{ "Event": { "published": true, "date": "2023-10-22", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-10-22", "timestamp": 1698019381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "efdf5461-94d8-45a9-96f2-f71d2161e3c2", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f32c7fd7-70df-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697981765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981765, "uuid": "f11e67a3-07ec-4257-8982-219dfb7a16ad", "comment": "Malware payload", "value": "6963c0373505d53389f4bc7d543eb4bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981765, "uuid": "0e510d5f-f3a0-48a7-b06c-56f9d1f8e557", "comment": "Malware payload", "value": "006610ab8f7050d3f06fe5783757527b8cfd333cd4a8137e0741159c8e40537a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981765, "uuid": "0d147600-028b-453d-b57a-10fc1075e391", "comment": "Malware payload", "value": "4ab9478150593e50b78efa6d4b81435f862fbc4f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981765, "uuid": "7b43f101-3ce2-4934-93f5-acc8f5c472b7", "comment": "Malware payload", "value": "5585501db6fee39a010feb8029f3596ed53f27641d226310645e1ec9b5f5bb85b026ae7ef8d0c531a8f284a9e4b16c41", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697981765, "uuid": "fb57aecd-958f-44f3-b7ea-bebb9d06cf55", "value": "T14AF4E36415EEA00CB1A73FA367EA7BD98D6BFAB567AB504C34A1530B4712D80CF85730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697981765, "uuid": "df629818-1fc8-44bf-8abb-5406642dbb6c", "value": "3072:qsfPS/xsfnAxsf4sfQQzgXsfnRsf1QT2QK/pKa5TxNj53v:52fK2p5FNj5f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697981765, "uuid": "6260987a-a97a-4aa6-8493-2821426366b1", "value": 784920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697981765, "uuid": "63379f07-573a-4210-877c-ed32d8ed0a17", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697981765, "uuid": "6b1974c6-04f4-42bc-9462-1b30a2cdd199", "value": "1e326958051423811313a8652ac8ee12d2d186500be0a9a73be3abbb.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5860da6b-708b-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697945428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697945428, "uuid": "d2eb6550-c8cd-44a3-95dc-7025b5e8ce0e", "comment": "Malware payload (Formbook)", "value": "de2ea1b5ecf82a09aba1655c98e27807", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697945428, "uuid": "592db7fa-05dc-4612-871d-95e1dffc8a74", "comment": "Malware payload (Formbook)", "value": "01ecec7a028c6079ea479759bfe443ec97c9a5ff8b6fd02210c7e9bda28ae381", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697945428, "uuid": "eb90407e-6a99-4a9c-a972-1b0a7c313af3", "comment": "Malware payload (Formbook)", "value": "d0ea526df6ddf82baaf31cffda2ebd139289079b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697945428, "uuid": "a1399538-83d6-45fd-ae47-76008039cfd5", "comment": "Malware payload (Formbook)", "value": "d6469cec0848a08c8e7d45e463986e9e87cc14b2bf5c74118efbe610beb6f1a6c7389f890c87657ae639fae7015d3a63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697945428, "uuid": "cf56a93c-f6b6-46d9-9ba0-1dec21cbb118", "value": "T138752303B2F9C273DA7557B06CFA0383193A7CB564A58B272A98DC4D4E72C545C3972B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697945428, "uuid": "e9c79363-bfe1-474d-b100-caa73a8eb244", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697945428, "uuid": "288f62e0-d0fb-477e-b70a-9e78ea5a6b7d", "value": "24576:VyZxTJEu2ZR1lzFFq1xNuBjlv5WPJy7W8m8HN/inyOrbHhNiAR35:wZtJX2ZR1d61x0Rlv5qFAKnjHOAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697945428, "uuid": "63978c72-8fcb-4180-90a4-ca5bfaae53ba", "value": 1608704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697945428, "uuid": "1aeb7a08-7aa8-47b4-86e4-e82743ee312b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697945428, "uuid": "fa7e9071-570c-4dea-a3f4-bf4a314ecc6c", "value": "de2ea1b5ecf82a09aba1655c98e27807.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68aab88a-7094-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697949320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697949320, "uuid": "b0b7100c-73ab-41c0-b269-7de2e8e1631f", "comment": "Malware payload (LummaStealer)", "value": "732f36321975723a444866672e395221", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697949320, "uuid": "480776ff-f22a-4086-915d-fd21a8ac5daf", "comment": "Malware payload (LummaStealer)", "value": "02762425e97359c49a2b79dcfc83bc6d4862f212f3ad9af5d1bb4376bc9474e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697949320, "uuid": "fc202982-ee42-47f3-a230-47f8271a59e7", "comment": "Malware payload (LummaStealer)", "value": "2cd2760178a111e8327b8994e6cfbdf830425891", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697949320, "uuid": "eedbc753-f433-404f-89d5-135582c3850f", "comment": "Malware payload (LummaStealer)", "value": "131413a431e366e968ced76a5a0d8e1c8652fe82ddf4aea0cb61cb911f20721bd56220c49ecfab06160ad7fd0fa4984f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697949320, "uuid": "189f4ef9-77e4-415e-a444-5d9538f77128", "value": "T118652357A5F4A832D8BB2FB070FB5B5302317C638178112A6A51F85B14A39D5F9363E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697949320, "uuid": "2727879c-b06d-410d-a546-85d7b625f966", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697949320, "uuid": "c3643297-02d2-44e4-b9ce-edf3ab9c2919", "value": "24576:GyT1Zmd2PJNm+oiuDkAQauDSdrMnHTcGI1k7Uk+B4qBu3QD98xyqddqIH8Zy2VJ+:VTfo2PJkPiTtavSHTcLU+B4BQDaxtn61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697949320, "uuid": "fa29a7dc-ce3b-4643-80af-7573baef358f", "value": 1485312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697949320, "uuid": "bc030e25-b383-4fd5-a6bf-785e088755b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697949320, "uuid": "0ede70f3-0fe6-46e9-bd4a-0930f94d5a9f", "value": "732f36321975723a444866672e395221.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da2100e7-70ad-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697960248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960248, "uuid": "04dceb9d-ced1-4135-ac80-d71bf68f041f", "comment": "Malware payload (AgentTesla)", "value": "ee04bd3df8f1ccfaff6c07e7f01040ea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960248, "uuid": "ada151ef-441a-4787-9d59-b1d188584a55", "comment": "Malware payload (AgentTesla)", "value": "02a81f65ac8255add0150a5ebc1c6cd7df349b76ea4e9977b92c0062598aab70", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960248, "uuid": "b85338ae-6e5e-402c-9b07-7d1615223101", "comment": "Malware payload (AgentTesla)", "value": "0659b33d931cd6b4f2c47b345c76964c4b9bec72", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960248, "uuid": "2b8cc5c9-928d-435b-ac9d-75835e4a0b9b", "comment": "Malware payload (AgentTesla)", "value": "6f4665ebda5e09355a2931efefe6e5c4643d40ee53cc8cf8ad16b156ed1ac2b76dbb84cb4aac3f749de72a398065c654", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960248, "uuid": "e3bf4fcb-7d3a-43b1-a3c7-08613db1263e", "value": "T115E4224032218B57C6AC5BF74C3649A28BB05E466467DA9EBDE7359F0CF6BC80312B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960248, "uuid": "cbd87e52-0957-4a96-aab8-d55a5c2235ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960248, "uuid": "3c63f2de-c7c8-4fa4-9442-c10a138feed1", "value": "12288:58zS55mFzVy3HJZR/1JHy+5h1OeyUJtx33BI42Y7ETf3rp0vCW2y:5f55qJyXd1lOS13BILYQTv9BW2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697960248, "uuid": "1c36f9bf-3ede-47cf-89bc-664267c84d3a", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697960248, "uuid": "7b789d27-e7d0-4661-a65a-c1b89d179300", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960248, "uuid": "8565be99-72cc-4f60-aec8-a63b8d6f92a4", "value": "Swift output__688494949_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56290172-70b0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697961315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961315, "uuid": "606592a4-527a-4da3-a4f7-9a9294e3323f", "comment": "Malware payload (AgentTesla)", "value": "dddabc8019a7184055301927239a9438", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961315, "uuid": "8eec49b0-f223-4379-bfb8-eb56d84214d5", "comment": "Malware payload (AgentTesla)", "value": "02a837d139709853b2ab7c3f1c55802c880fd133b731cfb2a15830230c5babd2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961315, "uuid": "f50a4bbb-84a6-433f-934a-a2e050476ce0", "comment": "Malware payload (AgentTesla)", "value": "1d196f7a5ac96f5632c536017546001491ca1e46", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961315, "uuid": "bb246a28-e8ca-4495-806d-1c57e4da6fef", "comment": "Malware payload (AgentTesla)", "value": "e93ec2b811c760219fc986fe44fa3d6742ce83a83b8d0bca090177d509818f32348aa573ac06e1f2a9048dd1b03ab8b7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961315, "uuid": "25fe1e04-2164-4442-8a94-6ffbbcb81902", "value": "T112E423C482904CEDED8EBCFA0CDB667A4143C9E4748E964DBD67F8A1922B0B1B5D35D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961315, "uuid": "d550229f-da61-414d-a8cc-11b3a3a1a3fc", "value": "12288:oY5Iw/PgTNwXvJXUhah9ykWxzilIDmsn9NwhvrxAJn22MdTPEuENa1:o5MvJkYkkcWlkmk9ehzi22Md4uEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697961315, "uuid": "b09192e5-8dc1-4f63-b8dc-527d96248773", "value": 701696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697961315, "uuid": "b3bb7ad4-276e-4105-ba38-c3aa55d5a7c9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961315, "uuid": "408c0e94-4df0-4b04-aa61-5e67fe1ba76e", "value": "Payment List.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22240d79-7105-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1697997735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997735, "uuid": "4f03d639-9b86-45aa-8c52-3fca7e3e92a9", "comment": "Malware payload (DBatLoader)", "value": "4a3ea5a12db0696a98ca86670ff89c43", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997735, "uuid": "c808321c-5a04-430e-b29d-b7853f1a6fef", "comment": "Malware payload (DBatLoader)", "value": "0348b7181e838a339237fade5062e7670e6fdf2ccca4814ae7f97acec60cb8b2", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997735, "uuid": "f74d4b7e-89b3-4a3d-88b6-755747f5058a", "comment": "Malware payload (DBatLoader)", "value": "1655be110ec9158b45b611542acd47ba64610047", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997735, "uuid": "b0834bf1-115e-421d-8b95-629e66ced5c1", "comment": "Malware payload (DBatLoader)", "value": "22530666c6e26a967195c612da936b9ec69c30af31bc2cd1075e0968854db1ba579ceae818259e38c2450eb7559809af", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997735, "uuid": "3d405b3a-b645-4c54-8550-0204a6f4d562", "value": "T1C7355B72F985DC72E02689799CC9B95E165A72F06A4768EED29C7BD533B03703B4C083", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997735, "uuid": "084fcd99-d156-46d7-865a-43332e583615", "value": "cd0bc3eafbc3cc9f776d6c66674b72bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997735, "uuid": "f23e7ee7-368e-47a3-baaa-5388d0521089", "value": "24576:BnoM7x5Y77KKc2ON3txt+PAidyEyr1VW9:BtH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697997735, "uuid": "895f98a7-f037-4df7-8cb3-29f898f043e0", "value": 1128448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697997735, "uuid": "8879c63d-7f00-41dd-86c0-00eb0068974c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997735, "uuid": "8101c4bb-f930-49cd-8799-bc6a42be3427", "value": "PI and payment confirmed pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cfa2565-7103-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1697996975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697996975, "uuid": "53b635c1-31eb-4184-88e1-e45c6c61e7b8", "comment": "Malware payload (RemcosRAT)", "value": "50f36f7373fcac90cc8ce33b38d915f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697996975, "uuid": "dee359f8-09df-4514-a2b9-fc7e028af187", "comment": "Malware payload (RemcosRAT)", "value": "035f5ee40a4986872d3480fa5d5e96e4dd56c0d1b93cd77a82cadce3283243e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697996975, "uuid": "14feafd3-644f-4f34-ab44-7ac4bdbcea32", "comment": "Malware payload (RemcosRAT)", "value": "79d46385302aa0a6309f723871dc11e75a414355", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697996975, "uuid": "4827a9f0-29cc-41e7-b566-30fcb3a96bb9", "comment": "Malware payload (RemcosRAT)", "value": "888e2a0a4e4053b86899c07433de0f1a6951753b12fa20f2ecced235e571ebcf1b15be412c3dba221fe4cfa3bcbd73dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697996975, "uuid": "1b4367c7-4b1c-4928-a191-21c3fb627ccc", "value": "T180458C22FED19C32C8F3497C9F4BEF78AC1D39F1162454A96ED9294C4E313903EA9196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697996975, "uuid": "4e813281-709d-415a-9ff3-7af7d6bb1b91", "value": "4df0e13d93cb581937cac481e3c87c38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697996975, "uuid": "d92d40a4-971a-4f71-b62a-5b266d36b1f1", "value": "24576:qeA4Puy3YeOyFbcA3l0xdapY2bwplPYlEQZlo/:q5cZ3BmdaG26wE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697996975, "uuid": "1055e1e4-59e9-4ac5-9f17-fd03ab39605f", "value": 1262592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697996975, "uuid": "0a08fbfb-16aa-428f-9147-686044ff2002", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697996975, "uuid": "e12b223f-3891-4001-9954-c24ce20929a9", "value": "TGB0989000900090.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20b9bf94-7105-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1697997733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997733, "uuid": "942b615a-1db3-4fd2-9c43-4d08aceb5036", "comment": "Malware payload (DBatLoader)", "value": "96c836aaeff5db9eaf65fed67c60ea02", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997733, "uuid": "26e241a6-d949-410c-9c76-1243ca854020", "comment": "Malware payload (DBatLoader)", "value": "036c6898af5b3d4003e544deb66eb29bd5a83c43903aac4667eb77e42169a6c4", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997733, "uuid": "d6ad672d-dfbf-45fb-8302-e31aa6da9293", "comment": "Malware payload (DBatLoader)", "value": "25e18f7253c7d288b5b349e3c1ad5da3a0d137ad", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997733, "uuid": "b10a5687-1711-461b-9ca7-5d0af54614ba", "comment": "Malware payload (DBatLoader)", "value": "04bceb5289ebb4811e8eacc936df342d2fcd9b74b6cc0414e6bcc3e56e5585b23cf8dc76e2ea15488b792b2dcbda8738", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997733, "uuid": "ea493c69-3a49-4739-9190-4a75fd814852", "value": "T1C2452B4A7BADDC64E0A127BD8C9D0BE6B82D79C236F4CC9122653D4F09112D57DE80BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997733, "uuid": "beeb884f-56b7-463a-9781-4406511757f6", "value": "d020f949ba89411d7c49f3baa1ad9952", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997733, "uuid": "4219f49b-f3fb-45fc-bd2a-cb73ae7bb3ef", "value": "24576:E+x0KeaVl6fTAz/92jMRffknKdEf+17E+/:E+9zI81I+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697997733, "uuid": "2b22ad34-b780-4344-a534-468fcb5bdd31", "value": 1178624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697997733, "uuid": "ec77f3ac-9e24-444d-955b-6473c76e13d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997733, "uuid": "4e1986f2-76f2-4928-9e05-9bba74d2f8d6", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fd9f1a8-70f9-11ee-8907-42010a9c0042", "comment": "Malware payload (Adware.Generic)", "timestamp": 1697992792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992792, "uuid": "31368497-733c-484a-b24f-6fb4602a0e70", "comment": "Malware payload (Adware.Generic)", "value": "e7acc6d7e6960a484ea595cd04302c77", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992792, "uuid": "f96d18b7-97fa-4a16-a4b6-e7e06f72bfd0", "comment": "Malware payload (Adware.Generic)", "value": "04f8fcfa41dffec9821818a7b0a9e2eeaee60723320665b4eebc721b33182be0", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992792, "uuid": "21c99dbd-c9a7-469f-95e5-9cda7a842597", "comment": "Malware payload (Adware.Generic)", "value": "c9a012a478e3859f7b85728860b585adec98bbcd", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992792, "uuid": "6c93a468-5513-4322-bf27-278de13a6345", "comment": "Malware payload (Adware.Generic)", "value": "7a2b16c3c65b01e5b88fe08926d7f655d7fe5eccbe09e9b6fee9658851a8f483dc31979570d3fd19cc3b5a32f7a7b024", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992792, "uuid": "d234ea58-345b-4892-9437-f228d5441e95", "value": "T18CD47C217641C036F9FF05B589BDAA7D42BDB5610B6850CBF7CC0E6E4EA15E26B3120B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992792, "uuid": "271d8da1-641c-4a20-8ff7-76fd07571c82", "value": "447bc117cd5ca260be6dd0aba2d729e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992792, "uuid": "4a8d1c81-b11e-4504-9a4a-236510100a84", "value": "12288:03x8FhTVp7KNlJijn4E9LyORLr4YpTtFzglnFgUicemgoR:ukZv4ADRvlp7zgleRBmlR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697992792, "uuid": "8f95a4f7-0703-490a-87d5-0d26e62c53de", "value": 640336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697992792, "uuid": "de8d8d0c-aa6a-47d2-8e06-78d38bc6a2dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992792, "uuid": "794d6a98-0cd6-4e36-a5e1-280ecfddf538", "value": "SecuriteInfo.com.Trojan.GenericKD.69118404.1585.9937", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1417ac52-7110-11ee-8907-42010a9c0042", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1698002436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698002436, "uuid": "03ffc90c-69d2-483c-9447-45899ae48a2f", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "54653af9a150e18cbafede01825b269b", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698002436, "uuid": "5cae5369-fb07-4e70-bcc8-4dccf79a4974", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "0514395a778941a5876251dd3d81ab440011d4e8847755e68ebed2fb05ae7307", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698002436, "uuid": "23184a10-4fa8-4c73-be4c-acbda569f60e", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "d923abc1efc2623ffab48aa910101ee21e3cdb22", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698002436, "uuid": "18cd30a2-2d19-42ca-8816-e57b4adde23e", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "5ec95f21fe6b6ccade4b577581e26f2a1a8c1cb330f80d6ec5b0404ce079ff0ea9e6e3927ff46d87b649dd4d3f68c026", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698002436, "uuid": "daddecd7-43b7-44c3-86f5-8267f9d595b0", "value": "T17A8523E693F94023DE644B7108FA02C71B7BBC94957CC7463761A81E48A36D4E83E76B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698002436, "uuid": "d5e9b7a0-cf20-4107-9579-edbfcede40d1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698002436, "uuid": "294d2584-81ae-418e-8705-14f6936c2c74", "value": "24576:yydIrbu/YHX2v6ptVid2Esc2mWLDdsS7K54la77nCmK0Svr80TN0oiXyMhvjzWh:ZiqY32CptUXZ1YpK54U7zGDYeSBvjz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698002436, "uuid": "c4447f6c-43dc-4c00-b9b3-8b1e4b7538ee", "value": 1820672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698002436, "uuid": "246b9889-8010-4c27-829a-1931a45e93eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698002436, "uuid": "2f6418da-d442-4f05-bcba-494f312560d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c4e0462-70b0-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697961326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961326, "uuid": "fbe72c7c-b99f-4771-b3c7-763bdb205ab6", "comment": "Malware payload (RedLineStealer)", "value": "f85e6f3afdb64f7a3f6b97e66b1b10fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961326, "uuid": "7a93f8c2-e38c-4424-9df2-b8bd437f122f", "comment": "Malware payload (RedLineStealer)", "value": "053c6c9b402e47fd711912a7611490944a9408fce517cd402121705b1502ed1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961326, "uuid": "0c0139d7-79a3-47d4-8592-67a85c90be84", "comment": "Malware payload (RedLineStealer)", "value": "16a1a415491d97e74c2a720d895ddb44c3aa727d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961326, "uuid": "0a5e2f56-03a3-47c5-9d91-c5eb7edc79e0", "comment": "Malware payload (RedLineStealer)", "value": "043dd03f854942e31e1db99af1b95f2b2c4de4d750d79f844c1b2cc5d530bcd4320bcdf7f697391b1eb5c74bf3393784", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961326, "uuid": "32975956-22c1-43f4-9391-638751c6bf34", "value": "T14A652343E4D95173E976637169FB0287013ABC91087C431B3BD7A80A19B3EE568B27B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961326, "uuid": "4445b052-3765-4efb-801e-c8ddf0123c05", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961326, "uuid": "3d0c7307-1ac6-4652-8366-2842f7cc681a", "value": "24576:nyiNtO/TC6Vq90EHFx1o/A5H7h0JWT+mnk9p15n0U85xCes2bBfQ+hwGst:yiNM23BVsOHSWT+mnYp15n9qLs2No+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697961326, "uuid": "7690b4c8-ddfb-4a0c-b48a-20fa904703b6", "value": 1491968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697961326, "uuid": "ba5da004-690d-4ab4-8ded-9cb897209fea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961326, "uuid": "3f55f66f-5942-434f-8d5b-0e58195897f9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef7eeeb9-70af-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1697961143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961143, "uuid": "ecfabb38-9fb4-4c85-b641-f5a44ece78c8", "comment": "Malware payload (DBatLoader)", "value": "7d8f6dc02ffd90d67f80dd1e382b3c9f", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961143, "uuid": "7b81a50a-f433-42b0-b0e9-56e20004898d", "comment": "Malware payload (DBatLoader)", "value": "05916ba2b91c37d04c8e458225b754913b72c6b5dfccfa4914fa643eb9d07e95", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961143, "uuid": "36e76dbf-97ec-428d-9595-ffd7a1485705", "comment": "Malware payload (DBatLoader)", "value": "2742602eab33b8d0180d35e4b9f9bc669a0fafd0", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961143, "uuid": "ecaa0a9e-4335-463b-b6de-b2d150ea7ec7", "comment": "Malware payload (DBatLoader)", "value": "da78cf819fa864dceb8482cd6bb60884cf8bc98cfa69966e508ed2be59d36aaf0373348a21f72b803f10dbe786519414", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961143, "uuid": "fe9087d7-85aa-4b1e-ac8a-144d3e3b103f", "value": "T17E95E122B6F28433D2735638DDAB96E48D3BBF203E28659667FC5C4C6FB56803416187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961143, "uuid": "cac58576-ea93-45ba-9c61-9c20f560c0f0", "value": "4569aa626af1b80196dcb0b68adcc830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961143, "uuid": "693a2a0b-84a7-42db-802a-5bad49291453", "value": "24576:3Te9LrsMoZkD/VOP/6juQp6DjasufyJIZlnLxGgVzwmDi1ETNay76nBWWnmQqK0U:3Te9NLVfn513VzrunlxND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697961143, "uuid": "d521b73c-d1ca-4519-98f4-326bc46b15db", "value": 2039296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697961143, "uuid": "3ebe5624-c00e-4589-a02a-b88fdbc96792", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961143, "uuid": "8bd60a85-a1e8-4864-a14e-bce0e564ee31", "value": "7d8f6dc02ffd90d67f80dd1e382b3c9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98649ca9-7073-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697935227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697935227, "uuid": "a07c1c6b-ff1a-49dc-89a9-79434ed1a3e4", "comment": "Malware payload (LummaStealer)", "value": "0fa835e8daeee55e5b397b28dec3dd12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697935227, "uuid": "127677e3-a065-46a7-a160-eb3f8c0b009e", "comment": "Malware