9c26d86260b0b318ca9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687905233, "uuid": "57c2cdf0-93fd-442f-8628-c94a6e1cd949", "comment": "Malware payload", "value": "9516da287ed3db051228fed3cca4d188cbc7a2012a66d1f1cb829e995616e30c3f8666b64c4f8645dd7a597abb2c0594", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687905233, "uuid": "bb32254e-e9e2-475b-a560-62848c999e91", "value": "T1AE96297BA2A4C129D15EE27AC4AB9F40993370B91B37E1EB519003A51E16EC4DE3F770", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687905233, "uuid": "ed344f92-9bfe-41be-a9c8-daca888ced0f", "value": "8ad3c8f2befbfbbb7ed7c3ff64c30859", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687905233, "uuid": "19e517da-c73f-45af-b957-93ed1142abc7", "value": "49152:Gcm5QQHJhTVcpMVX/CZlq57SKfNfREGjtlkUSoV+9J8Ho1EIqERLIHQepqtnMQt/:Gc0x7I+933Ho1Et/+zxtcs8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687905233, "uuid": "f75cc5f2-bd39-4b31-b0c9-6897bdddfaa0", "value": 9302528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687905233, "uuid": "f2b906aa-0b5c-4c47-a375-3d5e0131f5ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687905233, "uuid": "3910531b-6e32-4cd3-a527-94618dfc6664", "value": "SecuriteInfo.com.Variant.Barys.434263.25402.5954", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0381565c-14bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1687850394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850394, "uuid": "68e35ee1-110e-4f49-b185-a49b8ce1b6ad", "comment": "Malware payload (GCleaner)", "value": "563571409701890e53b761083c7808ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850394, "uuid": "294a8be6-b3fd-4c6b-827c-c72bd6230c60", "comment": "Malware payload (GCleaner)", "value": "f838ad107e3fcbed893cd5afcf8dd2edf9c2aea0719c85efe0551cd587c9ed62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850394, "uuid": "5c7adcfe-ced4-4755-8be3-7f5c1eff0bb6", "comment": "Malware payload (GCleaner)", "value": "951e3132009a1c0a5c8dfc9170886010902bea7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687850394, "uuid": "c06fa96b-4aa1-4c43-964e-6b4b5187ec64", "comment": "Malware payload (GCleaner)", "value": "e92a3ce43d6ff7560e26a2bd4128f76cc7e533a2ce4c829d88d7d91f95733b57bd7f721d4f9d309d27571bd923d6d32c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850394, "uuid": "96ec3e40-3869-4c00-98e3-ce95c68fd147", "value": "T143649E5352907C90FC259B728E2FCAE83E8EF2608F59375622685A2BC9711F2F573741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850394, "uuid": "60268835-a0bf-42ad-8577-bfa70decdacc", "value": "2374c2e3effb7cec5b64d024cc2c8613", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850394, "uuid": "385b2a37-99f3-4e3a-8e6a-ffb36f5e7121", "value": "3072:9IHaryMnopuJTC+0b/En+4eRZqRwYpUqGVsOu5Qe0YPotCMTicRdE8cBRMYqqEdN:eHamQXJ+Vb34LGkU9O5znPotdf0O6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687850394, "uuid": "94d92055-a723-47d7-bbe6-94e242d1ffdc", "value": 324096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687850394, "uuid": "be6d4488-4649-4ee7-a24b-0aba3ba06d46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687850394, "uuid": "31a4a42e-4a1c-4346-93fb-bc094ba7d8d0", "value": "563571409701890e53b761083c7808ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "706df776-14e0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1687866468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687866468, "uuid": "5e4bfc26-eb59-4129-ba58-5c7cb8337362", "comment": "Malware payload", "value": "60c479cae011b20ed4f751e8988c2f60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687866468, "uuid": "15176475-b1e5-495e-ba99-936abe69eeb1", "comment": "Malware payload", "value": "f8710776ed786f383027517c0dd8f4a8fc77e8c9b1661f244395b6f60c496ec6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687866468, "uuid": "cba09468-d33a-4225-9266-62ad5a6f56e5", "comment": "Malware