payload (LummaStealer)", "value": "06ae46d3c55d7e3ca1a1e1ee7689d9ea88350b16858322e34ed59a84f1285e50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697935227, "uuid": "49eaeb3a-57ee-4033-902b-862442c1b2de", "comment": "Malware payload (LummaStealer)", "value": "0871bac0327f63f7960d49419d4205c8f4621b55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697935227, "uuid": "d86fac05-7ada-4d95-b453-468f308bcd2c", "comment": "Malware payload (LummaStealer)", "value": "6b4d3ca1612bdad0a89bb5eba9691c34fdd0fc07a70f12e7b98772e693327901ed60e74e7e280628ca1a88c8289a56b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697935227, "uuid": "bdb03c7e-cb9c-4a1c-a034-2bfe033f7cce", "value": "T17F961221B781D526EAA211315A7DD75AA02CBC710F71A0CFA3E4671E2DF09C25732F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697935227, "uuid": "add95919-1a9a-4827-9680-caad1c22778e", "value": "413704d931dd90675c12a0afcdbdaa34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697935227, "uuid": "c37c481a-b84f-4951-b58f-53dae446c214", "value": "196608:7rvhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh9:7YVywfHZv7a5uCkGZtqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697935227, "uuid": "6871a485-ae57-4125-b1e9-591091b7cc81", "value": 9074392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697935227, "uuid": "d466a37a-3cb8-405b-9a39-e6a29d777f81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697935227, "uuid": "9ccf35ad-698c-4735-a84f-ef6ca5089d86", "value": "0FA835E8DAEEE55E5B397B28DEC3DD12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b4a0e9-70aa-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1697958944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958944, "uuid": "edfbb036-eecc-405f-8cdc-2d5a2de51e1f", "comment": "Malware payload (SnakeKeylogger)", "value": "2474d448f810e4090ba3daa707f372b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958944, "uuid": "b8ddd1f1-77c7-4f12-be0f-0cc78b0f6e27", "comment": "Malware payload (SnakeKeylogger)", "value": "072d45e35fb6403f20ba1d9f1df354a06bb9f32af28bb635140624f011af8ea9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958944, "uuid": "ffd45849-8036-4418-a0d3-33d3c935c025", "comment": "Malware payload (SnakeKeylogger)", "value": "f00c6da6aa976899b62ad4d4b2875ac14d4613f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958944, "uuid": "1c1afd5d-471b-4a41-9046-7109dbc533c0", "comment": "Malware payload (SnakeKeylogger)", "value": "150baf54a40d0bea745ac3788036091d7dcc28f58306b0d81e3eb0c822e6f00bfbff935c43f6f13a6513abf17dc4e295", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958944, "uuid": "29fe3d0d-2062-4c70-babf-438e9b40a334", "value": "T19CC4014233988537DB7A4FB89D621510A7F1AC391D12D2CBEE8921CE05CEB745A21BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958944, "uuid": "2ce3dc5a-f82e-4d73-9baa-e8cf090db876", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958944, "uuid": "d6d6ac2d-ffb4-425b-8b94-a3ba1c118e16", "value": "12288:QEkVRI7s9nw8W1P+axP3cwmP1MxsuUrRhBj8L6E0zqHRb:OVK7s9nDWLBcwmP1Mg3gD02HRb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697958944, "uuid": "6739f266-cac6-47a4-82b4-2f8969ef36f6", "value": 587776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697958944, "uuid": "c727ff38-b12b-473e-82ab-c6cc731b436a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958944, "uuid": "2a2f559c-7a65-431c-9b7c-d76ec426c604", "value": "swift.txt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47240410-70ae-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697960431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960431, "uuid": "cb98f498-d3ad-4fe0-957e-298cd1f6ae98", "comment": "Malware payload (AgentTesla)", "value": "0bcd514d7e2d45de7bb8dea8d717617f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gunzipped", "colour": "#3986AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960431, "uuid": "cff58eff-d2f3-4eca-8bcc-55f19b072c4d", "comment": "Malware payload (AgentTesla)", "value": "077017e5f92ab767447cc02a7017d126fc06e048811da11bb3956eac353e576a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gunzipped", "colour": "#3986AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960431, "uuid": "7ed29bdb-ee0b-429f-9cbc-627d23f87cba", "comment": "Malware payload (AgentTesla)", "value": "9e058117755853bce0e80f0e44c91d00bb733e94", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gunzipped", "colour": "#3986AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960431, "uuid": "72da8ea9-214c-4531-80a8-d387ecb473df", "comment": "Malware payload (AgentTesla)", "value": "bc21985b4ed8817f9261c44129574634a6fdd5eaa1020d7665349845bf51adafdf2d09fd77d371b3c9b2ff07c1b31f0d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gunzipped", "colour": "#3986AB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960431, "uuid": "3665608a-cdb0-4d83-92a6-e5d63da46832", "value": "T1BDE4124573F4A3B2C4B9577A505C424193FA719D1A33FB099CEC90AE6E63FD90602E8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960431, "uuid": "2f1cea37-9c07-4f48-9b58-7048722f30b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960431, "uuid": "966e205b-d0ca-47c0-9797-e217df9f9032", "value": "12288:h6vi1vjJGGna1FS3XXA9KgtIQoFUKiE+RWa9n/9HdavgF91NeyWDIrhz0EZGow11:Evi1LJ1na1isdfRKD+EaN/9HD1k9azzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697960431, "uuid": "71dbf187-b846-4668-a0b9-b3bc9b5f3a60", "value": 661504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697960431, "uuid": "5144ca89-03ff-4850-be6e-fde6bf277819", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960431, "uuid": "9a822250-ce1b-402f-a5ea-7d43c1e96caf", "value": "gunzipped", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "063de46e-70a8-11ee-8907-42010a9c0042", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1697957745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697957745, "uuid": "6463bdc0-7985-4209-8c4c-d80dbc9e2fc2", "comment": "Malware payload (Rhadamanthys)", "value": "064fb0d944bfcef43baafa542d16ed9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697957745, "uuid": "9b9f6617-d26d-450f-b1e2-3b9f59a2ad7a", "comment": "Malware payload (Rhadamanthys)", "value": "07e10579d53abef99996e7efead80890273436055229826fd1f58ee96993f46e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697957745, "uuid": "823b9c67-b2cd-49bd-b51a-c950ad8986cd", "comment": "Malware payload (Rhadamanthys)", "value": "e89047bb7c44da24b92b39d1ce542c17ff86c536", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697957745, "uuid": "d761d8a0-8855-4fc2-a07e-61262122988c", "comment": "Malware payload (Rhadamanthys)", "value": "4b35ff0f7e31add01ef88ae16cf11ba4b5c8effc0a8aa8cb2311ffd9d455ff2c3f3d2e8f89cbab4d3b69edacdd0ebef0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697957745, "uuid": "c6bc4adb-53c3-4afd-9bef-53b5b2429779", "value": "T12DF4AF2D6477C963E5774331A21076288EABFC900F59F3E71F995F8A99D17C18230A8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697957745, "uuid": "78bff382-fbff-4e04-b8cc-e21a83698cef", "value": "29c8b785823d6c11cf3aae5ebbb5f0e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697957745, "uuid": "fce8d0af-5b64-4b04-962f-99d4622c399e", "value": "12288:JJ8OkfMfnuis006jmR2I493Zx8gNOIyfO5XvEkVPNKIaq:JWOkfGnbscS85yfO5Jzaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697957745, "uuid": "bd1693b9-c4a8-44a8-b001-ebacf3cb9bec", "value": 740408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697957745, "uuid": "5f1ee803-2731-4330-aca3-9a1cd49794f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697957745, "uuid": "3015f224-8c43-4bb2-a50b-78d2e2304a25", "value": "INV#01034039.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2382db2-711e-11ee-8907-42010a9c0042", "comment": "Malware payload (CoinMiner)", "timestamp": 1698008795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698008795, "uuid": "10d1bc3b-2c19-420a-8168-766a507b7f29", "comment": "Malware payload (CoinMiner)", "value": "d28a7e811296c4b0bbd5ca0abbb35625", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698008795, "uuid": "fcec0643-b319-4242-bdd9-6b227210726c", "comment": "Malware payload (CoinMiner)", "value": "09cd440ae1c706df0019e1842c7f7d53498b4b4f9f269365e770a13d7cabd8d8", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698008795, "uuid": "4283006a-690d-4ada-8318-4b8a5a9e9ff5", "comment": "Malware payload (CoinMiner)", "value": "43b71ffeb514b4fd8b90aed706e097bee13d3389", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698008795, "uuid": "5a917c4b-2b75-4be9-abb0-27a00a39ec32", "comment": "Malware payload (CoinMiner)", "value": "249edc7d4d35c3309a3adce317d7a3ee53574c33b8bafdae67cbe5d677f71da5b39e72ba70c8bcc1f75793c9865b57c9", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698008795, "uuid": "ab78486d-ba03-4611-a5fd-6a1043adb4a9", "value": "T17504DF117690C032E1E759340970D6A12E3BBC72AB7640CF37A43A3E9E706D15B76BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698008795, "uuid": "ba3d8299-1a14-485e-9af2-c7f21619ca08", "value": "6ae03e1897875cb6ffee8a530dc88389", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698008795, "uuid": "8aeebd8d-3183-41a3-b664-88c4b7a3ad60", "value": "3072:kyBN6fvr6AFsSrGxC4aw0j7zaKRi0GNLKyHO/10J/xX:3i+AF/rGMUkOKRi0yXSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698008795, "uuid": "eba3cf1f-e5a6-485e-8756-3136079b0aa8", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698008795, "uuid": "73a4983f-a1cc-48c7-b367-37c32eaacf1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698008795, "uuid": "cb0d8b52-edae-40f3-a286-07490b636040", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1278ee7-70f9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697992794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992794, "uuid": "1c1a397d-0699-44e4-bece-fc3057487361", "comment": "Malware payload", "value": "418e36fcf74397105e3e12a78504bd3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992794, "uuid": "d8857f08-3855-4419-b6e2-734f04c530ca", "comment": "Malware payload", "value": "09d5b297d027f91ae12a383e959f981d4bc085fc31c65a738c818de55e47b213", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992794, "uuid": "113e3894-c236-4b04-9ff7-10df8d9c5a20", "comment": "Malware payload", "value": "a5aff0af0e17df6f6f7b4c25acde3d32e932f241", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992794, "uuid": "58fe0ddd-d81e-4d01-a3c2-76a2e96c0047", "comment": "Malware payload", "value": "a6d5bc908d59bff1b70383be53aad02e615988cae977ae90fa17dd19c62868dc14f010f030af3e2cceb17bb896c412de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992794, "uuid": "74e987b3-b209-4362-b61c-e7989eaebde2", "value": "T1E642E7013FF88219EABA99789D72470417B8F946DE32DE9D0CDAF84E3976B014690B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992794, "uuid": "9dcf8b40-f71f-41e3-b649-0414de815791", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992794, "uuid": "62334b58-aedc-4bd0-9594-b073966aead3", "value": "192:b8mfS+LO6VP7zbv3drsb3lGLxd8mcW6T4UmC1154iJ8CnLybty:PJbT2b3lGT8mfUn1OtQebt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697992794, "uuid": "20765768-2d58-4ace-8e7d-8f73589bc4f1", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697992794, "uuid": "1b600c2f-8186-4ac6-8117-248a6d405acb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992794, "uuid": "4c11d36a-8ba2-4d19-9743-515377ce7638", "value": "SecuriteInfo.com.Win32.KeyloggerX-gen.20370.1036", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd53cfac-70d3-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697976521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697976521, "uuid": "6dca02fb-c31d-49d1-8e18-4478a258bde0", "comment": "Malware payload", "value": "918c2febcc30f2cd3a0cbff9d953b1ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697976521, "uuid": "2ce75c9c-83cb-4693-872c-a2d71e31579c", "comment": "Malware payload", "value": "0ae1f1ca1eca6676a4cebfdaaf16b2f209b0f73f1ae4095b7ed1162f1ba1f715", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697976521, "uuid": "0971d305-8bad-4fb6-b37a-0f5d9c8d6b64", "comment": "Malware payload", "value": "427f1b9edc0e786fc6b5bfcc2255aa1c96c7904f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697976521, "uuid": "6098eda5-8c83-42f1-b408-0a4b1659472c", "comment": "Malware payload", "value": "7b18d99fd9cc2c1b41aaa2a8d5bc722c9f747c68d403f688b20bcd8706468ed225f96b9cb71f449701514bb857fb7863", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697976521, "uuid": "69de2fc1-ba6a-4600-a69e-03ce89d75edf", "value": "T124A5D74579011CEEDD6D01F2F3A2AB08EA00C4761F4C99AE26C7A3DAEF4D2DB554F582", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697976521, "uuid": "1e515e9d-a76d-448d-9af3-c6dd93c9a867", "value": "24576:quI+3OS/GcG2fj1QggOcTRU5Ha7EA/dS:qf+3tu+1dedUFMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697976521, "uuid": "011ffa25-0a76-40b1-8bd2-d8f842ff0a61", "value": 2153472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697976521, "uuid": "b89e474e-7cc6-4438-af42-61a6b40760b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697976521, "uuid": "c3f4ed74-7a27-42c5-b64c-8933d1c584f6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d6e7be0-7106-11ee-8907-42010a9c0042", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1697998345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998345, "uuid": "79c2e7c9-9ab6-4fb4-935c-cd30943ac165", "comment": "Malware payload (AveMariaRAT)", "value": "1b8a4a0d9091cb9c2044b91a6463737f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998345, "uuid": "a728191d-0e65-41bf-bc6e-e273fa482e58", "comment": "Malware payload (AveMariaRAT)", "value": "0b7db565af8cf9f8724af5af103ad52e11ecdc0bf9816689d64a65f45ecd78de", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998345, "uuid": "ce0451ae-4aed-4013-88dc-a17f3300ee32", "comment": "Malware payload (AveMariaRAT)", "value": "fe00894ee986260fab1e732a8d918a0d33734350", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998345, "uuid": "d58b747f-6961-4890-8066-9cd9ebce85c3", "comment": "Malware payload (AveMariaRAT)", "value": "547559ff605b067e2fe713dfde113b5046516f3b903c66f16305c668fe3d1630987daf4934007548b72a8c91b31997da", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998345, "uuid": "276ab233-8d44-48c7-b252-11feb22827db", "value": "T1DA231A312768D732C97D47FEF441611007B1E16A2116FB2B5FC2F4EB1A6BB849A60E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998345, "uuid": "5c50e554-7202-4fc1-ba4d-77b197a07167", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998345, "uuid": "fb5f4e76-7f50-4dba-8a39-608ac3e2292e", "value": "768:Xsm10ACgyq4IrhYkkkkkbetA6mdXYTCz92nSxbk66O0TWVAZjy:BupIrhYkkkkkb/6mdX1zMsie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697998345, "uuid": "e568ba6d-a803-4fbd-b88c-2efc2be78e8c", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697998345, "uuid": "39490d52-1d4e-49a8-9b3d-96da2cee9efe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998345, "uuid": "d0ddf847-38ab-48dd-a422-1a210dbdd46e", "value": "Invoices.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbfb6882-70ed-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1697987793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697987793, "uuid": "f9c0fcf9-6931-4a7e-a892-f962962bd104", "comment": "Malware payload (Stealc)", "value": "4e394b1a68dc5009383320218d1d9366", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697987793, "uuid": "5680cb43-4f0c-4641-8fb7-5ffea8468f57", "comment": "Malware payload (Stealc)", "value": "0d36b22f0a5a966b9f89c9fa9ad0e740e5c636560eafaf887e74d708f3f81bdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697987793, "uuid": "1b0039de-16f0-4e9c-b3b2-4c837af58904", "comment": "Malware payload (Stealc)", "value": "b7e27e16892424388ed7875c25aa33cc36194047", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697987793, "uuid": "bad10681-100a-4c51-a3a2-f2cb19e18106", "comment": "Malware payload (Stealc)", "value": "2152e80c602befc1e86cfb2821e75263ab9b952eb081c09fe5efbfda1e4179742cbe780066eb0cea8e3a4921b6e62d1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697987793, "uuid": "cf803b2f-7304-4f20-9b88-6b27f24b1ba8", "value": "T18944D022BAD08431E5A355350874C6661E3BBCB1AB7581CB37983E3D9E712E05F76B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697987793, "uuid": "23841279-eb67-40d9-9dbd-5aee43550c41", "value": "d2a54e4207f7fb1f334f58a667aa3417", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697987793, "uuid": "28162108-7060-4fc5-a940-827b4e3f9510", "value": "3072:xyBNUfBKxAtGdKP3IH9q6+JOkoo83SNLJTk56CKoeSUnvQX:seMAt6KP4Hb+JOkT8CNKHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697987793, "uuid": "7d9dd51b-0e53-4b70-abc8-1b62943b305e", "value": 260096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697987793, "uuid": "6a0b9d53-2069-4890-ae53-05b71878b912", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697987793, "uuid": "ede77c36-5ae7-4196-90fc-6926ad0bf696", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5397c28-70ab-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697959300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959300, "uuid": "37d2fa29-ce2f-4144-b600-774baf625518", "comment": "Malware payload (Formbook)", "value": "8abc0c0acb6d301fcca96b52d67832fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959300, "uuid": "bc236c27-b55c-4611-96e1-65cb9cea6dcb", "comment": "Malware payload (Formbook)", "value": "0d586804ddca6f238cc255491bdef2b71a2b1f378260f37745f547830fcd9695", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959300, "uuid": "7cf8bb02-f86d-40e2-beec-174c0e323ce4", "comment": "Malware payload (Formbook)", "value": "1220c8f6e318631edaf786ed4a087e010c18129f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959300, "uuid": "a3b089f2-5a77-498f-9dde-591ba0f56302", "comment": "Malware payload (Formbook)", "value": "0483e8462410fdca2d1f383238e215abf5c1caa5c36a6d42cbd907a5540b40f4f483dd7b1d68fa714da4888916f1bedd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959300, "uuid": "698ddf29-1772-48a6-872f-09a7dde59957", "value": "T111D412A97798F5AFC423C03689E02E619331747B972BD517644320AEC90E69B8F10BF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959300, "uuid": "6e8b7a98-cf9f-4b87-8909-7b8343f3d1e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959300, "uuid": "4b6ccf0c-28e9-4f39-bdf5-bbe30c8351e2", "value": "12288:9R/jqCs39nUdwmSG1q/2BMjqr19kC8HmG05qTt6Eg1V90lmZ:TLqzsdSYqfm9qTt6Eg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697959300, "uuid": "e4426895-9c33-485a-acb0-4a1e251dac72", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697959300, "uuid": "4e079317-1358-43e7-92b6-217d0f556e3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959300, "uuid": "d9d515c1-a0bc-47fd-afd6-2657938cb4dc", "value": "PO# PUR-ORD-2023-02758.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ca0ec17-7099-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697951421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697951421, "uuid": "8992161d-a17c-4a37-96ef-6d20e2bdcc4e", "comment": "Malware payload (RedLineStealer)", "value": "05014f6d1ef2d7bbe2fe4a68950b83a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697951421, "uuid": "9ce5e479-a1b9-49c8-9b53-5dda560c4cac", "comment": "Malware payload (RedLineStealer)", "value": "0e4dae7cf334b2e185aad7777953d608763d2577fc3cd9126019b2e29a5b900b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697951421, "uuid": "96de42f3-8818-412d-ae64-d39819064bff", "comment": "Malware payload (RedLineStealer)", "value": "32ca878a507487f2717e0d0049157448f6f90c49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697951421, "uuid": "0730525c-136a-404c-9593-85835912c5d3", "comment": "Malware payload (RedLineStealer)", "value": "e4ccde7c2e539e8d05b5f662953de41a954ea922590a06028825c919fc05ad53e801e3c8b712f7106f63b38c37d6f8fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697951421, "uuid": "e9cd7f7c-e40d-426d-bfe7-6928c0ebfb38", "value": "T19A652383B7D98073DEF21BB049F90BE307377C266C748615234AE9A50DB2EA4553772A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697951421, "uuid": "fc2dcb43-af75-41ce-82a7-bae6084c3aec", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697951421, "uuid": "df69226a-2e59-4781-a9d0-203a7c8c68a3", "value": "24576:3y/kCfXgkv6yp0TmYYyQfArnmcuCJ4ey6zr7HuDQ8V1gNi3HwgEFozBXN:C/5nSypImY4an1uCJFNz/HKPgNiXR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697951421, "uuid": "f24e730f-bf30-43d8-b95f-66d33bf588df", "value": 1475072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697951421, "uuid": "47e933b9-effd-4049-8b18-9ece9ab32396", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697951421, "uuid": "d3a0fdf6-c076-4d2d-9fe5-ae6514a7ef43", "value": "05014f6d1ef2d7bbe2fe4a68950b83a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "591d0185-70ae-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697960461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960461, "uuid": "1f2c694d-8655-4933-a863-f56afea2f457", "comment": "Malware payload (AgentTesla)", "value": "a5519d2d34ce8782aa980fa69f0d2f93", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960461, "uuid": "565b001a-e91d-4fb2-ad0e-4b75ba49765f", "comment": "Malware payload (AgentTesla)", "value": "0e738141435d85c326c49dba8cdc7bfdc990188d32f3447e797162bfaabb3301", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960461, "uuid": "ae49bd8e-ae54-41f6-9d2b-3cacf7bcbd87", "comment": "Malware payload (AgentTesla)", "value": "e1d781e4ba9c8bc14a163dadaaefacbd34ae997d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960461, "uuid": "e9569a51-22b4-43d5-99eb-ed8f9fcd995e", "comment": "Malware payload (AgentTesla)", "value": "a339ae2d8e9491d026f832f667efc22eec52547de8ce579ac5673e6ff3cdf938c5c89d2034a2ee869849519cd94d5e57", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960461, "uuid": "9eadf29d-fd75-4c22-8994-0a37bce6bdd1", "value": "T1AAD4220533E09367E0FA537594A5027543F6B59C2927E72E7EDC90B86E33B984A01E1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960461, "uuid": "d6d1bd02-dded-4dbe-a286-a6ac7a9dcbdf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960461, "uuid": "0adfe85d-d00b-4e88-8ebc-d5c67462c815", "value": "12288:GPd1vjJGGna1Ll2SFUGFlzE6dPAJRM6MDqVMSgQ9lLg9uydZzGjddgKm+HF1:GPd1LJ1na1LDFUmzErM6MmVVZlgjDGnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697960461, "uuid": "33edde6c-8d6d-42ac-a36c-08f41bcd886d", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697960461, "uuid": "226f034a-0074-4e94-9c1e-7882ccf1eccc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960461, "uuid": "35554551-9a7c-4046-b23a-f0012ed45b0b", "value": "Shipment Notification 7098216766.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eaaae04-710c-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698000763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698000763, "uuid": "3bcd26f5-ba12-4cd7-a0a8-eeb3fa83f8c5", "comment": "Malware payload (RedLineStealer)", "value": "f29f839c0a57856619346236bcbf36e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698000763, "uuid": "3b30db1e-2e24-4892-a673-1702e6b1d3fc", "comment": "Malware payload (RedLineStealer)", "value": "0e91e63f58ec9e8f4317130af799c195f5610c7c6304d9c6858e9dfc903c263b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698000763, "uuid": "b03961dd-822f-41eb-bd78-faba2fc92c36", "comment": "Malware payload (RedLineStealer)", "value": "fb0dca28d36f6f011f9f53b7da63ff9e7e08c306", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698000763, "uuid": "7c5d4e80-4df8-43a6-8991-320537aa054f", "comment": "Malware payload (RedLineStealer)", "value": "4eb1b3d6139d53ad33b54476f90d8ac02b248a1a9978a89ffbc833c2a30076726243da2aadc8ba193d368d5df8296756", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698000763, "uuid": "a8e0847c-2c84-41c8-a290-8ec96e389173", "value": "T120853381F7D084B3CD7507B1CCF952D7B6393EA18C3AC6873B89582B88B1998567172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698000763, "uuid": "ad7445a5-2ef0-4344-957d-4529e3b94459", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698000763, "uuid": "1f7ff474-b941-4cc2-a203-dd5b820b3f6f", "value": "49152:QAVbEKlAtkVaZmwzrrll0zOp4JUqg3HQO9z:JVbEKlAtkQzkzUqg3Hr9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698000763, "uuid": "b40969be-68c7-47d9-b7fe-bbffa05a106a", "value": 1824256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698000763, "uuid": "e43b601c-bb36-4011-a951-209bc8493190", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698000763, "uuid": "90758217-f512-4589-84ac-3ae5294a5b2b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb01b4b6-70aa-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697958934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958934, "uuid": "8a585025-24c3-4fbc-918a-14c5b81d19f4", "comment": "Malware payload (Formbook)", "value": "329d62d6721d26d80cbad1ea1bc0fabb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958934, "uuid": "ee537fa4-7dc4-4ca3-9390-f4a33a08874a", "comment": "Malware payload (Formbook)", "value": "0f6bd3f07adcb52e4e0a94d3fcc307b0780cdcd2e02ff3640474cd32303b898b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958934, "uuid": "6427edb6-272e-4f0e-a4fd-6df60b13260e", "comment": "Malware payload (Formbook)", "value": "8f5b7cd1fb8190b04c5075082d7d86628f93c664", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958934, "uuid": "a72e33e4-bea3-4970-b137-f5d31f16e786", "comment": "Malware payload (Formbook)", "value": "b780650354e6db42ae93fd41f28667f34fcee7eed7ea4e69f5e48d9e65e2df6deefb54799f3024572e2434ab863ae201", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958934, "uuid": "68f4ec2e-320f-4a5e-afea-84ee7d412452", "value": "T1BBD4010672AC9523DF764FB58EA22110E3F25C756A22D34FCEC422CB15DEB395520BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958934, "uuid": "bc9196b1-00cf-473a-becc-7903783948d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958934, "uuid": "f1f3d70f-3ce8-42ff-baca-b31a08cfceca", "value": "12288:cZ7s9IwQ2FBf6J0lJda/LGvgZ8l7gXipJ6l+8OAMtcjd:cZ7s9IlkfmXZ8KSzwTOAgcjd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697958934, "uuid": "abc541aa-2c5c-43c8-ab77-b96806c8eb74", "value": 650752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697958934, "uuid": "d5ca8268-edd2-4203-ac05-a95b212d0852", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958934, "uuid": "5b5541d6-8265-4130-be44-1bca71dafc24", "value": "Orden de compra.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86ecd868-7088-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697944217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697944217, "uuid": "6a2e1265-94cb-4b6c-b23a-f25cda438bae", "comment": "Malware payload (Formbook)", "value": "a6e173295bb398f9faa2a0d1e331eb72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697944217, "uuid": "3e83cca7-0027-4cc0-af29-d9c105af34ef", "comment": "Malware payload (Formbook)", "value": "0f99360dddca5382f0f94fa92f6dfca5a51873594b1f71405fd495386e20f348", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697944217, "uuid": "8892f765-1216-4542-a55b-324da82fea6f", "comment": "Malware payload (Formbook)", "value": "e8f3670ab4a18bf9002e4645ac4d094ce7600169", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697944217, "uuid": "9a15fafb-bb65-4961-a98d-bb605ea2fc92", "comment": "Malware payload (Formbook)", "value": "27e646019d26e528610ebc0554ccbbfb9ee3ff6c54021e320ee8ce2942c2ead0880207cfb29273311c7370669e5c1186", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697944217, "uuid": "cc9730cd-5f17-454b-bb8d-63b054c5dcb9", "value": "T1BA157D2138809136EEF320B787ECBA3582ADE0B0071915DF56D85BEED7606D17F32696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697944217, "uuid": "b5e715cf-122b-4b20-a6d0-9d22ab6badbd", "value": "440e77e14aa712e0e687ae6e10b63f30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697944217, "uuid": "434f3d7e-60f2-45a2-9d23-bc46b34951ef", "value": "24576:q7mtwk+VoLIY2wHHHHHHHHHHHmGVTorjmPPAy:qm+VoLIYnHHHHHHHHHHHlo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697944217, "uuid": "2443b27a-5cb1-4f8d-a515-3830a84ea594", "value": 938496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697944217, "uuid": "14f59c43-4677-490d-a89d-18f15428e4da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697944217, "uuid": "b5f8a101-d9eb-4d93-990d-e5d5e547e81c", "value": "a6e173295bb398f9faa2a0d1e331eb72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9e3cffe-70df-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697981749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981749, "uuid": "68fcfa43-d279-4d73-8f30-640290f12605", "comment": "Malware payload (RedLineStealer)", "value": "acd7409ef4b127d4aab0039ca0ab37bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981749, "uuid": "e75c62ca-d15a-4be8-ac8a-1fa66260ac02", "comment": "Malware payload (RedLineStealer)", "value": "0fd5baf99b8f234d833b4ada94e37cf7fdfe2f5e287d068132b5e96ce69212d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981749, "uuid": "e00392ec-bd44-4938-acc5-f48640bdea98", "comment": "Malware payload (RedLineStealer)", "value": "26db89dfe2be38e159466aa53c7c72f66dee28f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981749, "uuid": "86aaf858-cca4-4211-8e88-8195a2991277", "comment": "Malware payload (RedLineStealer)", "value": "b0aea8fe28bf61899eb0ab1ec2d24935a6fe01970a0352b8a15f7892c104191b906ca46c0eacf38528341d6835196421", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697981749, "uuid": "d230faee-9817-44c3-b523-605c68c7b5a2", "value": "T145652345E3E44033EEF767702CF513C30A36BE62296883EF0396E96A5971584A471B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697981749, "uuid": "895beae0-44ca-4615-827a-e623fd171702", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697981749, "uuid": "3cfd9da8-71a4-4e68-a230-980da7f0c221", "value": "24576:1ybXV0v4y2MVkygp5mkl8BDI1e5MuzIKchb5/JvUWMaMVgPQrNo7RSuFtPWZH6:QbXWxkjbl8BDcVusKcQaZIZo7IufWZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697981749, "uuid": "4a991dab-e5a9-458e-a044-8733c6699142", "value": 1538048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697981749, "uuid": "d8f72b39-6caf-4b6a-a51a-2450f3c53119", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697981749, "uuid": "bb1edd25-ed9f-490c-9204-c13af1ac68eb", "value": "acd7409ef4b127d4aab0039ca0ab37bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b4c4b5d-7113-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698003817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698003817, "uuid": "53a43246-711d-445a-a636-8a0ec5f98297", "comment": "Malware payload", "value": "946cb5acb42c5f01cd18c94d60833ef6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698003817, "uuid": "02879473-b2e5-4867-987b-298a94b5d3cd", "comment": "Malware payload", "value": "107605336ccd73cd2ab6d23317827847eff3af5962093d2f4b038f2dbf8e32f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698003817, "uuid": "32e9eb6c-7648-4b4f-ac8c-e6a7389e1503", "comment": "Malware payload", "value": "f591265335be87d73a4520d941456a873a0d0afb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698003817, "uuid": "b40efc68-4691-41f1-a0d4-e02c4733dde3", "comment": "Malware payload", "value": "da2dad4f5bbef47258e1475becb589a7c7a47fd5cf9ab083a09f6bae2e6aeec3692a356a220e7986e5b1569b0dcd29ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698003817, "uuid": "185265d6-5cf9-4579-ab35-cd0010228a5b", "value": "T120335A0271F1D032D46B52F9497AC789AB37BC116A76815737E4124F9F327D0AE3A32A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698003817, "uuid": "a175e4c3-dee0-4442-ae85-2c92749a190a", "value": "465deb4a611490f08d0e5994489155e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698003817, "uuid": "e15cc7cf-2c96-4cad-9b84-78fc6778d3e8", "value": "768:sNzmKcpgn6DltOIUATKCefAWPwQV+3rHEtzJch7yfMD:Ar6DovXAWPoQtdc9yfA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698003817, "uuid": "989befc6-afdf-4d58-82d9-1fac1f8ca7e6", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698003817, "uuid": "98fe5e8f-3e88-40ca-ad20-5dec18f45bc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698003817, "uuid": "ba2e33c7-693a-4b85-8123-1cd2e1a2f196", "value": "SecuriteInfo.com.FileRepMetagen.26819.20673", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f513cdc-707b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697938648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697938648, "uuid": "8cabad20-de07-46b2-9447-9ccb1602527b", "comment": "Malware payload", "value": "a8d2f6362b102dbad2b8b240b7fbe7d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697938648, "uuid": "64425edf-d6e2-4766-8f83-4a0b06e32cd1", "comment": "Malware payload", "value": "10c509006cf9328447712a70a0793952a1a6c6f3bdf994a482baa47e883f9e5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697938648, "uuid": "77ac35e9-2efa-4166-b660-ba29dfc1e33f", "comment": "Malware payload", "value": "91477c37c04bedb0d5d01ac863231ab322d16f44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697938648, "uuid": "c1f4dd5c-f6d6-4319-888b-930f1044fe3e", "comment": "Malware payload", "value": "109e542341fc75af6b04e47647b90bcf8bf31d578dab0ca65b893e5b1014256fc71044c8a27c6dda19b0d8e939559b7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697938648, "uuid": "d2a68ea2-6dfc-4e4e-aa3b-f7880568df54", "value": "T16EE73375EB51917FC33CDFBA61C4A215340908C079A3BB135A7F90AAE12570A8BBF275", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697938648, "uuid": "3bfdf8ea-3435-48ce-933c-664e4540b75f", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697938648, "uuid": "67676973-1ca6-43e1-939e-a3ec361c9b94", "value": "1572864:y4/4rzOchPar22d1YIfOocFSvEDtqJQZbXj9hCbB9MvqboaGR7:xkqcdar22dCUOco4JijEcqrO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697938648, "uuid": "f8606aa9-8318-4099-a67d-740abb3a1bd6", "value": 68748928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697938648, "uuid": "dd2f752e-f62e-4d85-a619-f0030ec6863a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697938648, "uuid": "819cd4b5-90f0-4b11-9473-2b82c29b45e8", "value": "SecuriteInfo.com.Trojan.Siggen21.47292.30874.29519", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c0d9b6-70f1-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697989282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697989282, "uuid": "c09f9527-4474-41b9-813e-af6b14a8d7e9", "comment": "Malware payload (RedLineStealer)", "value": "783a5507e00f7583528116d410d54903", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697989282, "uuid": "acb0b122-f1bf-4892-b556-6cb4b96b3baf", "comment": "Malware payload (RedLineStealer)", "value": "117332feb820bbd8d10177720dae9736c7f62dd2fcc5b9518eed427f90af6524", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697989282, "uuid": "b7fc83dc-777f-437c-984d-b5526a66b6d9", "comment": "Malware payload (RedLineStealer)", "value": "73784ceea302ad6e5d926e244bad5d3379fc1db2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697989282, "uuid": "c5cd540e-6fda-4c5e-b451-ad5e7afb2f9d", "comment": "Malware payload (RedLineStealer)", "value": "c0732d38391c4d9b7a6829ca8676cf4950344f7f80d915745cdbcae36fa048e2ae025d25271366f684801686b35b3225", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697989282, "uuid": "a8d25402-d20c-4494-b055-e5166f06979a", "value": "T194B45A51B0094F2AE3F2087CE6CA5DAE4D507EED6F530B8F36C14B816B967D1A93910B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697989282, "uuid": "f3b0605f-2afd-4418-8c65-319d2d089e31", "value": "d350427820086a321ccf21b695161218", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697989282, "uuid": "c20d6d45-6355-4d9f-9a67-5459127c0250", "value": "12288:88E8MN4QB2o97Hr62k3n/+pLsv9+eXUeF6e1L:BMN4QkAr62k3n/+pAv+enL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697989282, "uuid": "76ed9386-ca4b-486c-9f48-48ac8db9db92", "value": 507976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697989282, "uuid": "d52286c6-e9eb-4f9b-ac4d-42c850a4dc90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697989282, "uuid": "faba2d93-d401-4dd7-ad44-9ab073091a2f", "value": "SecuriteInfo.com.Trojan.PWS.RedLineNET.6.4539.8803", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47cf07b7-70fd-11ee-8907-42010a9c0042", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1697994362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697994362, "uuid": "f6368e4d-2a8e-43b5-85e1-ed2b747f7417", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "b71aa049b4baf84f49816500f66efb5d", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697994362, "uuid": "2c51b849-233e-4501-8c27-a11f3448f619", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "119dcb288bd720b1f2221d2321877c201247d282ae368bec323c752e899ef14a", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697994362, "uuid": "4d9f21b3-ecc7-45d5-99bf-536afcd7a57c", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "ea4cd19be6ce58a7a9fdc629946aba575519dec5", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697994362, "uuid": "9d64eb91-3436-4d5c-b713-c71a2cc6e680", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "39b2190827d43c62eeeac7924d927bdc91c96467a906b02dc093c305bb65093aedb51f1f520af233929adc83dd877f2a", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697994362, "uuid": "6543e992-10a0-4aa4-b3fa-e52539978a48", "value": "T12C049D5174C0C372FE67293605B1F7B15A3DE8300F949F9F6B970B764EA02C19A32A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697994362, "uuid": "547868f5-c2a7-41cf-93d5-b6d01189a43e", "value": "8c347d587a6b42414b9cc837958b02c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697994362, "uuid": "83acb171-e197-488d-827c-76dbcf2a681c", "value": "3072:iDQbaizKw/kal99mdVeiOEru0PIBZcqHyGUR0nLxnd:inK3l99cV4ExsypSLxnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697994362, "uuid": "e0c8ddfa-9c9a-40ea-9cb1-6a7c0ed1e0b5", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697994362, "uuid": "f7d7e428-0116-449e-8833-5f0386cb1bbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697994362, "uuid": "c8dc05f5-2781-4d66-9296-bdee5d004338", "value": "b71aa049b4baf84f49816500f66efb5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dca822ce-70ad-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697960252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960252, "uuid": "708efd16-ce5c-4366-8333-e5fb5e707936", "comment": "Malware payload (AgentTesla)", "value": "bdfb3896e0da4061a08cdffef0d1932d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960252, "uuid": "fe24d924-f23d-49fd-9e4b-98b375744698", "comment": "Malware payload (AgentTesla)", "value": "127b328917d5cba521215fb9f8e0d9fe9d062913d9371272f1bf1ac12d74aa05", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960252, "uuid": "4cf902a7-245a-439d-a1e5-9d6a56bbc233", "comment": "Malware payload (AgentTesla)", "value": "a962c2fed3116b300899453938ba9f5544d3cf86", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960252, "uuid": "6cf0be02-9ada-475d-887a-085d5e2eb3f4", "comment": "Malware payload (AgentTesla)", "value": "1f7478a0c1635cede881aa67aef4f5fa517b74744234e9c7ca3b2fe8197009963f854fbe51f4663a2782e8da30d1dded", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960252, "uuid": "fa7ccb0f-3148-4d32-a445-17399b102a0a", "value": "T149B41204327A9627D93D26F34D328A9547780D6A2552F78C3EA532DF0ABBF449321F87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960252, "uuid": "b3e8b587-53a1-49fa-88f5-a09f9f9f9654", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960252, "uuid": "ae183c3c-9886-493d-966b-03aee7460f47", "value": "12288:r8zS55mFzSzSzBbHQWpBZ8CCaNBfMbl9YlqcWU3h3lq:rf55qDHQ08woulqF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697960252, "uuid": "44aea615-4a27-4d4d-979f-a3bb674c3f0e", "value": 541696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697960252, "uuid": "6083c780-b538-431e-977b-575002971880", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960252, "uuid": "684df747-1f00-4570-b789-4f82a3a0b69e", "value": "MV ADAROSE - PRE-ARRIVAL DOCS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dcc209d-7103-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1697996976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697996976, "uuid": "f2885f45-a5c3-4acf-96c2-55d7ab229ec4", "comment": "Malware payload (DBatLoader)", "value": "c6cbad9226d0d2de8992c1bbc8da45d5", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gunzipped", "colour": "#3986AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697996976, "uuid": "96bab4ad-45cf-494f-a291-d892e46dfe0f", "comment": "Malware payload (DBatLoader)", "value": "129a9a2dbbd1c3f8c82b66d020ec59b82878ab94a30647902d80dbeb92f74878", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gunzipped", "colour": "#3986AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697996976, "uuid": "2da65e55-2dd1-4f97-b037-9b063cc87315", "comment": "Malware payload (DBatLoader)", "value": "263c3074b0484943d4289941684afb896ec5df66", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gunzipped", "colour": "#3986AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697996976, "uuid": "3afab56e-06d5-4108-8dfb-74f09327f5be", "comment": "Malware payload (DBatLoader)", "value": "6940031b0a349d6458ccbc3e2a197d029fe7ec58823ae9a1038c4ea4be0de7a59400e07ccb7079b0ff689e98d7d0a294", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gunzipped", "colour": "#3986AB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697996976, "uuid": "b8901c13-323d-400b-9000-c9d5cad469dc", "value": "T12A458C12BED19C32C4F3497CAF47EFF8A81E39F1192459A97ED8294C4E703513DA918A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697996976, "uuid": "eb9721e6-8bf4-4e14-aedc-7137476d3d0e", "value": "4df0e13d93cb581937cac481e3c87c38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697996976, "uuid": "9a289747-0fbd-4438-adbe-6e5e4f6d4333", "value": "24576:qeA4Puy3YeOyFbcA3l0xdapY2bwplPYlfQZlo/:q5cZ3BmdaG26LE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697996976, "uuid": "bd16c6b5-9c5c-4ccb-98ee-1f3b682ed561", "value": 1263104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697996976, "uuid": "2fdceffe-c825-4b46-8dee-28eee9a1d9b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697996976, "uuid": "60bf8d44-6e5e-462f-a53d-408e71e16876", "value": "gunzipped", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "400307d0-70be-11ee-8907-42010a9c0042", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1697967291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697967291, "uuid": "9ef960c9-e629-43d2-9fcc-b9c7b9970c43", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "91fcc906d24350286fc38d756bdacbfc", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697967291, "uuid": "1312d25e-7089-4b2b-8089-2c15078b5aa9", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "12a5b844e946f8c8b4b4bb3301664f7a662a1341ea9171359d1c4fc25bc11b6a", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697967291, "uuid": "3eb899d5-5420-4084-af0d-1541d8a86fdf", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "b96e73c04be4d15ed18e2e7811b951554cf57e7b", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697967291, "uuid": "95caac38-7108-4b53-ae5b-8a6923112585", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "c60f8f0c632b7d4ac135269e6d5c5329afa95d935be468f3ee9f22c6a5ecc7068125ab780078520b4c34d36e80905a34", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697967291, "uuid": "56a7156a-c55f-4316-9a13-51f6a05b09f3", "value": "T1637601B4BE5FD80A62F518A7D0CBF2F3D1465324BBAE760DA16CB7A8153B1B84B11D01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697967291, "uuid": "34f6c8c8-10d0-4667-8254-65abc0fa0ae6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697967291, "uuid": "5e268768-b3f8-4265-83bc-f5b380095d11", "value": "196608:tH/rieS1u4+zl+k7GJWhlTC7BUQ4qye9tkvQ2y3w3W9uWD:tDiFk4+zhLOBB4qT9tk6EW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697967291, "uuid": "f772d0ba-99e1-4300-8210-22e3aaf7c502", "value": 7693824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697967291, "uuid": "b0447d32-503b-47fc-8cd9-26996e11315f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697967291, "uuid": "8ffaacd0-5746-4987-a3d9-ec2721341e1a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee09643-7095-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697949894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697949894, "uuid": "f120bb43-8059-4f71-a73b-5ec05a0bae20", "comment": "Malware payload (RedLineStealer)", "value": "1732a22df6bfba4374bd4dc32d5d5c25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697949894, "uuid": "afd4651c-abfe-49f6-ab86-2d96ef6c469f", "comment": "Malware payload (RedLineStealer)", "value": "143a5bc4c9eb954f47c22cfa31257d906482709c20641333657e68c38479012f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697949894, "uuid": "fd0c3625-2d01-4939-9e6c-a0e92404b93c", "comment": "Malware payload (RedLineStealer)", "value": "8137d10786a2853f636e2d0f99a686fef5540663", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697949894, "uuid": "db537de1-08ba-4fb1-b153-fa6dcd4630aa", "comment": "Malware payload (RedLineStealer)", "value": "0c6234fa1894b1d8cf86f8a23b2bb9903db635b35cd7716aad40997c7611fc64d9a35d9f1c34faf66623b3a6132ad5fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697949894, "uuid": "74fce489-085b-4825-92a3-407c40f4b7dd", "value": "T1D8652367EAD48126DCF527709CF7234707357CE0DA789A262B05690E6C636C4BA3372B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697949894, "uuid": "2f49527d-c0bd-4ba0-b3f9-fc6561a8493c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697949894, "uuid": "2e8b3029-195b-4e22-8b0a-33dbcd92ff00", "value": "24576:syhnji68iJF6Nqqi1A/hKs+sw0wxFl2nOtA3oWkZVc/yyO1c8Ix:bhn2MVbmhs00PIiVVc/jOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697949894, "uuid": "f2285f9d-a0e2-40bc-9d84-fe54c1189ba5", "value": 1496064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697949894, "uuid": "342e4570-11a9-4b9c-86a2-4c7e82d52d2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697949894, "uuid": "4aa30c6b-2084-44c8-bdc3-7ed74cb28714", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d19731f4-707f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697940477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697940477, "uuid": "06c25af0-f72c-43d9-b8d5-9de70ee1495c", "comment": "Malware payload", "value": "15af9a80c1bd022cba280dff80ad2665", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697940477, "uuid": "6786c314-6b3a-4d77-b33a-de254ba04523", "comment": "Malware payload", "value": "163bfe0ede186459a3d2724aa061fb41eb7db8a2c10b0ccf24083a5d087a3a1c", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697940477, "uuid": "f1da6550-fa8a-44a5-8687-292375ce2f04", "comment": "Malware payload", "value": "a01f9e86ddaae45eea8ea56ddc480c2798368ea1", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697940477, "uuid": "2a2edbbc-8cbc-4a79-9c06-acd053a7d251", "comment": "Malware payload", "value": "5501116164a7e634a459712e704fedc69c74a1a9c1f355cc7cddf079206214c2afbada0129d16b231b8804e25c29a723", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697940477, "uuid": "2f7ed46a-2b0a-43ca-bdbd-d89cf218057b", "value": "T1A6F61283B7D8582DC07642B28C4E366566AB4D259A03AEC7390C3BEC29F3BD45F15BD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697940477, "uuid": "51107504-7d06-43c3-9b82-51f250619a18", "value": "393216:WldQDeN98SfCfFh+z16p4LLYT0QcD8GHBRaM0yPY:WldQrSfCfFhIoSLLY88Ip04Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697940477, "uuid": "91e416f5-388f-4d70-8728-fc4d0765f243", "value": 15541177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697940477, "uuid": "e2a485b1-b407-49c3-be94-7ca9187a8925", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697940477, "uuid": "2cb7881c-d758-43d6-8f53-1e7cac2267e6", "value": "tv-latest.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "503294a5-70ae-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697960446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960446, "uuid": "06c554d8-1697-4102-8104-3802937653f7", "comment": "Malware payload (AgentTesla)", "value": "70f020f6172e668aea52b99351b8529a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960446, "uuid": "64ef62fb-c9b8-4193-a2b7-cc8e43d73fdb", "comment": "Malware payload (AgentTesla)", "value": "164d54f565cb9285f383bd2bf702123d8db4f32262bac2ab6324ad1975920cb2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960446, "uuid": "585544cf-e5e3-4324-859b-82f83e18b51c", "comment": "Malware payload (AgentTesla)", "value": "c1304553a26f998d9eed7fbc7bed34dd2318e2b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960446, "uuid": "d81d24b3-780d-454d-b8c5-44c72b23c1c6", "comment": "Malware payload (AgentTesla)", "value": "b13658d589b9f0e9e66bef1de787a652396365d0027486ff438e22a54fc23bd1c7ab98a599cb0b2dc75dfe99368f1301", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960446, "uuid": "88474017-9bad-4bdd-98d5-b5b64ace925f", "value": "T131E4220C73F00B36E2BD87BA651C839053BA769A6236F60D6EAD74E63953F444701B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960446, "uuid": "bc50c7ef-20e2-478c-834b-127765b8e927", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960446, "uuid": "9903ac51-35b1-4429-8611-b7c8d1e7cdb3", "value": "12288:Mi3r1vjJGGna1zk3dJ892pF/iI9jR3nVIlFCKVafCkH8ljtfEiIP0/g6OfH1:V3r1LJ1na1gtkwNR3ylFCwaqkH8x5Ei2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697960446, "uuid": "2fef6921-81c9-4964-a21d-f98edb9df0e9", "value": 665600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697960446, "uuid": "da40e38d-0820-4710-9503-29caa772f268", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960446, "uuid": "1ef1ac05-d2f4-48fc-8de0-387152ff5e1a", "value": "Proof of payment TRF776328529233.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f0ab87-70dc-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697980377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697980377, "uuid": "5490c5fb-4d5d-4f21-b9a6-379d9915b118", "comment": "Malware payload (Amadey)", "value": "5cc2a9d1502bdbf9c62eafae60eef460", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697980377, "uuid": "f7a1fbcd-8f06-4845-b061-bdcf427d2c09", "comment": "Malware payload (Amadey)", "value": "168d1b0925ead8371fb8e587f5352d132bc453a727152ee67aa695dbd9d6b2a8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697980377, "uuid": "7d22bf43-1b8f-4976-bd1e-48861a34dd0d", "comment": "Malware payload (Amadey)", "value": "979cdddf6216ce41177758aec9affae484b6063b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697980377, "uuid": "91e09960-367a-4000-936f-28656502b435", "comment": "Malware payload (Amadey)", "value": "36788ed00837a29fe35a2067c6cd4aad4e943bd596b0822d0d2b191ee79323423cff718aa7742103d603aa45248f40a3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697980377, "uuid": "55b02c23-b463-4641-a475-868983ea9d8e", "value": "T17C852340F6E0E077D9E207718CFA53871A3A7CA38A7853776657E4AB0D73990A930727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697980377, "uuid": "0c75f134-5404-44d9-91b5-e57b49bb03f3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697980377, "uuid": "f86529aa-a1a5-4f53-a229-1c23707b889c", "value": "49152:kxr50YITFr/r+tb42w2MnOUv7lerBZGitjk8:y55Ikl427U5By", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697980377, "uuid": "32041b73-0c8f-441f-bed3-0ec760bb5abf", "value": 1843200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697980377, "uuid": "6e955427-3a43-47d4-954d-c954f4727bfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697980377, "uuid": "13a516a0-582d-496e-989b-d812deae1703", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b3b0adf-70ae-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697960438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960438, "uuid": "8937e505-21a1-4010-ba02-dec92016a894", "comment": "Malware payload (AgentTesla)", "value": "5eb6b0215c442e6ea11391e3bcd9d13d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960438, "uuid": "1b444642-5005-4b22-b372-f9894377353e", "comment": "Malware payload (AgentTesla)", "value": "16be12f7d98675fee56f1a7b36544ae013bf8aeb28a4a77d426ac77ecf8de2b0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960438, "uuid": "0ea9b352-7526-4a40-95dd-815169971e71", "comment": "Malware payload (AgentTesla)", "value": "2a426308ad4a95fc519f453f82dac8fde5588754", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960438, "uuid": "45791e05-4544-46c8-990a-56c9cb36710b", "comment": "Malware payload (AgentTesla)", "value": "519c1cbf3bd3a659329b4afc8c192a3f940954615b12e56180afda883d8a8a8ac86e2b229675efac5ae5f9213960aa76", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960438, "uuid": "fae0bcff-c003-4b5e-bd5e-7ba093b29f79", "value": "T10DE4124873F057B3D1B6877905B50360A3B91AADAD23FB5A6D9D11E97D23F840B02B0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960438, "uuid": "f0292363-9745-4768-aefd-4e6ac09039b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960438, "uuid": "22fb44d7-b9bb-4d15-a4a2-6ac018aeefbd", "value": "12288:/MV1vjJGGna1Riq2xFUsNJsBf9FrxyeW6Dr5nImQ107WaXfoLl0MN3xVCu7UyKtY:/MV1LJ1na1QxUsNaFu6tImQmZXfoLldx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697960438, "uuid": "fa785490-8f9c-4142-8f72-092ac23307d8", "value": 660480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697960438, "uuid": "6a113167-3954-4cb0-869a-76513d6e7e9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960438, "uuid": "472560b9-ec0a-4b02-98f5-c2d9520344d5", "value": "RE.RICE PRODUCTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf9e2572-70ab-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1697959372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959372, "uuid": "a8144745-b686-464c-9cea-80d1b5c15479", "comment": "Malware payload (SnakeKeylogger)", "value": "3c1ade1441ef11aed8496b742eab197b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Product 3", "colour": "#FE8372", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959372, "uuid": "5fef0b31-4260-443f-b3ff-e90435339653", "comment": "Malware payload (SnakeKeylogger)", "value": "16f9ece070a18550dedbb5e3bb6f256d79e9853b2d3e049dba379cba0ea4b738", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Product 3", "colour": "#FE8372", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959372, "uuid": "ca4ae27a-7f60-498b-9749-fe9be326f48c", "comment": "Malware payload (SnakeKeylogger)", "value": "06ebde82c367791c03196888fb2fcc7721296564", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Product 3", "colour": "#FE8372", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959372, "uuid": "03ed8310-f525-4fc3-8e50-600c03a23fbc", "comment": "Malware payload (SnakeKeylogger)", "value": "0cdff1498a561d621a31b89edf217fef2bf6be1c23d882be970cf9a11e5685603d061bc96f233095d35f01ff9a80f5fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Product 3", "colour": "#FE8372", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959372, "uuid": "847997bf-ccbe-439b-acba-fb1fc59b5983", "value": "T1D784F189929A8B80CD0E53B4E9265750463CBF3BD079E34C3EDAB4312BB32469546DF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959372, "uuid": "f25b78f4-84cd-42b0-b8c4-eb360703b7d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959372, "uuid": "b00a5f90-5379-41e6-ad51-bf0cad08073a", "value": "6144:L0nJBIKD2SJMz2dR8rZNlvzGSTo5xBB9VVh8YZWUBwDPlj3y4QTdk6ceh9X3P92D:sJfD2S+nRqx39Xh88VBIlzy4Qpk6ceXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697959372, "uuid": "dbb67164-6c44-4175-a5c8-8be68b1f2d87", "value": 375296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697959372, "uuid": "71efd26e-3263-496f-b096-cb85800fce83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959372, "uuid": "4790ea96-4dc5-49cb-9a9e-03820c838f80", "value": "Product 3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "457408c0-70ae-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697960428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960428, "uuid": "fc4af7fa-2af3-4b33-a0a1-73e98c306f47", "comment": "Malware payload (AgentTesla)", "value": "d82bce96450c53ce61d5639feda186bf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960428, "uuid": "556a429b-576c-410a-9627-788ef799ac21", "comment": "Malware payload (AgentTesla)", "value": "180063097b8813644078412341c479562c54e2a94b2b9a669813bccfeadc3f0c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960428, "uuid": "8435bbd6-5854-4c53-ade4-7efd3419db23", "comment": "Malware payload (AgentTesla)", "value": "469f3c336cd6d5d43f10a3f93d5e2890292e3276", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960428, "uuid": "750b0d2f-0fa9-4314-973c-a6c407b6cfe3", "comment": "Malware payload (AgentTesla)", "value": "ecbf76838a708d83b0818e109ffbc077e02cbcb809db7cf41b7ccf2aaaa864a083358db9e09d88df332966c00dff32d7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960428, "uuid": "dff097a9-96e1-466e-be17-903a789c29dd", "value": "T185E4234833F8973AC1B9437A61B19240C3B0A9557121FA0E9DECD5EA3AB7FC50512F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960428, "uuid": "c97d46da-0b32-4823-a750-1203adfa1a93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960428, "uuid": "8a061e22-91ac-425f-a4bd-ef34e3de8338", "value": "12288:piNq1vjJGGna1RycX/X8RCXFYZhCIspfJPOnhWsD4213ILJoEuBxIG8ezmpHq5c3:kNq1LJ1na1RfXf8cYaHZVm7U21mJunZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697960428, "uuid": "b7bafd03-e685-4633-9c9c-493f0cbc9b69", "value": 662016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697960428, "uuid": "6d068a02-68e4-4286-9228-892d60cf9f4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960428, "uuid": "0cfecb84-fa7b-4eaa-88ea-000a1b496d4e", "value": "PO854665956643.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d502df0b-70aa-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697958951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958951, "uuid": "86558b8c-3ae5-43e2-9463-6526b527e2ed", "comment": "Malware payload (AgentTesla)", "value": "1959eb177c68b8e74acfffff40382c89", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958951, "uuid": "96196def-896a-4056-8805-999b531cc7eb", "comment": "Malware payload (AgentTesla)", "value": "1903589a4b2f66ac3bc6e3d2a6244d886fe976d930fc5ab1ba15048c85241475", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958951, "uuid": "16ab676d-2098-4b3f-a181-f5e6a5e507dc", "comment": "Malware payload (AgentTesla)", "value": "e1b88a0e0a0af6a351af4e6e7f2a0fa11ef3055b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958951, "uuid": "367b98b6-1099-4851-a117-ea712a17cc9e", "comment": "Malware payload (AgentTesla)", "value": "736783d8356040caa7ef1587bbf812e1b663e6b15437c45349049f946e0201105c0334b3cab479789c42396f732e55e6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958951, "uuid": "fe84d351-9671-4503-b2fc-30358a5246f8", "value": "T1AFE4120271D44633CF760FB88DA2121157F2AE6A2C77D28BCD95B28A45DEB384235BD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958951, "uuid": "f3fe2b17-3cad-46e0-81f2-6ec758339640", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958951, "uuid": "9d6995a0-e361-413b-8a66-82452a266c4c", "value": "12288:euYI7s9swf+CLYJYNIl05wqp+UkbPK8WfA+QGXDqKVx46ya7J30ZXfm0aeenilTd:zYI7s9s2+CLCW5wqpgi8OVQGFxIAM+gJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697958951, "uuid": "442cb71f-7728-4b5f-88a7-ead03a546c67", "value": 709632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697958951, "uuid": "16a235e4-82ab-42a2-b083-67e46802fe4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958951, "uuid": "5beaad61-7602-4592-9dc0-050672b5c147", "value": "RE RFQ AQQ -T2190-CVE97,pdf.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52bbc4d4-70aa-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697958732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958732, "uuid": "77d313bf-003c-4a45-9888-3287672c1379", "comment": "Malware payload", "value": "cb104d58c3cc9294405ad8ad6f411245", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958732, "uuid": "bd8a6bb4-997a-4ac9-850e-3b4b2ed09f69", "comment": "Malware payload", "value": "19520cef71059be6b224133790e00a001861601d7eff692365e7240173236eac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958732, "uuid": "bdc603e1-adea-4e95-b3c7-852160ce2656", "comment": "Malware payload", "value": "5bf314f36eeafc3af67d4dfc9ade039cf12ec622", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958732, "uuid": "0541ad89-9da0-472a-8484-2b683dc9cd42", "comment": "Malware payload", "value": "43d85e4f2a862e29e70a152b2318d842cd600474321f9939eca22b43f36d01c670195f06069f6cc74797acdfcece4150", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958732, "uuid": "887a04de-b23e-4f59-bdc1-e2e4758afd47", "value": "T11E65A503BA5789A2C548173AC697CC360364D5816323F71B754EA36A1863FBA7B4DE0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958732, "uuid": "22f04beb-d3ce-4014-9a32-e8af7615c26b", "value": "24576:IAwd0udvx1t5DBSRFX8KovdCTrkM7r6Imc4Ro8gZavZ6mjVcDvTvwk:2dvx1t5N2NH6R3jVcDvTIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697958732, "uuid": "9fe391a6-b9b3-48d9-abb2-1f5f1aa3be23", "value": 1500160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697958732, "uuid": "6c4334c2-62da-4d0f-a00e-e56aaab78e7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958732, "uuid": "3f7181f5-f48b-469f-b2ea-de791005f93f", "value": "Cfgeg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "274cf5e4-7125-11ee-8907-42010a9c0042", "comment": "Malware payload (Tofsee)", "timestamp": 1698011488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698011488, "uuid": "2f1eeb6f-834b-4125-b403-78904f074f4d", "comment": "Malware payload (Tofsee)", "value": "652f00b6afd02c149a52a299ee2d2455", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698011488, "uuid": "8f977ba3-1844-4877-80dc-0d0e70e63bcc", "comment": "Malware payload (Tofsee)", "value": "1a9f34a4410437ddb1a2d8051099d92990751e9743b1b1a4d909fa0113da0e07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698011488, "uuid": "647b6f54-81a3-4589-901c-b86f379e19ef", "comment": "Malware payload (Tofsee)", "value": "dfc353413a54c37aeb1a190bdacae61c19e2e63d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698011488, "uuid": "f296b0f6-b10a-4a0e-b2f5-ba3bc5b19edb", "comment": "Malware payload (Tofsee)", "value": "8e246089fe396d8557f71aac455c015647d95d0de375af7a5853e3e418a890a28241e174b8afbdf38bbafc30ab425fbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698011488, "uuid": "08be85a2-b22d-4fb0-afd1-6b21975bd30d", "value": "T1C704CF217AD0D072E0A759351A70C6A21A3BBCB2AB7644CF37643E7E6E702E04B75753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698011488, "uuid": "7a101681-b7e3-46c9-9627-c689e1dbfb81", "value": "b4dff5a08e23018869237b48ff2d1876", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698011488, "uuid": "c7749401-ca05-47b2-bfd4-e8a3f46da015", "value": "3072:cyBNbfgueA8c9TnxCBqKbWQeev6sMODgeP9NUU7qQPoxdc30YbQBX:/uTA8oTnYMKbWQ35MOc6cUKdCz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698011488, "uuid": "e8aabef9-73ef-4585-b564-b59b240e44cb", "value": 183296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698011488, "uuid": "40005cad-717d-476b-ae97-6e9dc1da49e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698011488, "uuid": "ab47661a-3334-40e4-9ce2-5463c896e101", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f91aa512-70b0-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697961589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961589, "uuid": "27fb5fe5-5a99-43c3-8df0-5ab8f4290f39", "comment": "Malware payload (Formbook)", "value": "a46554cb25cbf644fed5cb198aaccbb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961589, "uuid": "a25b5105-5d95-48c2-ba51-cfa8322625ae", "comment": "Malware payload (Formbook)", "value": "1af4a1a93832576a896d1a2b24da5df2bd3ace8dbce78d1d4ecddc608df1ef71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961589, "uuid": "b2b3195b-9f58-4293-b92a-ca3586351c17", "comment": "Malware payload (Formbook)", "value": "21123f6058c2df025175211de8b024237ce9234a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961589, "uuid": "ca6c1742-fed9-4c3f-a1e7-14a0eedcb9c4", "comment": "Malware payload (Formbook)", "value": "f7f68bd754d101766d6b1e125e3041385309d621b4f03510b9dddde55fdfd15f8fac5dca0bcd0127de345c941b7ac720", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961589, "uuid": "cc46b822-1f16-4d03-8576-fcc3b5450ea8", "value": "T19D158D2138C19132EEF320B787ECBA2542ADE0B0071A15DF56D85BEED7606D17F32696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961589, "uuid": "2f7c525b-50a4-4702-b951-c2932f189539", "value": "440e77e14aa712e0e687ae6e10b63f30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961589, "uuid": "e1bf653b-0b3c-4138-a990-39c2d4b0c72f", "value": "24576:NUmtwAOC4b6HtHHHHHHHHHHHEsydhVrjeyQ:JOC4b6NHHHHHHHHHHHahP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697961589, "uuid": "6355a6ab-76ff-4672-8017-28ef3df07fc9", "value": 938496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697961589, "uuid": "4cf820c3-8d83-4de9-80ab-b25a1187b9d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961589, "uuid": "7ed32b7e-572d-4c13-9437-c42da92f124b", "value": "a46554cb25cbf644fed5cb198aaccbb0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48d086d3-70ae-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697960434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960434, "uuid": "bf8d571d-0055-4020-8a4c-db5f13faa17b", "comment": "Malware payload (AgentTesla)", "value": "c6287a7864c18abcb273e32e3188052d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960434, "uuid": "2ae8b2c1-3fc5-47a3-8fb7-69dde279eb46", "comment": "Malware payload (AgentTesla)", "value": "1aff1af8cc7bb8d570a97142992b71c34dc24bbe8ae39bbad5ac6dbe974067b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960434, "uuid": "c5b24518-fec3-4d53-870c-66d75a920b5b", "comment": "Malware payload (AgentTesla)", "value": "c3fed2aef4d98a26a989f9147ce284664a1347fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960434, "uuid": "48aee0ee-33b6-4a6a-9bae-a5f4b7ed9784", "comment": "Malware payload (AgentTesla)", "value": "7f197d55b0d5d280cfe675784dec3b9c5b4930340ff5ad0243cc8b38f5fce12f6aa2482b551d827d576820646d63d932", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960434, "uuid": "1520ea22-8c18-4a3f-adbd-7cb3f14e9f50", "value": "T138E4124563F8273AC1BE873A656463D01732295C2E33FB179EAC91DB2D67F648240E4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960434, "uuid": "34062b7b-6032-427a-a9fb-eee643ca3fc9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960434, "uuid": "d046469e-57ff-4648-9255-6563d9d45db3", "value": "12288:NfY1vjJGGna1OHU6HMQNKNJEa4KjB4BQDjDWfvUhvmNV01bstX8KsBo81:NfY1LJ1na1oU6vkZBtDWnYvoV01buuj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697960434, "uuid": "4360ea1c-ab0d-4a2e-94cb-8cb123819bde", "value": 660480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697960434, "uuid": "b094049d-f930-4973-8c6a-8b54f75f6df5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960434, "uuid": "3c0c5e8b-4cc6-46f1-87e6-e534f2bcd015", "value": "NBO20-0328.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dbab125-70d6-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697977515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977515, "uuid": "09af7089-a452-4d3a-9a92-9aa7b1a2ca52", "comment": "Malware payload (Mirai)", "value": "3b3a95161e1db55428873abffb91990c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977515, "uuid": "75f22e21-2088-48c3-9bb7-c9822f92daf0", "comment": "Malware payload (Mirai)", "value": "1c69804b793728bb416fe039c5e9ab0a59d763bfb55bcf9a8d63dace26f2c1f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977515, "uuid": "64c9d593-63cd-412c-8779-faff9ca2b757", "comment": "Malware payload (Mirai)", "value": "a6a0ff6b190fb213449786bedc2ace8d1ede34ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977515, "uuid": "9709e07d-845b-4b96-9d6f-2f1b2eee1f98", "comment": "Malware payload (Mirai)", "value": "d412f14db4e240b54aaa7d7586f6c4a939956fcbb7ad5cddda68f2ddca7b67eada55c9d30375b078c2723fc4b7e8b6c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697977515, "uuid": "6a66f653-2e3c-4ba6-be2d-f37915aec853", "value": "T12BC30872B804DF66F00A96B604E38B267E30BFA70E631562731B3966AD331D53857F49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697977515, "uuid": "21c353bb-365e-4ec0-8c2c-f1170e61eb57", "value": "3072:Jq70QH+OT5oiZ/NIJ8/yJpszQQO5KdDmC4ucEN3SyYuNb:JM09OT5dZ2gyJ0m5KdDmC4ucEN3SyYuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697977515, "uuid": "e78f1487-82b9-421c-8f88-54cf6153a32a", "value": 129864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697977515, "uuid": "ffcb566d-ee23-44fa-bc6e-cd8784c1c893", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697977515, "uuid": "71b40aa4-7dcf-4e03-b22b-4bee5ff1bdd6", "value": "3b3a95161e1db55428873abffb91990c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e11951c5-70a5-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697956824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697956824, "uuid": "8f5d128e-a770-4fe8-bea8-045dd777c205", "comment": "Malware payload (Formbook)", "value": "9fb83ad6d8c549b8067f68dbe5a4f8a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697956824, "uuid": "532ebe33-2586-4a5e-8f06-db0ebce654e0", "comment": "Malware payload (Formbook)", "value": "1d6df5e2a42f4a61b60cf45a65897cdb1fe9b81958cb46d56157f58f574f959e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697956824, "uuid": "87e3d637-096e-4b5c-998b-6dc8236f8c2a", "comment": "Malware payload (Formbook)", "value": "1c9da67bf16b6ac6a7b23623de45f3b8b33a39d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697956824, "uuid": "765daf38-09f1-4a55-aee2-d2e3044b60d3", "comment": "Malware payload (Formbook)", "value": "25572646e2394aadfc71b20b148aa42759ffc66dab9e3105a40238a9c03762ddf2d5adebe52cde6272e01b75d6a640bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697956824, "uuid": "25031c54-27c8-4210-ac68-a40c19323aa9", "value": "T121157C2138809132EEF320B787ECBA2642ADE0B0071955DF56D85BEFD7606D17F32696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697956824, "uuid": "e96185d6-d188-4c12-82f2-918e14a52397", "value": "440e77e14aa712e0e687ae6e10b63f30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697956824, "uuid": "c8aabd8c-bd23-458a-900b-a7a3647acc34", "value": "24576:FjmtwAOC4b6XFHHHHHHHHHHHEsy9pVrl2uN:cOC4b61HHHHHHHHHHHapj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697956824, "uuid": "9e567cca-a2aa-4433-8a1a-06eebd08cc78", "value": 938496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697956824, "uuid": "62af257b-75a3-4141-a573-3cbc51a02b94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697956824, "uuid": "7d16956e-efb7-47e5-afdd-9e7c67c0feac", "value": "9fb83ad6d8c549b8067f68dbe5a4f8a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4a183d8-70ab-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1697959353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959353, "uuid": "3ed9d4cf-1bad-4df7-9e55-e523312f195e", "comment": "Malware payload (SnakeKeylogger)", "value": "b4d7f22c8fa0d77d4ca4aa60e381a0f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959353, "uuid": "a5a327bc-09da-4e6e-aac3-865007c39c73", "comment": "Malware payload (SnakeKeylogger)", "value": "1e5aaff948f19f643319f41f91ce20c6b3e3ceca9084334b7910294bceff46b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959353, "uuid": "6a4f0cbd-5d45-4320-b09e-e436c9816990", "comment": "Malware payload (SnakeKeylogger)", "value": "f6af8b30e8e979fd2c246e65f78b59c0eb04e36c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959353, "uuid": "b5352a65-8372-4a5f-9c93-b24ac269f0eb", "comment": "Malware payload (SnakeKeylogger)", "value": "e21748c318b4a6d3d3dd1c33ce1d421a873b2e3626a55e3fcaee15b714d04352c75dc158b9ff95cfecfd383302776ba6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959353, "uuid": "fbb67370-58a0-4d11-8eac-21ce65ea2634", "value": "T177D4CE9C3550B5DFC817C876CAA82C74AA617C7A531BD203A05336ADDA1DAABCF015F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959353, "uuid": "947e06fb-9fe1-46a5-844a-ed83b276986d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959353, "uuid": "03c10e2a-52b6-472b-87f7-cff243d27de3", "value": "12288:hCUeIBMSjOwO7mdVr30Pps3m2h8k678G5gCzku7nbIyq1XPDV1dO8Hb3EJ:FowEaVrEBsJh8v80Uuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697959353, "uuid": "2f60381f-a630-42ab-9a41-73e55b2d28d9", "value": 637440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697959353, "uuid": "186e56a2-302f-4309-84df-3b4df656c834", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959353, "uuid": "89f52282-34b2-483a-b817-3462ca24fb51", "value": "b4d7f22c8fa0d77d4ca4aa60e381a0f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffb5568d-7105-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697998107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998107, "uuid": "c6f7d9ee-fa81-4467-a77d-5048b24970bf", "comment": "Malware payload (Smoke Loader)", "value": "1830f98caaa5789acb8724d9d0048fba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998107, "uuid": "6f47fe90-86a3-4878-b130-530caa43a98b", "comment": "Malware payload (Smoke Loader)", "value": "1e7b75740cee8241e5f4983fb065892d622083cdf52031f740ce4ccec8828f89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998107, "uuid": "79a5381d-0b2e-49ac-9347-2ba89be8cf14", "comment": "Malware payload (Smoke Loader)", "value": "daf70e7f1449b1c781621762f37bb8fc653f4c11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998107, "uuid": "8b44c6e1-b583-45be-a3d6-56165533eeab", "comment": "Malware payload (Smoke Loader)", "value": "4f40ed77f8c485ff5d0cedb3e42ea9547af6b0921c902b66bda87df2191430a51e07adc15ae70f387edde091a882538f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998107, "uuid": "8d4b4282-2c5b-4212-9bbc-867a06006a2e", "value": "T1BD65233793C98071DCB107F0BDF626830E397C80DAA8D71672D6A2985F73A81657A367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998107, "uuid": "2eb561c9-52ef-45a5-b7ff-d02499f1a5d5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998107, "uuid": "17e85794-e0b9-4f9d-8cd6-af8d1a9ed73a", "value": "24576:8yukVdR/iu95RaJxFdL6sAUYyZMA2R/RikVp7U35JgYnrQEq4VGyIlrJ0HRN3d:ruGX6uvRoFwUYyZT2/ikVp76h9G9lMN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697998107, "uuid": "043f80d7-5f9a-47dc-b9f1-4827c6978f84", "value": 1511424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697998107, "uuid": "fe5bd01d-a0b8-4aa2-9e22-520a54ee8b49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998107, "uuid": "398e6539-e7ec-4a17-a55e-ff3c81d590db", "value": "1830f98caaa5789acb8724d9d0048fba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1a2d0ef-70a0-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697954650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697954650, "uuid": "8b22fe5e-dc92-4427-8202-06db62c56598", "comment": "Malware payload (Mirai)", "value": "e0e5b19265d3aaf5b94a1b35bb97b698", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697954650, "uuid": "d5122fef-37db-464d-b31d-ae006c2bf490", "comment": "Malware payload (Mirai)", "value": "1ef843145ab345057d22a1f2de088aa5b5725239598aa28d20dab1f6ab5997bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697954650, "uuid": "155ab41a-221d-48be-b3d7-af0f89d12992", "comment": "Malware payload (Mirai)", "value": "a3c85f14b221a92a38fe89473fd4ffa9356d34b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697954650, "uuid": "8b37a8e5-4153-414a-a80b-b483fa252f13", "comment": "Malware payload (Mirai)", "value": "ec378d1a8fcde2359d93be52de75470317c342c01a09092f8699eef5982dc7e0ade2c1f50bf486db36781e8805c53915", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697954650, "uuid": "8072007c-24bf-4363-ac5d-2f3e69b79444", "value": "T19BD2E12CD95DB905CA9E3DBD50CF4AB9384C70C0935DBA8F17668448B61BA9BEC071F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697954650, "uuid": "f765132a-5ebf-497f-a300-3d2a0bde9154", "value": "768:k1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNmK0pfJbUWUI:kbDs06t4BEub4sU/MbUBsYI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697954650, "uuid": "5de72ea0-9012-456f-b258-979fa79fe1cb", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697954650, "uuid": "a608be3e-d5c6-4717-bb2a-b1c37a923528", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697954650, "uuid": "d436f0cb-3bec-4909-88a2-46d970e4b9e9", "value": "e0e5b19265d3aaf5b94a1b35bb97b698", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c2c2f38-70aa-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1697958748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958748, "uuid": "aa0acab1-199f-467d-a87f-03c5e4baba58", "comment": "Malware payload (SnakeKeylogger)", "value": "2ee598718ade0429bcbadd58e216cc09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958748, "uuid": "ddc2fcac-5afb-47e3-8c59-cd26acd6b10c", "comment": "Malware payload (SnakeKeylogger)", "value": "1f0a70d21e0d65393b50b64e59c1c3e38e2215338401419ec885c67b46b2b934", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958748, "uuid": "848ac34a-ee4f-4d82-a494-6ccb5b190520", "comment": "Malware payload (SnakeKeylogger)", "value": "8b0830385d96045449dcdfb5dfcf20fb911f77fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958748, "uuid": "aaa7979b-00aa-40a8-9ce1-65885b68472a", "comment": "Malware payload (SnakeKeylogger)", "value": "2bb237bbff0505c1ed3aabd16be9f8dbb02579648b8772b391501419572a450aa95fee2e6d9439fc5584f1d2be529904", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958748, "uuid": "90cc10bf-18e1-4165-ad36-aa067cc6cfaa", "value": "T182E42311B68A4AB5C4798FBBA0B773A11332B91B1D58DB5C6CA471CA5C57F20CB4EB03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958748, "uuid": "68ad6237-3018-4c2a-9c1c-095e93be45d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958748, "uuid": "0a90512a-7795-4952-ac18-867356c9bf12", "value": "12288:BpmNumB0apppHqHwLcYvq0j+QhfkPev+202lcpncPu+qtGybK2DFp:bty3DHMFn0j+QhIMDVu+fybK6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697958748, "uuid": "ecd87e50-635b-4fb9-b48b-ab0fae28b5d2", "value": 672768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697958748, "uuid": "1c1c174f-434c-41e9-9a26-2c48e92da5c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958748, "uuid": "498d266e-3a41-4430-8d9d-794cb3192b0f", "value": "2ee598718ade0429bcbadd58e216cc09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a61c30a-70b0-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697961188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961188, "uuid": "50929704-c919-41ae-8f9d-287386d0d172", "comment": "Malware payload (Formbook)", "value": "71368866925c23e35d340705fae95002", "object_relation": "md5", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961188, "uuid": "a71b1511-c9ea-46d1-8b41-b0d246dba589", "comment": "Malware payload (Formbook)", "value": "1f30b513d1315b7a9432f9cf2937d5c4728455fbd7c681a552b94f57a849757c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961188, "uuid": "3d47e234-570c-4169-b508-f79b3383da8e", "comment": "Malware payload (Formbook)", "value": "8b2e76a61f33f053eb4fc2f2bc3600917e7d1d09", "object_relation": "sha1", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961188, "uuid": "118ce684-7998-49a0-98d2-13a9cfed858e", "comment": "Malware payload (Formbook)", "value": "672307163aa56840142d30ad498e6c6df5392f2c94248c759ac52e2d0a335a80679bf425b3e0804415290181b8f36444", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2018-0802", "colour": "#AB286D", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961188, "uuid": "203ffb8c-e93c-4ee9-8801-d23f2f7379da", "value": "T19D65E00BE9008F87D01C43F46DB33A990B1ABE15ABD12ACB11597B4B3E317A11DDB6D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961188, "uuid": "0bc607c4-f323-40d3-bf5b-17eaa2cec7a1", "value": "24576:cWQmmav30xrmZy3w6VA3bVNRFZyVw6VC3bVG4nvsLtbtecTQ5WWkK3q/0wkex:xQmmQ309wP6VA3bVDN6VC3bV25tBTTKg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697961188, "uuid": "9b4bd99e-e6eb-4fe2-9f68-7e31b11db058", "value": 1543680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697961188, "uuid": "782377c3-35e3-4533-a1c6-226cd2e58f48", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961188, "uuid": "ad1f8d76-604d-4e87-95d5-af81c20fcd67", "value": "PO43P00416.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3461db52-70f0-11ee-8907-42010a9c0042", "comment": "Malware payload (Tofsee)", "timestamp": 1697988746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697988746, "uuid": "e0a317f2-c330-4023-aba6-047f6be7d80d", "comment": "Malware payload (Tofsee)", "value": "400d83c136d4003e1137471d3900f267", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697988746, "uuid": "e2a830d4-37a8-4be2-b977-816f997765bf", "comment": "Malware payload (Tofsee)", "value": "206ca3f88f29ee80ca16649e17efcce1ee750c45ce1a6762f96f6d6d049993e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697988746, "uuid": "6e538875-db97-4ee1-93e5-9cc67598a357", "comment": "Malware payload (Tofsee)", "value": "c26b5043bea1c3176d9d605b782010542ef7d26e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697988746, "uuid": "7be740dd-ce68-4b9a-9208-2a12a7647939", "comment": "Malware payload (Tofsee)", "value": "8e1e114677da80629b390c186f3f5ce39cfe1293ec21b15e24155a835481e650fb5b57a3ffd9e93c3a3f5812ee97a58a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697988746, "uuid": "ec3e3e6a-af7e-4a01-a54b-28a03fde9a38", "value": "T12044D02176909432E4A75935097482661F3BBCB2AB7685CF33943F3E9E703C19AB6743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697988746, "uuid": "6320550a-45c4-4b04-85e9-33536bde6f16", "value": "d2a54e4207f7fb1f334f58a667aa3417", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697988746, "uuid": "a1b1b394-0198-4cdd-9739-3278c64dae6d", "value": "3072:WyBNUf2KxA+GRKv3XgAYUzBefFzGdrgRiyVHhoLA48vQX:9FMA+KKvHgn4tIiyVHqL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697988746, "uuid": "b706e32f-8a4a-4f1a-b43e-134f328761bd", "value": 260608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697988746, "uuid": "c202322f-16c7-41e0-adf5-8480266397d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697988746, "uuid": "9e835ff1-1a9a-4a57-bb63-2e8a537081a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08fea6a0-70d4-11ee-8907-42010a9c0042", "comment": "Malware payload (njrat)", "timestamp": 1697976648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697976648, "uuid": "ab7065f7-73ce-4e94-8848-d11b9816358e", "comment": "Malware payload (njrat)", "value": "b1290bf36ae40c7d6ac7dfac9f399848", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697976648, "uuid": "9a5fcfbf-cc96-4aba-915f-3b31e45df51c", "comment": "Malware payload (njrat)", "value": "20b06a72b000ed9c2d9db774c543202171728537aa4a43a7c8b5fdab7bf026c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697976648, "uuid": "8a2cc13c-932a-4060-8082-c4623409e425", "comment": "Malware payload (njrat)", "value": "fbcfebb104fe31aeae0a24b3bd28d92280f012aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697976648, "uuid": "7c3e8ef1-118c-47be-a4fd-c5fe3e151aad", "comment": "Malware payload (njrat)", "value": "11781ac52f824c94f7cad374f1b5a20eef4f002b1426fa850c07150a6faa92e5438cd55cbdc66ad416244df73ba2d64c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697976648, "uuid": "beca6877-310b-4c6e-a0cf-60998e412ba8", "value": "T1F0634A4877958A55D2BD2E7844F256518730F60B6D03FB3E48D160EAABB3EC40A42BF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697976648, "uuid": "90fe8a41-3172-42ec-a9ec-33b81000d19a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697976648, "uuid": "0d160b77-601d-40c6-be11-66aa7e4d52ec", "value": "1536:lcxR4cEoN36tLQviFw1iW6SBnvb0fLteF3nLrB9z3neaF9bNS9vM:lcxR4cEoN36tLQviFCbhBnYfWl9zuaFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697976648, "uuid": "bf5d39cc-612a-4057-816a-52b9b6c58ede", "value": 67072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697976648, "uuid": "8f8ef5d3-f532-4e07-b375-abbd45d325d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697976648, "uuid": "7db6010d-bff5-4c9d-9e28-85ae1e16de67", "value": "B1290BF36AE40C7D6AC7DFAC9F399848.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d35b2c41-7136-11ee-8907-42010a9c0042", "comment": "Malware payload (IRATA)", "timestamp": 1698019078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698019078, "uuid": "88fadf17-f642-4fb8-be3b-8a39647e637b", "comment": "Malware payload (IRATA)", "value": "2a60561675dbc25ab068365a1a612fe3", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698019078, "uuid": "16066158-97fa-4e04-a3b0-3d7129c7fbd6", "comment": "Malware payload (IRATA)", "value": "20bfa53acf272f5e6fbada795b7444dbd2f7aefe1037e6ba5ff11cddee5b61b1", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698019078, "uuid": "d92e4aac-fc32-4cf8-a73c-e7713e008e19", "comment": "Malware payload (IRATA)", "value": "3a0bbb10ea8ae8e6db111c6fca3bda437471a020", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698019078, "uuid": "ff30a3a9-5b9a-4636-9261-7177da340e73", "comment": "Malware payload (IRATA)", "value": "09386d4c41ecd794e80308d626e6cee5cde091b78f840a8c1e7b8c4f1d7ce26739a922b641ea85a3b8030408040e961b", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698019078, "uuid": "34f8575a-1597-4bdf-b642-2d183ee7bc7d", "value": "T102851243F27A6857C831D13325452B3A211B5D28DA46FB8A696433FE74BBDF84BC12D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698019078, "uuid": "ef49f74e-7473-401e-a7d3-756a375ac153", "value": "49152:Csjkk6EXLbbY3hnR6uBVuvOgmF2rG3AzS3J071wh:3kkBXnbY3quBVuevK71wh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698019078, "uuid": "3c63e391-6699-475d-aa80-58a555e7ae40", "value": 1743864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698019078, "uuid": "3f01e871-1147-4c77-b90a-725b1d3b1337", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698019078, "uuid": "9598cba1-2200-4b53-bb70-a189db6f02a2", "value": "Edalathamrah.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e07e4ef-7093-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697948819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697948819, "uuid": "2573bc69-028c-480d-83b2-2d4918e7848f", "comment": "Malware payload (RedLineStealer)", "value": "b014eee3279f0da3d9341fbc46f328ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697948819, "uuid": "9013cd5e-c23c-454c-8335-754eda9a4d7d", "comment": "Malware payload (RedLineStealer)", "value": "21a97e3270a345d351d154ed89e9b2bbad9dc8397c7f574f80f1b29b1f206db3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697948819, "uuid": "d337dfe8-5728-4f22-9508-2e127fd30539", "comment": "Malware payload (RedLineStealer)", "value": "e0ea773b1a22d3ee5e6de81ff430ce0cbe3fe753", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697948819, "uuid": "e93d1604-d7a7-416f-914e-d69b5e9fa983", "comment": "Malware payload (RedLineStealer)", "value": "9e6f1438b17b9bceaba5a0cce9d5ed44ee92d18412f52560d87b96b80daf5a89fd3fb5675279d1055d14cdc5a790e686", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697948819, "uuid": "99a497e0-2228-4ff1-bda8-700a71f9c100", "value": "T133652323B5D49A73CE711B740CFD23A72B32FCE445750A7A2705E99A4DB3688A4B071B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697948819, "uuid": "1a06b83a-be1a-40d2-aa8c-931b97d4cc07", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697948819, "uuid": "28ed011e-b122-4647-8bd8-169f37b41022", "value": "24576:75yRumnfCFlaXmIM0JEYMxAbbcdeGcuPDTnjuuWpvJZZAjd7XGSkwT93rC:Y/KiXmIM0uYAobyp7TnXWpvJTS1Rb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697948819, "uuid": "3102e11b-5e45-42cf-a446-7d30fb933f9b", "value": 1496064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697948819, "uuid": "77cc7424-c9cb-408f-8580-d99c020975c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697948819, "uuid": "76e722e9-e97a-414c-9ce1-3380ef8819af", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b412a4e-70d6-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1697977510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977510, "uuid": "86f80450-f162-4fb7-a530-75a72010123f", "comment": "Malware payload (Gafgyt)", "value": "fa9a46ba2abbd67d0178c474482cd631", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977510, "uuid": "70c5b9a5-ddcb-45e7-a0ab-550e11656b60", "comment": "Malware payload (Gafgyt)", "value": "22a35e0f0096f11eae2f01ba452aa701b86bbd0a7ebbb3ecd13ae4b6f91f19f6", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977510, "uuid": "84a7abf3-c39f-467f-9497-e9419fd0999d", "comment": "Malware payload (Gafgyt)", "value": "430f8239be103605338c68420f029ba402b3cfa4", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977510, "uuid": "85a69d9b-c9ba-4a4b-bad3-92d3e4235b90", "comment": "Malware payload (Gafgyt)", "value": "37da209df01a9996c16d5e809ba54b6b8bd402f89a5185e5651e7346de8935fc56050a403b2b4b3da98612c48d25ef83", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697977510, "uuid": "4ad030b4-1d6f-40d2-81bb-ec4720ea962f", "value": "T15DC31837B5D18DFAC04652F016EBD9729C12FCBB0B32214B33987D616E3A8DA1D99B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697977510, "uuid": "d372bbeb-3a69-40bd-96a4-d352d95092f6", "value": "3072:aeiJQuS5hzg9rb6Ul32EpRJ5lgETasF+5c4E7ILVkH/E8aWNU:aeLg9rB2AftF+5c4E7ILVkH/E8aWNU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697977510, "uuid": "eebc247a-0c98-42c2-b920-29b546638ff4", "value": 128998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697977510, "uuid": "7cfb17a4-bf9f-45d6-a687-a6102ce3bdfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697977510, "uuid": "b38fa357-cb0e-4cd3-b39b-76f96f46ee7b", "value": "fa9a46ba2abbd67d0178c474482cd631", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c4cf5a9-70cf-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1697974586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697974586, "uuid": "abf65b52-9d7c-488e-af76-d7ac04d8b853", "comment": "Malware payload (Stealc)", "value": "13578554209693c995b537a2f51007bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697974586, "uuid": "c8a1c56c-e944-4acc-8796-1b709be1f1e9", "comment": "Malware payload (Stealc)", "value": "22b5f7e3dd15c8f0205d49e4a17f851cbffc636fbbda8e5d371a1a91db0e538d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697974586, "uuid": "265709cc-ef3b-454c-8298-75192629e781", "comment": "Malware payload (Stealc)", "value": "fecc2b8576b9a8c0260f08eeb53bf547b6e85683", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697974586, "uuid": "9e41516a-513d-4371-aa6f-5a361866e998", "comment": "Malware payload (Stealc)", "value": "98042629f7b1fba64443dcc20459fd8f4a74f28e764a308708056af3da51488a4fadc5ceaad20c6a89307075f5b2e396", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697974586, "uuid": "323271b6-4385-4290-8610-9ddea7612ec5", "value": "T1E444E01277A0C832E42759355930C6A62E7BBCB29A3581CB37583E3DAE313E15B71B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697974586, "uuid": "31352494-8824-41d6-bf6f-2e94253d1b7d", "value": "fc20e897770322541e2213674466dedd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697974586, "uuid": "1c2414ef-edd4-4b82-ae01-6067f4cb09d7", "value": "3072:HN1BNDeJAymECtP3ZL1zCE7QKH87oDs0vbC+WCKTxIlBb:JBoAyDCtv3VUZ7lqbCMsxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697974586, "uuid": "c5780767-96a5-4323-aa71-551fe5e75699", "value": 260096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697974586, "uuid": "3c42d716-5b76-411e-9bd9-c31f20c9b15b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697974586, "uuid": "ba8308f3-aae1-43e2-a9fb-bdb77cfae522", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e71031fd-7104-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697997636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997636, "uuid": "35d5e7da-9cd7-405d-abba-a826360e008e", "comment": "Malware payload (AgentTesla)", "value": "ba6ce7ccae114cea64a5906b7861bc85", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997636, "uuid": "4112a015-22e0-40d7-9050-472bce7f6deb", "comment": "Malware payload (AgentTesla)", "value": "24dd875b8a056c7228f962e122d7e661b34f231e7f89d634b0706b06d35c9ed1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997636, "uuid": "2448b064-5a12-432c-b0b1-98b5be15ce2c", "comment": "Malware payload (AgentTesla)", "value": "688a0e35280554e80af30461227895988d6f17b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997636, "uuid": "4b57d80c-5525-4d72-85bf-97a3a505f992", "comment": "Malware payload (AgentTesla)", "value": "b26e2c62f94f07306a3f18c9b4d3a026c05703c09f94bafb94e9d9822c4b296adbb34f92456552fab57bcf47167b430d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997636, "uuid": "984e1b64-1d40-433c-9d58-8e0facf7a241", "value": "T174459C4A7EC8FD9ECCE7C57D8C900E34DE1A38EB421682B67087715D992D7628FD40A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997636, "uuid": "c96e5fd0-f597-441d-ab10-db8a2665ae1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997636, "uuid": "ad53be63-58e9-4236-b052-50a5df37cdad", "value": "24576:Mm2qIFk2+5yoB4sRbSijxI4aPmyfCaCKm3/g:Mmd+k2ECTijy4aP5CFF3/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697997636, "uuid": "e2d6ae48-4aa9-46bf-92cb-25527eaad956", "value": 1266688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697997636, "uuid": "156766f9-b2f0-4dd1-9bad-e9b499ec08bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997636, "uuid": "98d400f3-b0aa-4d74-90cd-8d12dc95d0e9", "value": "ba6ce7ccae114cea64a5906b7861bc85.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f167a8-70e7-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697984810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697984810, "uuid": "b2e93e27-4f1d-4e5c-a482-31ead6ce1f38", "comment": "Malware payload (LummaStealer)", "value": "19988cfbaec4f1382413785709ae8c49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697984810, "uuid": "1c921b99-482f-4910-8c1c-78e51f786382", "comment": "Malware payload (LummaStealer)", "value": "2619a57d54cf675061189357a981d84b18298533227e6d7e0f43f24395b881c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697984810, "uuid": "0bcf7a62-2e40-4447-b89e-fc3ea8818851", "comment": "Malware payload (LummaStealer)", "value": "fae9da47c765ff76005f585d52a27b63b840c5f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697984810, "uuid": "c0893fcc-2c90-4871-a334-a75d663420f3", "comment": "Malware payload (LummaStealer)", "value": "1aaf03d73fe2f77ccf09266b1122dd074d30c6172947a32c932dea9e12e14b6c727e28748602fde30d368012ba7e6f6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697984810, "uuid": "1468427f-f3b5-499f-934a-6114954eb391", "value": "T13785231277E84072D4F927B4C9FB06870671BD26AEB5472712857E5E0CB2FD8A932327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697984810, "uuid": "5c72c2e6-8dec-450e-99f3-62817ac97e8a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697984810, "uuid": "447123f7-ef2b-4ba0-95a9-3561b76fc378", "value": "49152:C576Gr7LKzeeXovq4MRYsyKWoTSJM3VLbu7Go:G7WzeDMD7XTSJGbiGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697984810, "uuid": "f9cd1e2c-b017-4d34-a58d-281e51fdbac0", "value": 1812992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697984810, "uuid": "250ca978-aee2-4bb5-8df0-18360de83a8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697984810, "uuid": "78da644b-c2f5-4ce5-8f90-d3db749b684f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb0e7be-7104-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697997484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997484, "uuid": "b33c66f4-2a4b-4cb3-8c62-afb157858d7b", "comment": "Malware payload (AgentTesla)", "value": "15c921cb2dac8d0ee2ca4fbe7f7c0989", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997484, "uuid": "77ff24f2-1ef6-457e-9f80-8b474f618036", "comment": "Malware payload (AgentTesla)", "value": "2672783b07d4a03225cd11b484092db5792617647ba2f3ac4b447e22a9d0ed16", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997484, "uuid": "47dc561e-be87-4546-a766-3d982929a15c", "comment": "Malware payload (AgentTesla)", "value": "18bbe85e71bc15b10da55f70796ac86bd75936d9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997484, "uuid": "b3fb52a5-507c-41a2-aa8d-813a305020fa", "comment": "Malware payload (AgentTesla)", "value": "a71e8d3eae1ad65eb71330778a920bd6e08fab9fcc1c069b6e45b125e5265668b70db93e4f044014124221a62ef13c70", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997484, "uuid": "4d4555b9-d8db-446f-bcfd-6d86154ebc87", "value": "T16124CF11FE81861AE555433549F74FAA6325EC419B934B0F225CF32D3EF03B42E2BA66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997484, "uuid": "673064f7-deef-4e26-8290-0cd4313cadba", "value": "6144:9Y35qAOJl/YrLYz+WrNhZF+E+fgL+0dD8ivSbVqfMIkoR0/WU/6FG07W:E3bVqfMIkoR0wG07W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697997484, "uuid": "1c23a261-88e2-4984-95e1-3c2f33f2ff2a", "value": 225280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697997484, "uuid": "6f41e079-11e1-4a75-9e3a-8343a5e011d0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997484, "uuid": "8c25ad6e-21f1-4e1b-8ee4-fdc0c90062d0", "value": "Comprobante.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "474df6ff-7103-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1697996939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697996939, "uuid": "d8750977-1f7e-4ed4-abf0-76f0c5794ad5", "comment": "Malware payload (DBatLoader)", "value": "acf572bb612048e33436a2a161c5c4db", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697996939, "uuid": "97b8821a-1b6e-4d5e-b35d-37647e205849", "comment": "Malware payload (DBatLoader)", "value": "267f54dc36591c1746dba949c776e015c9c89be7a11f4c3ebf7ab0fb4510e0e3", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697996939, "uuid": "c6ebaa30-b6bd-45e2-b4fb-4b22c157d7f7", "comment": "Malware payload (DBatLoader)", "value": "644940b6bd85080dc68e779c9d8a8b521caea6e8", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697996939, "uuid": "fa452f99-6405-4e6f-8005-dca58f2ec0f9", "comment": "Malware payload (DBatLoader)", "value": "a0c3cabf679a5961b2431b7f844bacde5964a8b4dd4c7b492b6261f291f5b567b5b7e2b20428f9b7f18bfc65c92353b2", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697996939, "uuid": "82986189-3ca5-4c1b-be4d-d2700c85f9b8", "value": "T1C1458C12BED19C32C4F3497CAF47EFF8A81E39F1192459A97ED8294C4E703513DA918A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697996939, "uuid": "4ef2ccf7-a926-4328-9547-b1d82b03e336", "value": "4df0e13d93cb581937cac481e3c87c38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697996939, "uuid": "5e389dc7-c173-4e48-9d5f-d0bcce807e43", "value": "24576:qeA4Puy3YeOyFbcA3l0xdapY2bwplPYlRQZlo/:q5cZ3BmdaG261E/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697996939, "uuid": "2b35a586-5702-4954-959d-aeaddc65dc72", "value": 1262592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697996939, "uuid": "52a4faad-eccc-44b2-9847-b65d9e36753e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697996939, "uuid": "f592c7c7-74a8-4eec-8094-cf5e81908dc5", "value": "acf572bb612048e33436a2a161c5c4db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af4f36c3-70b9-11ee-8907-42010a9c0042", "comment": "Malware payload (RisePro)", "timestamp": 1697965330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697965330, "uuid": "3d43d534-1cc0-43cd-b7f4-5472270773dc", "comment": "Malware payload (RisePro)", "value": "abca48ccfce4fa0e082e44b15048104b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697965330, "uuid": "8b9f0044-cb58-4278-a826-a3d407bb2e5b", "comment": "Malware payload (RisePro)", "value": "26a628697a9933f66c951e2a3d6130a3ebaf0b5f777c7c5d8cc87f4b14225d6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697965330, "uuid": "efbebd6d-9c3e-4249-98f9-abf02defff0e", "comment": "Malware payload (RisePro)", "value": "c813ac7417748c20c29f97cc38eff19b7cbc8182", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697965330, "uuid": "8e9d5865-9590-451a-9563-739c330c96bc", "comment": "Malware payload (RisePro)", "value": "dec76771842fb723f5133f3f338f186fdfd002e3c469e636df9c63c2b02e8c562bf50448d849b7fb1af8378435577f74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697965330, "uuid": "7e0e0523-9b6e-4049-9bde-412c89f0b2b8", "value": "T12E56238274C1A182E4EA0AB1994AE97C31A13CFE989CC95F71D63F2FD9F3291353D116", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697965330, "uuid": "c5b6864a-a944-408e-9769-363f2e6c81d6", "value": "0d0546185239791e3ac977a371dfba41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697965330, "uuid": "c39659af-6341-453e-845d-2827d91d4cbf", "value": "98304:ZckNXDVUYCCLTCJA9qsMVxGr/Px7Mpc6EqgDKQNdUOOzT0iBCGatwgIfcVhDqKkc:ZRRVUYCCLTWPTLGrh7Mc6ELvcei0FxI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697965330, "uuid": "f9a499e1-a18c-49da-8f0c-caee3d38b86a", "value": 6017536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697965330, "uuid": "9459e53a-c773-4556-aee9-befe242fcfe6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697965330, "uuid": "4c9ea4a5-c4d0-49af-bc90-76d4527c21a7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4909d97b-7113-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698003813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698003813, "uuid": "e1759d42-d59e-4cea-be8d-9a2ab7a3736c", "comment": "Malware payload", "value": "dc6a65858077798b45f666e3521ef14e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698003813, "uuid": "04712194-f462-4b3f-a687-c87144568071", "comment": "Malware payload", "value": "2846e83998a7f2684baa16e23f3bc18e61742c1a5b2e70551a6172ad76f1679a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698003813, "uuid": "f09cfab3-f181-46b6-a408-86d41edf33db", "comment": "Malware payload", "value": "dfd30b9538b84741f886418c8a55a2eb31c2554d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698003813, "uuid": "a41aac64-1139-4335-bf96-452ed170b261", "comment": "Malware payload", "value": "99345c807da8e6bc424373d4dfd1bc0d75d8105ef0b583090678a85561b631e0fb9f15460117f73b4ee7940c906d987c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698003813, "uuid": "ea977bdd-3887-4b30-a6ad-f81e48e0439d", "value": "T10D237D1235E1C073D41642FA086AC746AB7B79129BB584973BE8528E9F323E48E3F355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698003813, "uuid": "a58a6c57-c438-4169-9194-ebe8dbef008c", "value": "11d42e5a5770dd9f0e82bcca3b9cd23c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698003813, "uuid": "21056269-e2dc-43d4-a6c7-2c01900aa244", "value": "768:Oxvr2fXoabW8pGyKohRbPeqNOgh+Zz4EtI:l/+ObP3oZ9tI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698003813, "uuid": "64022feb-26c0-4208-b056-a8693ac8d001", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698003813, "uuid": "3ab6f6d4-5946-4574-ac05-40889be22df3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698003813, "uuid": "d339ebe1-ece4-4272-a14d-3a4f4d44aeb7", "value": "SecuriteInfo.com.Win32.Trojan-gen.12758.9428", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a69c81ca-70ab-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1697959303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959303, "uuid": "485c3325-3f3e-4f96-97c6-7d9890483741", "comment": "Malware payload (SnakeKeylogger)", "value": "69f82fb1bb5bf5002ceb3681cf885cd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959303, "uuid": "eae1ff18-2f1f-4ce0-862d-a8e1985f0643", "comment": "Malware payload (SnakeKeylogger)", "value": "296b6f53d75d7cf11a83e21fc2c618897adcc24314a3a5587afe422b1cb6f758", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959303, "uuid": "709af2b4-042b-490b-b6e5-d5a162420c1c", "comment": "Malware payload (SnakeKeylogger)", "value": "ea249abb8d980d184ae50b0bcb9729ba43966aae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959303, "uuid": "10563ee6-2bee-478f-911a-b0bcf604c2ea", "comment": "Malware payload (SnakeKeylogger)", "value": "3acf9f5008fdf682d1346d16cec56a1f66a119236378420d1492b52c3155ae16867b3fa6d0666650c98a95c7b59d4104", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959303, "uuid": "535871bd-e694-44dc-8974-b47dd7148275", "value": "T11FB412943790B1BFC873C836C9A42C949731652A672BC657E867218DDF4D99B8F007B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959303, "uuid": "c63a4bfa-525b-4f9e-83cc-da8e07953bcc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959303, "uuid": "56915a7e-d510-4b7d-9001-fd9e53152e22", "value": "6144:Cq/YUzsjq8wJtwihAFb8E5F6TvhzvMChl2c5EthpiD3ViXA5StXN9J1ryPmBcKOZ:L/jRwyc5Fevhzvl9OWmXtd/1r7IWR+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697959303, "uuid": "1faaa7d0-d6fb-4211-9ea7-3662c6bb3c3e", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697959303, "uuid": "8f9631c8-998d-4fbb-83e0-34cf1d56e48b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959303, "uuid": "b40c30fd-0ee8-4f79-bbb3-77ec0f640e16", "value": "swift.txt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf1e8eaf-70e7-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697985140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697985140, "uuid": "ad2f1f2e-750b-4ab2-9374-84116e7fcf53", "comment": "Malware payload (LummaStealer)", "value": "1f789d46c7b7769598d1fd9f7352c27c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697985140, "uuid": "0ececa33-90e5-4a94-af2a-5c7cb220de34", "comment": "Malware payload (LummaStealer)", "value": "29d78ddaf4366b1ef0cd9b7f8e85aeabce276312c11ca1ca95ed5d77b643cbde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697985140, "uuid": "7bfa2f33-b0dc-432f-bcb6-3a068b401805", "comment": "Malware payload (LummaStealer)", "value": "eee6100376668197e2539368b94ff80924f91249", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697985140, "uuid": "baaa89b4-971f-46ed-8ca5-c706e222fec0", "comment": "Malware payload (LummaStealer)", "value": "9e0bc07364a3fc43d1622a4038c1e6d0363464465eaf7106a7e4c4f71ce41f27f474e9ccd77dc7b15eac4796746fa457", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697985140, "uuid": "f57c5969-5a5a-462c-ad8a-bc08d7752ed5", "value": "T162169E07EA65DF2EC35926391DD394546370D069B306BF4F0B6CF578B88327289A27CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697985140, "uuid": "09c8965a-603e-47d8-976b-4aaf4101d650", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697985140, "uuid": "27e0d7ef-d7a2-4f9e-bcc6-5a9056000deb", "value": "49152:T5ZBNyYGdgbIpLaD8bkllxLGrH0VlwuZ7syuybdvQV1RxvLvI2z+FZb+ni:5upkDxL6sWmBoVPxJzmkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697985140, "uuid": "4ca068df-aec5-43a2-bdb6-ca05e2d8b36b", "value": 4074424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697985140, "uuid": "9a7bf8c7-55ac-4bb5-9c51-8e6d10e92f67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697985140, "uuid": "2f1f9f94-b3b7-4554-b61f-b31b7fe96616", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb177192-70d5-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1697977483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977483, "uuid": "fa729f94-bfde-4dc5-9d37-d09433de5bf5", "comment": "Malware payload (Gafgyt)", "value": "3befc867cd31aaf38f4f19933efa1723", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977483, "uuid": "7f2e087a-5a58-4e6c-b933-dde2d50c60d9", "comment": "Malware payload (Gafgyt)", "value": "2a0856354b02760504f82798d0f6bb5deacd8eaf6bdd7e10a7a6ab50ffaa90bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977483, "uuid": "9a9b79b7-8c83-486a-b858-b5eb86e3a6d6", "comment": "Malware payload (Gafgyt)", "value": "c38873159f89a3558be461e1eaf5f4563b202037", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977483, "uuid": "86297a7c-10bd-47bf-9760-c645e72fe9b5", "comment": "Malware payload (Gafgyt)", "value": "f63294f2fbfe9303bbb10dfd2aba8dec7f621020bcf02d322dae7346794f4d8ec7745413b9bee7451e6ac4fee67414bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697977483, "uuid": "68ae9fa2-59f1-433b-8b1e-cfffb1a7d2db", "value": "T1AEC33A37A71C0B43C09795F12CB77BF28F59AEA312A611C0A219FEC04B739B22555F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697977483, "uuid": "ea7523bc-c72e-4839-b50c-c7abfc321539", "value": "3072:BWDL7g1ksaTjvAI8wjOaDm4ucENYMyYKNb:BW37Ck9Tj4VOOaDm4ucENYMyYKNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697977483, "uuid": "373030e3-b49d-404e-8a4f-426cd159e529", "value": 128675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697977483, "uuid": "957430d6-63ec-40d4-a00f-f5905f71988a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697977483, "uuid": "cc9fcc5d-a897-4750-878a-4f80406ae76c", "value": "3befc867cd31aaf38f4f19933efa1723", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6386ea3-70f0-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697988991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697988991, "uuid": "7f1c4f37-9b66-4c93-8d24-2465936facda", "comment": "Malware payload (Mirai)", "value": "1d1a3967d6fe81b35e08129eb8b55636", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697988991, "uuid": "b7495d53-04f5-4d9d-bd88-3172a064d12b", "comment": "Malware payload (Mirai)", "value": "2a896a91cdd620d854f50eab8b2e686eabed619e66b8d88d2494af8c4216dfbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697988991, "uuid": "273b48ed-214f-4f05-a6b0-7c506aa5c43e", "comment": "Malware payload (Mirai)", "value": "d7f983c7f28d39f9bf6dc1d3687ee2da47bf6334", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697988991, "uuid": "d81a71d6-d52b-4a34-a770-062545ce7674", "comment": "Malware payload (Mirai)", "value": "26d8fd1990e465627f85d04c46e4329e897b1a727f9f38040cb56069bba2e8026aad874f666c8a0169b9eccb8f286a35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697988991, "uuid": "279f618b-cae2-4553-8527-d85cdca7e647", "value": "T1676329C2A943CEB7D81741F442EABF351E32FDBA1A11D983E374FEA159A24C1B541728", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697988991, "uuid": "27986b1f-d541-4874-99b7-9667f38cca65", "value": "1536:TF+li2dTTI3HW3MxlXI3/EfZbq0AAVxrJSIA0:TY2xl43sfZmFEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697988991, "uuid": "94ca9046-cf19-42d4-a9ac-44931a504ae4", "value": 71960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697988991, "uuid": "1f0e8465-ca11-45e5-b460-b504b03d4627", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697988991, "uuid": "934561a0-ea2c-4e9c-bd30-9d84f768a6f6", "value": "1d1a3967d6fe81b35e08129eb8b55636.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "613399ab-706f-11ee-8907-42010a9c0042", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1697933416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697933416, "uuid": "6c5a23c7-21d6-46a9-823c-e8cc9f03d714", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "7bd7a6ca99c240a8f965694db9779220", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697933416, "uuid": "c511bfd7-6cd9-488d-b76c-46260d374154", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "2cba59d0e93c789487237caefe4701ddafed3f03a507276006965f63a5b17763", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697933416, "uuid": "94617a99-ea34-4f88-857c-76b96630665b", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "a4b22dd580b07c487c96e5889c272c8ce966f6d8", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697933416, "uuid": "e475336d-909f-457f-8971-ccc8bc47d5a2", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "ce7958056d3bf0423e3e5fc406d67a22ed47d29ce39454f36e50f79fd8dd58324059e0cf9d2004e0ce1362680550f612", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697933416, "uuid": "f7870788-e836-4282-aa12-1658f5379e24", "value": "T19C157D2138C09176EEF320B787ECBA2582ADE0B0071915DF56D85BEED7606D17F32686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697933416, "uuid": "668e4114-f12a-4d5f-8e60-7bb6685043d9", "value": "440e77e14aa712e0e687ae6e10b63f30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697933416, "uuid": "9e33455e-173d-4fa7-816e-a65f554536c9", "value": "24576:C7mtwk+VoLIY2wHHHHHHHHHHHmGVTorjmPP3y:Cm+VoLIYnHHHHHHHHHHHlo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697933416, "uuid": "7cf10673-31dd-405e-9ac5-2f0857894759", "value": 938496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697933416, "uuid": "15430c94-0469-4a9c-a1c0-6ee218f5f95b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697933416, "uuid": "b960e71e-57af-42bc-91e4-e2638f729dc8", "value": "7bd7a6ca99c240a8f965694db9779220.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6e1ebbb-7092-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697948646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697948646, "uuid": "050bc56e-e22e-44e2-84ca-733954347ad5", "comment": "Malware payload", "value": "b9ebd9b2ee804bc38050b34f6ac0b7e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697948646, "uuid": "3392c150-fe6c-4e1d-bb32-4134cf929344", "comment": "Malware payload", "value": "2d683fa70bf9574ad512dc35b4d07839369c183cc2135d87340a83ea38953729", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697948646, "uuid": "4d8bf439-6071-4e3b-afa1-30e3b7d15c3b", "comment": "Malware payload", "value": "35a2c572b33535bb10527c9d75e653b23408c3c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697948646, "uuid": "c4122782-8000-4ef1-8325-653eeb6bf708", "comment": "Malware payload", "value": "d3aaefec61e5cf507711bf169492b1e798a65ffc29a8de1f90f028a499a98f6b89786016e08f094c0e7650534229428a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697948646, "uuid": "f9960b6c-a675-4d71-9d02-f1a54f57ff50", "value": "T13D678C03B2A60195E4B7D138CAA74103D7B2B8635731DACF325D02161FBBAE49A7F725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697948646, "uuid": "451fce2d-a6d9-429d-ae79-98ff8e297448", "value": "f0486e7e054aa57188c99b0f71783b75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697948646, "uuid": "02d9e44d-ab09-4ead-87f4-3a019d2ffe76", "value": "393216:/QgHDlanaGBXvDKtz+bhPWES4tiNQPNrIKc4gaPbUAgrO4mgR96l+ZArYsFRlF:/3on1HvSzxAMNRFZArYst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697948646, "uuid": "2093bde3-0a97-44c0-ae17-59d4fe51b3c1", "value": 31535364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697948646, "uuid": "06cc1c41-f77d-4849-b090-53d2e5c867ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697948646, "uuid": "e136daa2-4722-4413-a30a-7e4adbb6093f", "value": "windows.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f68b0e7-70d1-11ee-8907-42010a9c0042", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1697975424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697975424, "uuid": "b800809b-a1b9-45f6-8304-abeda5ebc49b", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "2d978dfb5ac57068bf09e6b953c77331", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697975424, "uuid": "ff907f03-d4ee-4ea5-ae1b-dca0374da33f", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "2df344cc441b5b8cd29126b38692712c3995444810eed0d25e048880b94f4905", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697975424, "uuid": "ac5c42c3-8f90-40a4-bd16-5126ecb18d40", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "9b4a8e61e394f66c3407713af120093d2729e56d", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697975424, "uuid": "20a85d7f-a41e-45ec-86ca-6697395e5a95", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "13daca19fb810c6582936b3bfe5a5dec1d175e7f01db25ae009c788fcd3d713294b960f79ea3b9bac1818dc266077ab5", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697975424, "uuid": "3d77c6e0-64b1-4e3b-83ff-03aea8e750c0", "value": "T12F158C2138C49172EEF320B787ECBA2682ADE0B0071955DF06D857EED7506C27B366D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697975424, "uuid": "1aa70385-155d-424c-98f4-bb90ccb256a3", "value": "09b5d280d2d122a8b769c1e2cd1b4ca6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697975424, "uuid": "787b888d-829f-4417-9afa-504f08c9e15b", "value": "12288:UxgOmNwsdP2BrKsiONDqafUYU9XstR5yhuvS+kSAAPuXDNqXZ:UmNwsdP2Br1d5qaDwKfkWIDa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697975424, "uuid": "d8ca5d80-e5c5-4c01-ba30-2033976f3514", "value": 933888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697975424, "uuid": "4f8b537d-2b54-48ff-aa48-d0f45abe40a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697975424, "uuid": "61484ca3-e4ec-42a3-b786-4a22c6691da9", "value": "2d978dfb5ac57068bf09e6b953c77331.