payload", "value": "f59905b968fd7fa8ed6ea4984e44333ddd2e732f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687866468, "uuid": "2277347c-d6ad-494f-b919-6b9a7bb43a5b", "comment": "Malware payload", "value": "ff22b7c793195481ca716042a00ce6672b8b9de09070febb84c06c740f530cef37cc257a2d5364f389b90f3ee6464638", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687866468, "uuid": "0a5f526d-8f01-4ed0-9934-989b549e9a53", "value": "T10E351202BAD1C8B2D5731932483AB711697CB9701F24DE5FB7C44E6DEA31581A622FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687866468, "uuid": "4b81b8aa-71a0-4e9a-b570-0242d3317e5c", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687866468, "uuid": "f08c1f6f-2fc3-4fd8-a239-655dab113de9", "value": "24576:jNA3R5drX21GabXb0B3vggO7K7uPTeVKMitLpPIyb:O5GDbXb0B3vR6mcTeVKMA9rb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687866468, "uuid": "7e0d1375-a95e-41d3-b8ec-1dc22c048561", "value": 1071310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687866468, "uuid": "8c1ea933-ce65-4f83-a561-7b15121c1342", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687866468, "uuid": "35e58b20-3a7b-4055-b65d-e7422448128d", "value": "rurjgdol_sfx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc4a1be9-14fa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687877816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687877816, "uuid": "aa5c3a57-bc22-4d50-97a8-a75be8cd1f4a", "comment": "Malware payload (AgentTesla)", "value": "d117b29b2f18321820d3f67062fa7fa7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687877816, "uuid": "900e8f40-c08f-4eee-a437-5faeea133f23", "comment": "Malware payload (AgentTesla)", "value": "f896edc5afb483272da039b42c81f984aca6ddc0b342817f5a0be7f90ac42c01", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687877816, "uuid": "423695ad-429f-41be-bdce-5dd3e7df6d92", "comment": "Malware payload (AgentTesla)", "value": "9ea70fbdaec8645e38c56650dceded6eebc7150d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687877816, "uuid": "5b8b93af-f9d3-416e-9d92-3d547c030a77", "comment": "Malware payload (AgentTesla)", "value": "fd753f822ba05d6fa2629785e4f1c4c9b7ff3fb278471988256e8120b1c37783088454ffeaa878f173a6dc64a8a99d04", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687877816, "uuid": "99a10c9b-f2a1-4649-a7e9-49881f3aca7d", "value": "T171D423403EAA1F73DAD88AFA586539444BF9127B6502F7CD9CC022E269CF7900725F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687877816, "uuid": "3e130bee-cf1f-4127-a872-24f516393ccb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687877816, "uuid": "added254-3a10-4064-a474-2a791e10a4a1", "value": "12288:nEFW2jZ5/buQCDvLDgmOEP9HuudjEX+WgyNNy9+Oae70zoun0dnqPRZywtOtg:b2VdgoCOAE7NU9+w0acPRZBOtg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687877816, "uuid": "ae50587c-986e-4c95-a485-4a80cc6e1d0a", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687877816, "uuid": "f27dd3c2-2b93-4465-bb2a-e3736bc83d5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687877816, "uuid": "6b1673d9-de3d-47b7-8e25-67e49b934b35", "value": "SecuriteInfo.com.Win32.TrojanX-gen.17165.13298", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe7999fa-14ea-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687871001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687871001, "uuid": "ae86ee31-0c3e-46dd-b042-9475b8417b5b", "comment": "Malware payload (Formbook)", "value": "b8883e8c884ef4171b3f2f4566151690", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687871001, "uuid": "e23c2172-b771-4208-9247-9464e231627f", "comment": "Malware payload (Formbook)", "value": "f8f3b797579aed1c2c235e47ef2ec0c46836025f12cf15da5e4039900cba4771", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687871001, "uuid": "97c7b5b7-0b03-4622-ba57-e4966234e667", "comment": "Malware payload (Formbook)", "value": "fcfda158a12abdbea56af9b622bb670d4eba3d41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687871001, "uuid": "042bc59e-b2d1-49cc-9b5a-ca984003d6f0", "comment": "Malware