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05255d74-7103-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697996828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697996828, "uuid": "ae2effb6-8f22-4c65-be12-109050cf67eb", "comment": "Malware payload (RedLineStealer)", "value": "a5264141b890f2d03031de7fbaaeafd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697996828, "uuid": "544d6691-0973-4be4-b06d-dea9faebefbd", "comment": "Malware payload (RedLineStealer)", "value": "2e1cd553c976cfebd2e25a6812d38d8f3278a117169dc5c8eb3fa499148afbde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697996828, "uuid": "f3947f69-c19f-4ff7-a60c-cb607820ce36", "comment": "Malware payload (RedLineStealer)", "value": "a3e0b0b48af3d63b5769dded05b05bb54de12ad8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697996828, "uuid": "a128b2f6-815f-4c09-b87a-129547eb6e79", "comment": "Malware payload (RedLineStealer)", "value": "02b40071e78fb532567c4e41c14fb7c871bb0b92121ca1c3f4ea9f1045e60c34b62191d7de61ce6190fb293fb2e42440", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697996828, "uuid": "d7664eff-9f0d-4364-9a42-cdd8ccc10905", "value": "T1B985235292E48823DDB113B549F602831F3B7DA7DC3D42AA22E9D90C4E62590FD7B367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697996828, "uuid": "b968bb2e-2af7-4d34-abc7-31840ef860d6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697996828, "uuid": "63c8b58d-5481-416b-aa0d-f484d8fdfc82", "value": "24576:py+N455h1Ve8rexOHCPy2Q6ELxsUQYM75OfoqaNyDYZEz0ldyie8rijeHIhjqETl:cZLVevN62mNw1DZy8ZEozyi6j6qjqwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697996828, "uuid": "2be71ecd-c9b1-40ce-a5d2-36fbfdeb43c2", "value": 1824256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697996828, "uuid": "66247812-ac06-4659-815a-febcc4ff9a34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697996828, "uuid": "ece9770d-74be-416d-85fc-889bc4a63974", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "371c3c38-7090-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697947519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697947519, "uuid": "a6cac83d-5e4b-4704-97ab-8d13acad0cf5", "comment": "Malware payload (Formbook)", "value": "010171d9c77bdab550549858fcc25b27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697947519, "uuid": "b76eb5e3-1fa1-48c3-9847-7f5ed32ad44e", "comment": "Malware payload (Formbook)", "value": "2e5f55128f68b14db5b0d9488e30c9408759ae1f8e89d714419a6583e9793fbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697947519, "uuid": "9358e859-44a3-4798-8010-ca283546fc76", "comment": "Malware payload (Formbook)", "value": "698ccac5ecde5dd4a4e79ffb576d389c87a3d902", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697947519, "uuid": "60a7ec75-d1e3-4fc7-9776-dcd83b98f303", "comment": "Malware payload (Formbook)", "value": "280775b032724e46bded4878b2fca103ddcdad5560a7da56251f46fa535cbd3dca416a23b1816ce6068aeaed967f7c89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697947519, "uuid": "741687a8-3adf-4964-adfd-3f9861906432", "value": "T1A6157D2138C09136EEF320B787ECBA2642ADE0B0071915DF56D85BEED7606D17F32696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697947519, "uuid": "f17e56c1-6aff-4907-b1cc-846555c40e72", "value": "440e77e14aa712e0e687ae6e10b63f30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697947519, "uuid": "395f4eb4-c12d-400d-b20f-5090729f1b9b", "value": "24576:ZdmtwAOC4b6XFHHHHHHHHHHHEsy9pVrl2q:2OC4b61HHHHHHHHHHHap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697947519, "uuid": "bdb57c82-31e3-40cf-a622-011ba64cf79d", "value": 938496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697947519, "uuid": "b079e884-c811-4460-b06d-24ddf4d716b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697947519, "uuid": "79ae8644-883b-4c2e-9fa5-842a18f0d016", "value": "010171d9c77bdab550549858fcc25b27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce58aaf3-70e4-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697983851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697983851, "uuid": "bcb8d64f-f6ee-4d12-95ca-95e64ea2c5e8", "comment": "Malware payload (RedLineStealer)", "value": "d6095bdd3dcd3b0a9373aecacdcc9e1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697983851, "uuid": "0f57d3bd-1e16-4f43-bbe4-72d2e9d415cf", "comment": "Malware payload (RedLineStealer)", "value": "2ebae477e9d5a7f395a441445a0979679048773858f745581bab5d89000b0434", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697983851, "uuid": "d347c41c-f5de-4287-b590-116dca670830", "comment": "Malware payload (RedLineStealer)", "value": "9ed8c0e9dd89acc08bf2dddd2dade258433cd2d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697983851, "uuid": "e845f155-f7b3-4995-9f86-e1722ab13cab", "comment": "Malware payload (RedLineStealer)", "value": "bd4809a010e8bb28bf0f25fb0f4a44712d7586dec8b0d99eba8f2d9efacf92a6dcf5cc9703b8198d2fccc8a437754326", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697983851, "uuid": "6fc7d690-9cf8-4d70-9683-0d5ed791570d", "value": "T17B65237657E81462D7A023B18CF103D31E757EB258A4C39F2B4598AB1C73299E235B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697983851, "uuid": "ed70741f-ea69-47c4-82b4-7baa1daf3df0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697983851, "uuid": "14cb566f-0b25-408b-8a57-dc75be5d16a1", "value": "24576:PyJgowZ3hvCJdQdJ90eHPIcx775uknuPdvKdTbXP4j9jXPi34YlKNnnUOGOBdDZ:amZ30J2504PIK71nnMd6bXQj9jXKdlK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697983851, "uuid": "31f2b3ba-24aa-43ef-ae9c-da3d56fea3e0", "value": 1537024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697983851, "uuid": "3c616b96-fc23-4e2a-baf4-04bb09b59e16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697983851, "uuid": "50556c80-4081-4720-9163-d9cc18bdfdd6", "value": "d6095bdd3dcd3b0a9373aecacdcc9e1e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68777ebc-70ba-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697965641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697965641, "uuid": "868e3101-ba77-48dd-bc75-0039df410355", "comment": "Malware payload (Amadey)", "value": "248e9ed22966cff58b3063004c3af6f2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697965641, "uuid": "b35cc5b5-8938-4923-a2c3-ff3451ce62f3", "comment": "Malware payload (Amadey)", "value": "2ee24567bd406a892d1ca0b4bfdaca611c15dc67bb4ef2adcd9296e2b89dc1f9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697965641, "uuid": "b686ec2b-a59c-489a-8946-39b99785aef0", "comment": "Malware payload (Amadey)", "value": "ea295175d8b25381bf8800e94d3852d4468a368f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697965641, "uuid": "b6b7f24a-a903-4a5e-bd18-0fc0641d5ee1", "comment": "Malware payload (Amadey)", "value": "9522e2e2c4ed652f760f8547c1b5fa3ffa507064af502b658828422d9f3ac0794c75b0151bca0ec50d732b0eda0db138", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697965641, "uuid": "7d571bcf-4867-40e0-a30c-84bf9612fffb", "value": "T1A665231769D0656BCCF9A3B094FB079B08307C914D78AB2736849D8F08637FA6A7171B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697965641, "uuid": "fb9276f2-3d52-4176-af45-28619ebd9c4c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697965641, "uuid": "058994f2-d042-4582-b501-6fa6a6e021ed", "value": "24576:GynGydhebJNK842AtiktckiNb1sF4QPbMjzOaqmo+CbRFXj6H/KkB4OwGH:Vn0J5Juizb1sGbOmo3XwKxc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697965641, "uuid": "9646f4e7-1329-4fec-82ce-e0d7cc3b9519", "value": 1492480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697965641, "uuid": "252d7fc9-4882-4b26-ba79-c81ded4d0a97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697965641, "uuid": "7b8a3e33-ab03-4d70-9553-f80d868b79a7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46414ba7-70ae-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697960430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960430, "uuid": "cec59e92-56ab-43b9-b155-fb5b77d3407c", "comment": "Malware payload (AgentTesla)", "value": "ee966c5a98d6841bfa1efdd46461016b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960430, "uuid": "62e80f1c-92f9-471d-83db-86cde204cb06", "comment": "Malware payload (AgentTesla)", "value": "2f166feb3368d45bfb4feac127bf509a7dc5b177c56a07d54e1ed7e854ad6526", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960430, "uuid": "a712f8b1-5d9d-4a77-b13e-77e6cc45ca6d", "comment": "Malware payload (AgentTesla)", "value": "acf5182d4a3fbf300de33df1c9fe452b3985bd6d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960430, "uuid": "0ece8275-d76f-4f5c-b9da-38551d17f0dd", "comment": "Malware payload (AgentTesla)", "value": "e7ec131215f32e57743a857a7a1be103d2eb00e509c59f67ccde34dcda13cd5fffff5acebc532945c112f6626edc4346", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960430, "uuid": "46c1d1b7-ce03-466d-8a45-ad8e657ff711", "value": "T1F8F4CF9C765076DFC857C8729D681C64AB216C7B930BD207A02326ED9E2DA9BCF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960430, "uuid": "56ee0735-8d4a-4f39-a91e-c19336b22d77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960430, "uuid": "5ecafa3d-b6dc-4bb3-888a-56a6f04e4941", "value": "12288:D9GQN8zS55mFzmJYKizL7979MtpNwUUU9X90wr2nluQv/e655NitHF9DnWneQ3Uy:BG4f55qyJyzrMtpNwUUy90wr2lHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697960430, "uuid": "d824f6f1-d187-462e-b71e-88f838fb34e8", "value": 759296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697960430, "uuid": "ae831dfe-d306-4bd1-951a-922c161f0963", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960430, "uuid": "055fded3-2398-4af9-b793-1cd9f4750b56", "value": "20231002143249087.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "635334b7-7134-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698018031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698018031, "uuid": "df47a72d-21b3-4d0f-b309-d7ea5da1bfd7", "comment": "Malware payload (Formbook)", "value": "07bf77afccf4bc23f29a05f89465d707", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698018031, "uuid": "b46ade7f-a173-40ba-8b2b-c1c0aa81367b", "comment": "Malware payload (Formbook)", "value": "2f2084dcd8e2ad68cd7c32428d5f30410c3a7853ab63eb9b3c7a05677d545cd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698018031, "uuid": "83b0a3c1-2190-45a5-9cdf-bec96d09117e", "comment": "Malware payload (Formbook)", "value": "368912004e3630052059a4d1b70de92fe13c2f71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698018031, "uuid": "b0c20bbb-9a3b-497a-8ae3-6fe087c9cfb7", "comment": "Malware payload (Formbook)", "value": "314de3d734116da22e4a4ccfe57818dcdd4cf9161e6a920cb954f45db1c69343e25db2926db9ca34872dc2365cfb6d90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698018031, "uuid": "e8b1085b-bf4d-4d2e-bc45-56e51d2aa939", "value": "T1181523D2BBE49471E8F4277548F713930A36BDB89C38939E274A745D1C73098A4363AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698018031, "uuid": "19f9cf14-333a-41da-b685-d6de4e62080a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698018031, "uuid": "4ec87f17-668c-49dc-a88d-9dcee26ec7ce", "value": "24576:TyWVJTFcmM9pfygMPlkiPp4KbgJUt3UKL8:m6NYfSlxBi6ZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698018031, "uuid": "8872337b-ab66-4a1f-9e5e-c4f110872ef4", "value": 951296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698018031, "uuid": "e7eb47e5-e725-47f8-8e3e-b341f0acdbdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698018031, "uuid": "cfa0e6e6-4bbc-4584-ae86-2e41500f7000", "value": "07bf77afccf4bc23f29a05f89465d707.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b60022-7105-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697998058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998058, "uuid": "f2a2ea65-f07e-468f-ba97-f669d50e1ef3", "comment": "Malware payload", "value": "ec701917854c449353f7c19f78e19b3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998058, "uuid": "1b55af0c-6553-4743-9a85-2f983292edf1", "comment": "Malware payload", "value": "2f2414fa7bc6cb25d2606b6654d2130c51e8e4ed9060f53dcde59e7f915e6ef8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998058, "uuid": "3c11f2db-1f46-4b4e-bcd7-7fe91e519b63", "comment": "Malware payload", "value": "d665ceae5eb7e704c50418d7a35c2536f494a44d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998058, "uuid": "314da14e-6e5a-448c-b33d-bc609077bddf", "comment": "Malware payload", "value": "16cedbed2d8f2aadcb6f575af9f7ee82f5e812f71595a1e4e328e575e68ca199696018f36ac5d830c53f5b3b6659cd9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998058, "uuid": "b7969d3a-ee1e-45da-9d13-2e75b1fd9a9e", "value": "T18016F1E685F71126F6AA56381A3A0DF41A3FA5E217DC0C6616045D6E02BFB4C33EDDE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998058, "uuid": "ba60defe-24b2-40ec-bb9d-cb7f8cfa5996", "value": "98304:vavlQIN33nVKboT7MAwtCUxDwoQtKjnX6Og6X2XcNlfYWzdg/:vIlQIN33nVKboT7MAwtCYzQQjn46yQlc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697998058, "uuid": "66b59916-ea81-4a98-bc0b-6012c322cfbd", "value": 4355275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697998058, "uuid": "15204426-4c74-49e8-82a5-c8c7398175c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998058, "uuid": "b6df83d3-b059-4812-9b3c-bfaab6dd835a", "value": "ec701917854c449353f7c19f78e19b3f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd7c4d66-70ad-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697960254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960254, "uuid": "dac8dab3-a734-4531-bc24-837f7d3ad521", "comment": "Malware payload (Formbook)", "value": "e085287e182e1fe1afc6136e08639b49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960254, "uuid": "2e350a7c-1234-4c1e-b723-63a222043ffd", "comment": "Malware payload (Formbook)", "value": "2f717becc408420e2dfdcac5643bcf420ce2a8e3e28320c23b3db7a489235f2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960254, "uuid": "86f326ca-843a-4a3a-abd5-caab19c9b1c9", "comment": "Malware payload (Formbook)", "value": "5eb95ee31e92596ab20100ad13358c5e214c20cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960254, "uuid": "2fbe0233-109c-4b73-b049-20180f095949", "comment": "Malware payload (Formbook)", "value": "cee39a30fe77a11ea260878f499f96f80aeb92fd608a687e1f844030a349542c35b5b0775c790b769c8d7aaf6677ba43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960254, "uuid": "190150c1-2cb8-4aea-9a0f-313e75378667", "value": "T11DD4124136A98357E63C4AB758778AC103720C663A52EB8E3D9635CE8CF7F4857107AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960254, "uuid": "ac7882d9-b20e-40c0-9768-8e4e6ec71f87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960254, "uuid": "3e6dfb59-90ec-4d2b-9793-2bd076d1de5e", "value": "12288:u8zS55mFzhcNurziYbsFTzKyGvmKE8GJnff5VBJSCQ:uf55qF6urz9IFPOuZ5nsJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697960254, "uuid": "32ed11f4-6c26-423d-b429-fbae0a15bd3a", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697960254, "uuid": "e87a7751-7225-4b42-8745-c8b1bf5a4760", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960254, "uuid": "e5f6630a-1ae7-4ad2-812a-947bae27002a", "value": "FTT63730923.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b2bfe6e-7100-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697995710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697995710, "uuid": "707b1195-3b9f-4c13-b79c-da4861a63775", "comment": "Malware payload (RedLineStealer)", "value": "d23b492859cfae0b5b272c6802ea29c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697995710, "uuid": "091a7c48-5b76-4e71-b800-ec6be07cc35c", "comment": "Malware payload (RedLineStealer)", "value": "305653109239144203fae4638c4f7eead4a84928ded603244b35ed1dc07b69d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697995710, "uuid": "0f51ee31-933b-413e-b620-cf538379d95c", "comment": "Malware payload (RedLineStealer)", "value": "22fea9fa501a3ede9cce22cb05e919fd6aad2ced", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697995710, "uuid": "e4961765-7401-4d37-b72a-610dfd04294d", "comment": "Malware payload (RedLineStealer)", "value": "eab073223ffb86b60dd1ad414c1250714502c7c3300534dab524d3718e8fca07b3009cca08dc7c11d378d503833d18ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697995710, "uuid": "4e6b7e4f-a992-4b3a-bce1-dc32f74cef10", "value": "T19D852341A7F44472C6502B7098F202D313397D67883853AF77539E2D2CB35C8A6BAF6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697995710, "uuid": "1c131ea6-813a-444c-8461-d289bf3ed8dd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697995710, "uuid": "7163375e-cb30-468e-a5cd-46e76032bc24", "value": "49152:+FKKQOoTe2V+4rqvNlRycHLqJGzI5/5N8l:q2dqNDycHLqYzIRsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697995710, "uuid": "69cbca0e-7eff-48ab-a718-9472208ef835", "value": 1822720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697995710, "uuid": "5ecba102-09d5-4352-8f2c-c26eba831636", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697995710, "uuid": "580ee865-5747-4195-8398-5f8ea172a5e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db8b5924-709e-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697953808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697953808, "uuid": "3aa9b856-2533-4985-bf27-52865d8986fc", "comment": "Malware payload (Mirai)", "value": "0596e879627d42de39f9af1d1b186a83", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697953808, "uuid": "aaf9ff30-e2ea-44a0-890c-b426db793544", "comment": "Malware payload (Mirai)", "value": "30c038ca6b9fd7b5a0bbb6f05b31ff8c08e9d0fad6f32078feb0ce6bf3db791b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697953808, "uuid": "425eb859-eb25-4903-bce0-906192e3893b", "comment": "Malware payload (Mirai)", "value": "6499a237dbd521cb8e81767a4fb6e5901e328947", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697953808, "uuid": "3434cf8d-e408-4c6f-b6cf-38b2cdd1be1e", "comment": "Malware payload (Mirai)", "value": "24fde85c77de0ea544e410cbeab90e29a23f419d593c86ac69cfe1c4cc9e36e2bebd5e2e6dc218ac6e3f23f9f1837f8f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697953808, "uuid": "585ef364-f052-4f24-9bd4-09fb737dd30e", "value": "T130A2D01472A32D96E3ED1C3DC96AC327B9A71BFC90F5327629415620C94924A3E29A4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697953808, "uuid": "f4b54ad6-79fc-48b2-8603-80f4c95d642b", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjyhymdGUop5hN:vvQn4j+ZO5fKAlxms3Uozn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697953808, "uuid": "02576364-3e92-4dcb-b2e6-342c9a652d86", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697953808, "uuid": "dedf2cee-f5c2-4d09-818e-8817fb7be428", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697953808, "uuid": "510f40a1-9e73-4548-b52a-28c79f9e3da2", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af131751-7133-11ee-8907-42010a9c0042", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1698017728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698017728, "uuid": "ca1c7e51-8346-44c4-bab5-c1055eacf9f0", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "1df3a5bb06cc6d4176fd4bb3fe5f6bcc", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698017728, "uuid": "a346e769-bd7e-4290-a66b-5a554e7cf2d5", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "319d89eb4bc1fde194704b86466c0be5ffebb433d40cb187530c7f458ff5b477", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698017728, "uuid": "676cb162-0a44-4733-9022-35508ed88532", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "de3a5be9c1f9b4dbf905b3d5ad02cadb83787233", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698017728, "uuid": "ecf889d1-a4da-43fa-8099-644114ea097f", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "2ba7d3e8676202cb1de87177c1557896a1b59dd627e8869e57984792e2fc37c0c567a03cd6508b3cfb354fa64ab1c304", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698017728, "uuid": "697151c8-1650-4746-8a8a-6d1eeab21e16", "value": "T1E534AE01B6D1C473D572153609E0EBB55A3EB9700AB29EBF67E40F7E4F30281E621A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698017728, "uuid": "1de7974c-eaa0-4f14-85c8-3030cf28fef6", "value": "4f0cdfd3e1be2bc790b5aa9061b7d52c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698017728, "uuid": "4eefb558-55e8-4d07-850b-e85c2c82360a", "value": "6144:7mbX4FIRd5DzznuBosiDKl51eAORBozDKPs6/laTi:74IKd5DPyefBoGrkTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698017728, "uuid": "4d6787d7-bf46-444c-9ddc-a47a7bfc999b", "value": 235520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698017728, "uuid": "4c49317f-680c-43b4-b0dd-0b37728a12ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698017728, "uuid": "a1426385-b7ef-40bd-8775-2a2800a74926", "value": "1df3a5bb06cc6d4176fd4bb3fe5f6bcc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "499d18cc-70ae-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697960435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960435, "uuid": "27bc558d-c6f3-4d02-af79-3851da418798", "comment": "Malware payload (AgentTesla)", "value": "03fb76f83bae0f48c92601adcc0811d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960435, "uuid": "a0acd744-5a9a-45ab-a10a-9b6b85c16c5e", "comment": "Malware payload (AgentTesla)", "value": "31c199d5367f91b9db1140cf3718a91c569e124d20b5a7121c877d9d19d64075", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960435, "uuid": "94579712-07a3-4103-93f4-855950dfa184", "comment": "Malware payload (AgentTesla)", "value": "51dfe91de60bb5390fb766005657b73214192a7a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960435, "uuid": "892c1e61-9051-4013-9d67-8f3fccbf7010", "comment": "Malware payload (AgentTesla)", "value": "24fbc48d0732e87823e8f91c772a642f7e8ea14d6bff9bbb6341ed0ddea7e178b9c64be7bd2bcb872c4a0c0245a9a06e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960435, "uuid": "97824c6e-d6f1-4c08-921d-442e565f9b5c", "value": "T10AE4224033F41B27C1B9937AA4264341D7B72198AA32E729AD9DA5F63D37F8C4701E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960435, "uuid": "e8772999-2634-43da-b9b5-434fda780c66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960435, "uuid": "1e11bc8e-b26f-4826-a25c-a36001e0b4e3", "value": "12288:q61K1vjJGGna1ZX6/lqWchWP6kLWJ9wYdUuYwP7msg0n1POdUVYOa7q1:z1K1LJ1na1w/HP6kLWTquHPC90n1POWt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697960435, "uuid": "7172f0d8-092c-4d44-ae3e-3708a1e70e35", "value": 668672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697960435, "uuid": "b77b3d0d-5552-4f3a-868f-9ed5a3559ed2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960435, "uuid": "6e5362a5-c114-40e1-a3d7-d64e0040753b", "value": "Gibson Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b521bf6c-70f5-11ee-8907-42010a9c0042", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1697991110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697991110, "uuid": "1b6843e9-7324-45c3-ae19-fc9a6dcd0970", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "187aabdbc9fcc32821e4f9b558f966f7", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697991110, "uuid": "ff4fe5af-3caa-42ba-aa5d-c539fb0f97b2", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "32dabc2870dfd083f634dd632a0d62055c31162b7b5506612913579a1152c6eb", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697991110, "uuid": "752f4e32-93a0-4367-a369-64b1446c5316", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "946b1041259f37323afa826724a56e3d401f1c36", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697991110, "uuid": "3086285c-07d8-476d-b9de-bb63636a4f8b", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "f7c5e3207eb5371aa5b86679063b3814bf2c2e3cd9c05e95fef54936f1aa2c505a239d3c2a72b852f58482ec78c6263f", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697991110, "uuid": "8850b47d-6147-47f5-b780-98096902e25b", "value": "T1FE04CF257A90C032E4A758350970C5A22B3BBCB2AB7580CF3B683E6E5E716D05F79753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697991110, "uuid": "dc9f5017-ea4a-42da-9566-11fb507fc3f2", "value": "d2a54e4207f7fb1f334f58a667aa3417", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697991110, "uuid": "e2b95503-16d7-48cc-980c-6e8dc7595348", "value": "3072:FyBNcfzg6A+ouA3lKzqM632Tfusyam35ZllOfyuvTaioJQX:gsdA+PA3g5Tf3yamfHO6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697991110, "uuid": "d0e3513e-3246-4470-9eec-59b78b2b96c3", "value": 183296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697991110, "uuid": "45e119c5-438b-4de6-8e08-42f873a7f09c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697991110, "uuid": "41110bad-f1fa-4585-a39d-e2b9aee3303f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "314c76a6-7111-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698002915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698002915, "uuid": "f70697d6-5f28-4150-a3f9-d969b53a2b59", "comment": "Malware payload", "value": "646396a1f9b3474ad8533953a3583b4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698002915, "uuid": "32f956ac-fa18-4484-ab92-730cd224c4a2", "comment": "Malware payload", "value": "3407337dea12501ed2d524ed049d69a8e188bcd585f1a4055b60d4369cfc348b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698002915, "uuid": "daf6b9a1-a451-49d7-84df-0c0d913666bf", "comment": "Malware payload", "value": "9cc3b41381d97196f93d2d551492909d82f58dde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698002915, "uuid": "af0acfe1-7320-4c61-88a6-b582d60a4af3", "comment": "Malware payload", "value": "3170d045982fac905a98849efc50a10ac2734787c9be4bb942d193f45b06b8efcd55fef3b0a00acf828ff32ba3486946", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698002915, "uuid": "06ac47c0-d7a4-45e8-a35a-55a9fa6b6e3d", "value": "T198862223B5A1803EE5B292304C6F5E7096A57C338A754057F6A0FE2D2DF4991B923F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698002915, "uuid": "e1069f79-2700-44af-b0fe-907b93e3ccff", "value": "c9f6293768acf0fd0e2124a080e7bbe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698002915, "uuid": "dd1a5139-e58a-4e21-a388-ba5adc8c9c53", "value": "98304:UQx34LKr2YB0GY3FzbqHBQvt0rV1WrMxQZYghc1WCBwOSbjCsLWlSp260ebw:R1qgzYV6CsLkRhcx06Xm0e8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698002915, "uuid": "30158be1-1b66-48cd-8973-ba99933be9d4", "value": 8047760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698002915, "uuid": "5cc0552e-c688-4d78-9e79-a6804068563c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698002915, "uuid": "1594cfa6-8ba1-46e3-8659-59b5391c80a5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f17d0467-70b8-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697965012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697965012, "uuid": "3b78b710-ebad-4abf-94ee-401a76b7537d", "comment": "Malware payload (Smoke Loader)", "value": "ed48bd20cf24f144b36702b2ef073aac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697965012, "uuid": "c28e364c-7ccd-4770-9413-3769ea932515", "comment": "Malware payload (Smoke Loader)", "value": "3527cfdc23a8ca795809da61e9653772955d9ede01ca8e0ba2176451a8c84df7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697965012, "uuid": "32c26b1f-d661-4467-a444-25e26d9f58a3", "comment": "Malware payload (Smoke Loader)", "value": "7df782ab3f4e1f8485c5a6c0bd48ff34001d9166", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697965012, "uuid": "5b0e54c5-932d-42ef-b314-ea8991cf3bfe", "comment": "Malware payload (Smoke Loader)", "value": "278d3e4df39085ce238f74e130f2a159605ab00e26653b40bf8e5d48e27eec5dddc01950bd854e383166c87107d1a83b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697965012, "uuid": "fc5cd2b5-29dd-474a-ad5d-c961332e304c", "value": "T1BB44D02176A1D836E57759344970C6A12A3BBCB2AB7540CB37603E3EAE712D18F71B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697965012, "uuid": "0742e2ca-4e5e-4907-9435-761619693b64", "value": "fc20e897770322541e2213674466dedd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697965012, "uuid": "d5d5ece2-a9ea-4aec-98a8-8abaa7c89b80", "value": "3072:HB1BNweJAamQC5Pr83qLleWJ22wnvACeQa2h9uw9jNPF:F+oAa7C5jnLmvQA9uwhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697965012, "uuid": "5615690a-e531-46e9-912e-fb8292daa9b7", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697965012, "uuid": "a775af2b-d1d2-4759-aaa2-2ef5cff423c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697965012, "uuid": "c99bf0be-f493-4b64-b6e3-7c74a8d05cf4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0da0aa2-70b4-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697963185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697963185, "uuid": "ffb1e305-a603-4f6f-a70a-9d50466ee9f0", "comment": "Malware payload (Formbook)", "value": "df247bbfaf91dbe0da4d79a04cfb5ca3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697963185, "uuid": "59813960-be70-4eb4-84e5-ad0214524320", "comment": "Malware payload (Formbook)", "value": "354bb2d5a03e3c1d041730e3478e80ab5a264fd852e146e880834a346fc63579", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697963185, "uuid": "77e0d204-6270-41c6-ad6a-5d3325ae72fc", "comment": "Malware payload (Formbook)", "value": "0d29cbfa4b746e71c680bbd56a6c51964fd9b1fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697963185, "uuid": "5cdb24fe-47b1-42a9-94f8-0f4870cb1d9c", "comment": "Malware payload (Formbook)", "value": "90065396a5ee0ee9bf38341f9733a3f3b84858a16ebabbd883c0f3a4a4e8bf53a04614129e8e283ef5bf2164d07a5d98", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697963185, "uuid": "aec3fa49-9837-4f8f-9e20-a95351e55028", "value": "T103941253F5D1E8B9C91349B31432375A2DAADEA45F593A9207C13F0A3BB218318AF947", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697963185, "uuid": "ae8e9b0d-e2bf-449d-848c-5267b9e0bf16", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697963185, "uuid": "dd9f06e6-fdae-4927-9711-1d9f21e14f1d", "value": "6144:zfL+oqgoT3oPrD68F2PD44p8Ls1k7n82iKGI3TmBp6CbspK7M2jtsftCq9CPbz:zfLCT21oy82PGIC/Bb8K7MNCB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697963185, "uuid": "da495267-28ce-4939-a288-b61bf59b53a6", "value": 436964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697963185, "uuid": "4aba068b-3384-480b-9b8a-981bc3317b6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697963185, "uuid": "825e5c60-58fe-41e3-831e-e2acfcc48cc2", "value": "df247bbfaf91dbe0da4d79a04cfb5ca3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f7cfaed-70f7-11ee-8907-42010a9c0042", "comment": "Malware payload (CoinMiner)", "timestamp": 1697991771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697991771, "uuid": "4a15e222-bab4-45f8-838a-2459417a9d64", "comment": "Malware payload (CoinMiner)", "value": "2722b0312c2e8cb299647d97225c17e6", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697991771, "uuid": "4c0be1cc-f089-43d1-baaa-2ffabdddb0bb", "comment": "Malware payload (CoinMiner)", "value": "358cd94b404d08274eb01e5466ef12cb8ddeb4ef8524d7cb501077503aac6911", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697991771, "uuid": "cff63323-2b17-4e64-a460-3663e073ba52", "comment": "Malware payload (CoinMiner)", "value": "0961bbbb6a87e68c97db29e57a878c0204029bcd", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697991771, "uuid": "e34a516a-e331-4e3a-93e9-255995670880", "comment": "Malware payload (CoinMiner)", "value": "3ddb8b536cf8495ae148b28c80f948737b1fe6a3268f3f0d32930c6f660996abf2cf22e5f171e3e522dfe4a5c38ab174", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697991771, "uuid": "33ec014c-15f3-4b00-93d6-4cd4f441c09d", "value": "T10B04CF2176D18032E0B7A9341970C6A52A3BBCB3AB3544CB37943A7E9E713D08B75B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697991771, "uuid": "82ae6291-7924-4d11-a531-c8063e2d9a84", "value": "6ae03e1897875cb6ffee8a530dc88389", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697991771, "uuid": "9bf6279b-f6db-4a9c-9385-4f9071332e42", "value": "3072:Z1yBN6fur6AIscrbx+MkJa9ripeH7ewpNnrvIl6QuwNMPGROY0eQX:Zw7+AIprbwMFrbewnjC6Q0PqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697991771, "uuid": "6963877d-014e-4cd3-85e3-5715a50d8369", "value": 183296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697991771, "uuid": "4546674d-46e5-4d75-9d83-e4a62129ce83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697991771, "uuid": "5b043d2f-6526-4d6e-9814-5c061996742d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af24616b-70ab-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697959317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959317, "uuid": "8998050c-bea8-45a3-8c7e-97fa434ec781", "comment": "Malware payload (AgentTesla)", "value": "43ca669acc975ba003dd6a4486192b14", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959317, "uuid": "2680b043-5181-45ee-86b0-85e51f64d349", "comment": "Malware payload (AgentTesla)", "value": "359ee2cac1b16c368eb3082646be308ec2f771bff16429019b044da002dfa80b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959317, "uuid": "facad7fa-83a3-4ec4-99ca-0d88e30d7e3e", "comment": "Malware payload (AgentTesla)", "value": "dd378a7b7664b4206949073a908df46b24fbb171", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959317, "uuid": "84e9d576-6da2-4185-a178-5b5728173054", "comment": "Malware payload (AgentTesla)", "value": "47124a7e1f5d6c62d1023dd7a8c9097a798d8537ac06be7e96ad2e80f15a5162cf3d8d39d819aab6a2feca3b8474bbec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959317, "uuid": "be66836d-6a90-4dca-a778-9c2be8242cd3", "value": "T1F9D412A57700B26FC09786799AE16C645731783BAB1BC207589310ADCD8D6AFCF01AF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959317, "uuid": "c796112d-e7c9-48d8-82be-08d799ff0317", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959317, "uuid": "e76f354d-55ee-4ea9-8173-0fff9120db4d", "value": "12288:wh/j9vRrDaGYiZX/gR48jLYZw3Q6Z72dItnMDn89iH3UYRWsDOqBtpnEAV0xj:wL1RruMZoR48Hb3Pwinc89iH3rYsDjBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697959317, "uuid": "8c02dafc-08c2-4e0d-ab3e-ece888f4667d", "value": 642048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697959317, "uuid": "2a57dc8a-3fb4-4013-98bc-57a08bd8a122", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959317, "uuid": "4200fc1d-cc2c-4ce2-a4ad-1e9045af954a", "value": "jYleok1vDS1Pl8V.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5a16095-70ab-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697959328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959328, "uuid": "a1ca5cd3-9177-43d4-9ba2-fe195efb56b5", "comment": "Malware payload (AgentTesla)", "value": "0a01b3fa51a434cdc96fbc5e63a7fefa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959328, "uuid": "55b1ae5c-de48-4be7-ae5e-dfb20ff30221", "comment": "Malware payload (AgentTesla)", "value": "36cdd1d2327dd59355dfb9e8f790ae0a992dc957d602af2c30d70e1caa6d56b4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959328, "uuid": "56434363-7b1a-41cc-b91b-9ebdd2b4e666", "comment": "Malware payload (AgentTesla)", "value": "49c0f2471e2e87b37474a04520106c5490db7e34", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959328, "uuid": "17b8dac6-264b-43de-b792-5be4f214b62e", "comment": "Malware payload (AgentTesla)", "value": "5444a95533b0b7a91495a4ef76381c44444cf2b396cd5f16acc1c5c4605428f0f9ba8ef12734faa9c2bcecf8b7b1e063", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959328, "uuid": "13bd9bc9-c932-49a8-be1b-7b74ce040efe", "value": "T1BFD41298B350B6BEC567847BD7E02D94A320647B6317D603A54721ED8E4ED9BCF00AB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959328, "uuid": "c7c2e5cd-aa67-4638-9627-eaaacdde3d28", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959328, "uuid": "fbd0175d-24e6-4212-8b95-0544655b20e6", "value": "12288:y/joyN4zIcwznnCidtsBB/US1twOxoxVwwEvq5wSbI2l:yLoyCzbeCizm1LoxewR5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697959328, "uuid": "011a28fd-ac34-444d-bafc-a024d99a4eb2", "value": 646656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697959328, "uuid": "e6e4f15a-e538-453f-9be4-5a6aa7ba7108", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959328, "uuid": "febb8f6f-e2f6-42f9-8210-f76810db6528", "value": "Price and Quotation List.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47fe7fd1-70ae-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697960432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960432, "uuid": "942f695b-c3c9-4fbf-b623-7e957baea49b", "comment": "Malware payload (AgentTesla)", "value": "a48e58af1222debeb89e3d35a77469a1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960432, "uuid": "6546e227-a0be-4c3d-8122-548e4fcaeba4", "comment": "Malware payload (AgentTesla)", "value": "3727dbb8d08291962eb02e9b76df93a7dcb3f15751ecef1a80c511225a07d0c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960432, "uuid": "81f11cb4-f381-4e51-9274-4c50829cac90", "comment": "Malware payload (AgentTesla)", "value": "58a950dbdea37efbbf939f51a83739840ed84625", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960432, "uuid": "512d562c-97ca-435d-825d-af236bcaabfe", "comment": "Malware payload (AgentTesla)", "value": "d94bdca9329414ff14a8c5d7e1f9c48c0b709f5da1cda468eaa67a38c1e2b97e8ec1e5fee69d6fa3e29f7d0122ae5abc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960432, "uuid": "ef6c88ac-08b6-49ce-bc07-58e19cbfa34e", "value": "T1CFF4CF9C365076DFC85BC8729E681CA4EB20697B430BD203A42325ED9A2D9DBCF155F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960432, "uuid": "311ae28d-c3f2-4b42-ae3f-a657c77c3c6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960432, "uuid": "46336632-3470-4f29-88cd-a3c0717218ba", "value": "12288:N8owUt8zS55mFztNIYStXXKLpOADMpWR+uZBK1xB2K3UwgLoI4Gi2Rc2z173Nonq:Npwkf55q7IYAQpOpWJBG2oUHL5PR11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697960432, "uuid": "47b9ca55-cb68-474c-b068-9e26fb3a01fd", "value": 771072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697960432, "uuid": "a8d5efa6-5c91-415b-b134-60240336f681", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960432, "uuid": "d5ae8852-ef6a-47a5-a90f-e9d8141cfdf1", "value": "SWIFT MESAJI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02703bee-7093-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697948719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697948719, "uuid": "b0703b15-c922-4aaf-91c5-52c718536d96", "comment": "Malware payload (Formbook)", "value": "06144fba7a28e3aaa343f40fb900d879", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697948719, "uuid": "6fb5f69b-0061-4fd6-8d8e-ad7da3e29479", "comment": "Malware payload (Formbook)", "value": "375af608fbf3d324111085e5f401e6c58c078c613ce66336e922256645e2b4a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697948719, "uuid": "d138c184-3700-4949-9244-5859d398c70a", "comment": "Malware payload (Formbook)", "value": "2e5fd0917edc88efa1dc6daddd5d55970a0e8c95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697948719, "uuid": "a2e51d3a-3646-4d18-8e62-458f0dae6a34", "comment": "Malware payload (Formbook)", "value": "f4daf482df3df1257413dfa73cd2bd557b24f9df8ae03bc488c1e0845581dfedfae737d0528769d2befb9bc0d809bb91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697948719, "uuid": "6c3a42a2-54b5-4f9d-932b-8628a989ff63", "value": "T1A3158D2178C49176EEF320B787ECBA36426DE0B4071916DF06D817EED7606C27B32696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697948719, "uuid": "7ea92424-5f21-455c-9f00-ba33c09bba67", "value": "4c2ede2d1d1824f0fded580996722f5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697948719, "uuid": "ae143ec5-a712-48ed-91d7-e434abf21f8b", "value": "12288:i/5XAW9g1Azv0X5tH/SlVceJnMa5ifhNYwvumoQbPvTm0:iaW9g1Azv0X5FMHz5ifxz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697948719, "uuid": "3147340b-c421-4868-b0fa-e6fbde5ca2a6", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697948719, "uuid": "8a4906c8-6efa-4eff-bc5e-adfab1bab3f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697948719, "uuid": "cec54e1b-9453-458e-8d9b-b5cff276c5c0", "value": "06144fba7a28e3aaa343f40fb900d879.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a61bfc36-7078-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697937398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697937398, "uuid": "e3c80b50-4697-49a0-95f8-6ab0a490490d", "comment": "Malware payload (LummaStealer)", "value": "80fa72e2578adb4baf42d81e33f021d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697937398, "uuid": "8520bfb4-854c-4ada-a8bc-8f56581faec4", "comment": "Malware payload (LummaStealer)", "value": "37c4065e15a6bb998de669ef42bbf6c8970acbcd9806b2a398739b9b2b9a2dad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697937398, "uuid": "3991a0e6-0041-4401-a4ea-fc44cfadc72c", "comment": "Malware payload (LummaStealer)", "value": "a5d180db80b1f686c4ef2afb3249f9c033a72e55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697937398, "uuid": "9921c56c-cd33-4c70-8cc2-47fbf68fe9a8", "comment": "Malware payload (LummaStealer)", "value": "29b99b4f255c2e4022ddf55bb95ab212fd08a456ee0387c3d07ca298daac84e567836cd1b9349b611607c4576b77d65b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697937398, "uuid": "7483fa72-56da-43ea-ad69-49afdf9f3049", "value": "T10B652392BBE81563DDB56F306CFE07832A32B8259D7101673601989A5DF3BC4B931B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697937398, "uuid": "f7864217-5fc9-4f4c-97fa-f171420b53f4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697937398, "uuid": "e02ea4a1-2731-4864-825a-77ba7ae1fbea", "value": "24576:syUTv3jbY+Qrfj35FYjNlBYxA3VYOWbv70+wW8lQSedd3vQZYPnmLZCvcnHwxzLG:bULnY+M4jjKWVCeIoZsGhUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697937398, "uuid": "9ccdd67d-2c86-483b-a474-236db1bd61a0", "value": 1497088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697937398, "uuid": "ce2fa0fb-41fa-4777-941e-f4a697f21f0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697937398, "uuid": "9960759b-e5a2-4b94-ba54-df4e10e00526", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7784b947-710a-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1698000026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698000026, "uuid": "99ba47c9-a7c2-47b4-99c4-6627b8496fd0", "comment": "Malware payload (Amadey)", "value": "cf231a8a237f6a09d48f229ff26fe1e4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698000026, "uuid": "bbf81207-f199-44fa-99bf-f5ceb8eef3f2", "comment": "Malware payload (Amadey)", "value": "3861572608ff98d5b620849e73d67dcf776eaccecfe7f59e9c27871ea294fc31", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698000026, "uuid": "139903e2-aee1-47f9-b0f5-faba15aba150", "comment": "Malware payload (Amadey)", "value": "f2f407ff72281c23cc695c02088df0732f6f7d43", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698000026, "uuid": "0a6e9726-d022-4196-be28-066d725957ea", "comment": "Malware payload (Amadey)", "value": "1b9635bd24df8a7e1a4dfe1b16ac728a00ca19c9f06a778fc54e8e2b9d9db7c6457db81d49e038c66a3dad85b9f68483", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698000026, "uuid": "721b32a7-fe87-4147-ab13-73c28ad4e27e", "value": "T1CE852352A7F44826E99417710CF703A70B383EA55C3893AB2386B8391DB35C465BB77B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698000026, "uuid": "d8f7913d-7e88-471a-8b10-2ff4125ebc96", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698000026, "uuid": "97425b24-f3c4-49ae-89df-fe8871c09663", "value": "49152:3jio9Zj5zq0ue4vpQI6m5ik0kiQgQZeM:OQZjY0ZkYxjFQZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698000026, "uuid": "0c57b1ea-a9dd-4fee-8251-3511b0da446c", "value": 1826304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698000026, "uuid": "9d4f0e5c-b221-4873-b8c8-81e86aab4438", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698000026, "uuid": "af049ad5-4c6b-4e99-bf9e-22cad974afd4", "value": "cf231a8a237f6a09d48f229ff26fe1e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f634e46b-70ae-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697960725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960725, "uuid": "426f084e-d0c0-4250-ae40-c5435fe87e86", "comment": "Malware payload (RedLineStealer)", "value": "a72b2306bc20879e31bfbad4dcb05f29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960725, "uuid": "c47a93dd-259c-4827-82f0-24359da14c8f", "comment": "Malware payload (RedLineStealer)", "value": "38c476f08a27cbfabad4caadf3c53ff811b98633140aaffb66d2cc6d08cfeb8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960725, "uuid": "3957a972-1c8b-47a2-bd60-c894e937c52d", "comment": "Malware payload (RedLineStealer)", "value": "5461e3cff2bc78c2921172fc629ae435d65c0023", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960725, "uuid": "b7cdf176-d6a8-4360-a2cf-f34960ac3793", "comment": "Malware payload (RedLineStealer)", "value": "dc849a077e810a1e4286d51227facdcabe780829fc3260ba1c38099869c22b9fd6290078ca7474df5b10d7f0cc8e9d34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960725, "uuid": "75df98be-f9bc-45b4-af02-c4b3ba5b07f1", "value": "T186349E01B5D1C073D473353506E4EBB55A7EB8710A66BEAF67E40F7E0F30281D621AA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960725, "uuid": "d2e3ab1b-6226-4b96-98b4-daba303fe04d", "value": "a5b89b7089ebc12b19d0fac57b103ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960725, "uuid": "be2b683e-3593-49d5-9f6c-afb084137c49", "value": "6144:ieKxTJkr6PxvVeLZ7a6wkikrL/q9AODx52DONT0Z:tiJkuPxy5UlgO0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697960725, "uuid": "52df0272-ca6a-4a19-848c-b6ed37d312b7", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697960725, "uuid": "a1bf1109-1928-414c-aaf7-9d01e84ad832", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960725, "uuid": "b6cbbb79-5c75-4bc2-a1e1-720601764e65", "value": "a72b2306bc20879e31bfbad4dcb05f29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9757786-7105-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697998043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998043, "uuid": "fda695cc-7352-4a49-9e52-0b64ff90d770", "comment": "Malware payload (RedLineStealer)", "value": "770309f26fbfcd0d2644505278d94275", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998043, "uuid": "06bcfad3-b74d-4a66-8bdf-b1806fc8a0fa", "comment": "Malware payload (RedLineStealer)", "value": "3900732ea6c2bfc9941a4303d043e4d043cbd0d4ad4d7b674c2bbf71f2d1bcce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998043, "uuid": "123d751f-469b-4087-8bb0-8eb5f7ca2892", "comment": "Malware payload (RedLineStealer)", "value": "3f13056bf3afcfd883d24940ecec938eb0d08aa2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998043, "uuid": "5c4155a3-a16b-4663-bd39-b202bd20279c", "comment": "Malware payload (RedLineStealer)", "value": "c6d57960e4065dcbbb9e93b50d8fd2079599750e632edbddcd5bf37c6d91e2ca11f31508f63701fb92fb0bc9b48897a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998043, "uuid": "12696056-754e-4a3f-bb75-8865d446d2d1", "value": "T10C7523806BE81012E8F81771A5F316871B327A625C35876F63D29A4A4CB32AD7C3577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998043, "uuid": "c92470df-c96a-4db9-9ed5-2ac8d91a657a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998043, "uuid": "50c393dc-6c3f-4dbf-956d-e117ab840a9c", "value": "24576:jybDSy7r3xYYssxjfpT8nzC5/2E2mn+u07Kd5F4llPegz1qI3oStSCv0Kx:2nxYTsvmQ/2E2mn+4+k68I170", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697998043, "uuid": "24f840bf-3072-4d86-aa7e-d140a5e58299", "value": 1555968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697998043, "uuid": "1e07bd24-280c-4857-a2ba-296086423438", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998043, "uuid": "d61ea9e9-deef-4014-95a9-f0fe62fff7cd", "value": "770309f26fbfcd0d2644505278d94275.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf59b8c7-70e4-11ee-8907-42010a9c0042", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1697983852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697983852, "uuid": "4a5af764-689a-4c67-90ab-eac4a2677a06", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "b39551b8a1458013a1d47648ba905f4b", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697983852, "uuid": "88ec316e-9dd7-4681-a388-f67918f5589e", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "397d983d6b563a2f6c5e6677c81f7fc5baabf2c8474a9026be64b2574fc3701e", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697983852, "uuid": "e436d711-71ca-46bc-b2