payload (Formbook)", "value": "0b6f85472d4d80cb578aeeba71b2568fdbd9393bcd7913cf3d578d1c78b29898480bfe10c5f307fdc570f738a1ebc554", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687871001, "uuid": "a23eaf7f-5bf4-4da4-aaff-da6f1980e530", "value": "T1ABD423E490B1DC07DC7963B0A07A6D9F4B9EDCA688D2230713D0594AB937E429B5F336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687871001, "uuid": "5e354ea3-7e83-40c9-a9e5-51399b42a066", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687871001, "uuid": "1e72e43b-ac94-4216-921f-7c17beb65517", "value": "12288:ZYDEBUYYOyN7qp4R8OXQOHg/6tb6FwIrkLQ4BUFyG/qFTqzNJP:ZYDoY1NGSxgixIwU4BUIGiF2JJP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687871001, "uuid": "2c09345c-7422-4606-a21e-2f462dd2cfa4", "value": 640619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687871001, "uuid": "29b5092e-7a38-4b3b-afbb-a7cde6cbe391", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687871001, "uuid": "d10d37bc-64db-4c0b-9e53-d9399062c2d9", "value": "MARMEA - PROVISION (QUOTATION).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f05cca6c-14b9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1687849932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687849932, "uuid": "1dc8feb6-50eb-4d07-be2a-6da11ed26fb0", "comment": "Malware payload (Formbook)", "value": "1d132b7a35d336fc7b2aba2c52346f3f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687849932, "uuid": "a418b57d-2bab-42fe-8adf-3e8efc693c95", "comment": "Malware payload (Formbook)", "value": "fa50f197e39eb37efdbd83462dd11e3057e45f88d9acb8b7e99c50c44c1936b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687849932, "uuid": "2267ab92-8833-4e62-b971-01d0c3b22583", "comment": "Malware payload (Formbook)", "value": "a95122c3b1cd3298264c0545d119d7e83ca8d111", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687849932, "uuid": "5849ab4a-f4a1-4c63-abdc-7db3add03d1c", "comment": "Malware payload (Formbook)", "value": "584e0eb409f6e7c06d30474a6555e10dfb1f86c59ab58b7d1aefd6a423edf5ca352f2eaa8849bd6548f1686b96b01b80", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687849932, "uuid": "3076d8e6-8a46-43af-a53d-dd9ad3bf1652", "value": "T189D47A3C0CBD1A37E078D6B98FE48463F550947F39295A22A1CBCB556746EA328C723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687849932, "uuid": "f1f6dc03-1fd7-48c0-b81f-014baf82f288", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687849932, "uuid": "286fc672-d37b-4185-a1e0-d0c375b6052e", "value": "12288:UVpoPD6nPc839qzcD3SBW2/kBLpNtPimpdNj5py5hyXA:cpm0zDXZpL1pdnp4oQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687849932, "uuid": "6106b094-002f-4aed-bc1b-ce60915e6624", "value": 625152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687849932, "uuid": "678f48f9-e15f-4014-997e-687ccbe5f468", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687849932, "uuid": "f1de6ea7-db5e-49cc-9108-45793a0d3114", "value": "1d132b7a35d336fc7b2aba2c52346f3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d515e91c-14d6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687862342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862342, "uuid": "5886f88b-c3a7-4e9a-9482-d56426e51d82", "comment": "Malware payload (AgentTesla)", "value": "bb84543d4f239b89aa307e435f518363", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862342, "uuid": "330342fc-509d-422b-8b77-92cf069a62de", "comment": "Malware payload (AgentTesla)", "value": "fb2945c4344dbf6a9de214dcb4fcc52ab7b039b17b2ab924558eb08f8fd13c71", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862342, "uuid": "b943fc8e-0012-4b77-821e-616e1ddcc8a5", "comment": "Malware payload (AgentTesla)", "value": "fb856036b7283013a746d39d755b22046f6eb2bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687862342, "uuid": "ae1c6ff8-b67a-464e-af48-7f62a487d27e", "comment": "Malware payload (AgentTesla)", "value": "33f79d24b10c6a4a0cd527c50be8bc74205ee1174c56864ce8018bee559487641e84f6e41ae19728f79ab2a6af3a6924", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862342, "uuid": "6b0c2bd0-6e17-468c-8cf7-90a51a398b40", "value": "T16CD4593C08BE1A37C174DAB9CFE58463F450C43F39225A36A5DB8761475AEA265C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862342, "uuid": "fe0eeffb-d496-49f5-abb2-4057598851df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862342, "uuid": "655c9c30-71b9-4c2c-89b7-54f5ebdf728b", "value": "12288:ng2iNbE4oyCR/pN4N5T+2YBxjgpTil9erg8Jcgj/nodC8:ng1GDdRv4NxWeg05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687862342, "uuid": "71eebace-ff1d-4f3a-99d6-9485f229d214", "value": 608768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687862342, "uuid": "3ae5c90e-d783-4427-aee0-70d000ec626a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687862342, "uuid": "89f3c38a-60e9-4364-b979-45ed34001539", "value": "Bill of Landing_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4f76604-14b7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1687849027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687849027, "uuid": "f2f4c533-7e28-4742-99a6-968e8ffba27c", "comment": "Malware payload (RedLineStealer)", "value": "d3188a1b902874e070f59b6182fa9281", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687849027, "uuid": "d505afa9-30af-4f0d-9f07-834d80d15f4e", "comment": "Malware payload (RedLineStealer)", "value": "fbcba25bd85581fc264cc904e1e6cfccbe7dd66fb853b250f38ad0761d0ff1e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687849027, "uuid": "6676e6e5-86de-409b-a462-da4eb1ff974d", "comment": "Malware payload (RedLineStealer)", "value": "9b00592e499f9cc29d2118b44739f4acb5aea330", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687849027, "uuid": "9e493d95-37c7-456f-9605-1cc0536205c0", "comment": "Malware payload (RedLineStealer)", "value": "8bd6a3d6174542baf1e5b92f9a5723abaa6625da282a5bcfc9d2538ee0c34c63d520c8c3b2196522eb100b71324896ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687849027, "uuid": "17c66740-675b-41fb-86e3-0a0e2baed9bf", "value": "T19D35E1127E486452D2BBD935EA970404C5E8A82336F2C7677AAE32450FB3351D90DEFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687849027, "uuid": "533b20d4-2134-4f38-bfb3-d7413b320e16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687849027, "uuid": "7dd65af1-ca3b-47e2-a9b5-606906337e50", "value": "24576:M8qJDbHOClrXKbJDxpfJz2Ghb1f1Apr9exR6l2Waf:NOzKJDVhp6ELWaf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687849027, "uuid": "3cda4400-3c16-47d1-b70d-7bfe35738fb6", "value": 1122304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687849027, "uuid": "e75b92a9-1c13-47c7-bee7-3c4ea5e1da0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687849027, "uuid": "609c7b71-6159-488b-85d0-a62bd3079939", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e29dcee-148b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (XWorm)", "timestamp": 1687829796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687829796, "uuid": "6c76bac9-84a4-4731-b602-bd08c5502316", "comment": "Malware payload (XWorm)", "value": "f52191191ac8950f15e38483ca8927af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remoteaccess", "colour": "#3D8842", "exportable": true, "hide_tag": false }, { "name": "torjan", "colour": "#7D500C", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "xwormrat", "colour": "#16BCDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687829796, "uuid": "6548a2d7-54fd-46ce-86d3-a4eaed3fab59", "comment": "Malware payload (XWorm)", "value": "fedc35a1b93e0e18badb7900b6e4722a7656a65a75036e6a2e5010a393d648d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remoteaccess", "colour": "#3D8842", "exportable": true, "hide_tag": false }, { "name": "torjan", "colour": "#7D500C", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "xwormrat", "colour": "#16BCDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687829796, "uuid": "c29e289f-ba15-47a5-be73-f0f38f1ac2cc", "comment": "Malware payload (XWorm)", "value": "d051facee1918efca8df43fd8738d02b77c0bf57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remoteaccess", "colour": "#3D8842", "exportable": true, "hide_tag": false }, { "name": "torjan", "colour": "#7D500C", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "xwormrat", "colour": "#16BCDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687829796, "uuid": "bb72f22e-7654-4de1-acff-dedeea4e1748", "comment": "Malware payload (XWorm)", "value": "02f397967cce6b766992e800745bce1614154f6f29b6649e86ead54a8cc23d2a8ca41fae81cb1ca50bedf66d816c8b10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remoteaccess", "colour": "#3D8842", "exportable": true, "hide_tag": false }, { "name": "torjan", "colour": "#7D500C", "exportable": true, "hide_tag": false }, { "name": "Virus", "colour": "#FFCECF", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "xwormrat", "colour": "#16BCDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687829796, "uuid": "2de917c5-3245-4470-b424-d432e314642f", "value": "T1F875F1273E038D32E3C887B6C5FB6500ABA44DC57567E70A7E4626F4090372EA687D67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687829796, "uuid": "7861504c-9969-49dc-bc1e-886dbfba5fa0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687829796, "uuid": "6d71dff5-a095-43d0-a6c5-b63962d137aa", "value": "24576:3uWSIdFbt6tQwe4gU2bAw0zR9vAfVNZ+ycVlCS0Of3m2Bd3X3N:31mXr2stzRRA3Z+jbC5Of3zH3N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687829796, "uuid": "001a5523-015e-4879-a88c-bd11e1749615", "value": 1627136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687829796, "uuid": "f5310c9a-ac4f-4d91-a608-7dd33c713d0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687829796, "uuid": "3f7dc0ad-d51d-4081-886b-a2b1358041f0", "value": "WinRAR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f035b10-14c7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1687855567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1687855567, "uuid": "5b28687b-ca0b-4ac8-be99-4ad4d79a2e1f", "comment": "Malware payload (AgentTesla)", "value": "27cfd47b726f0f538e321f872c82d49a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1687855567, "uuid": "1f0181d0-0b6c-498a-b027-8df2f16732c1", "comment": "Malware payload (AgentTesla)", "value": "ff135357a87d1b5f8947dee12439f270b9c3e72693574ca052b114bef0015131", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1687855567, "uuid": "bc0c8cbe-9233-4e4f-9b6f-3691b7d83e8d", "comment": "Malware payload (AgentTesla)", "value": "224db504aafc5deffe1e03aa1721d2bded712342", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1687855567, "uuid": "f60ed058-52a0-44a6-b5aa-762155ffbea3", "comment": "Malware payload (AgentTesla)", "value": "883638fbd36096d08a6094c77bfe10317417e0f35061dd68e6efaf1c62ec401475fd98807b84700ca72f245b96822568", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1687855567, "uuid": "14b84ac1-a669-42d4-9bc6-578ee353131f", "value": "T108C42317B85C019FC76D8DBCF18122178AF9CE5460FBF7C89DE1B8B021587E2A642792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1687855567, "uuid": "19770a5b-3008-435a-a28d-481d7ce9422c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1687855567, "uuid": "c8123fab-cf32-4982-a543-f82b20097c25", "value": "12288:y12iN4ZRi48srHy99egbEHYFDOSS0t2kDAYugR3CLFK/97HnzvAcTTs:C12TrHm9xqSVEYuI3CLFS9PAKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1687855567, "uuid": "54753134-d31c-4ae6-a098-d84d2fd9153c", "value": 549376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1687855567, "uuid": "2782da08-f0d6-41a6-870d-b0db0052195a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1687855567, "uuid": "9f274b97-4d3e-4244-a00b-860e3db33f1e", "value": "Enclosed (SOA).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }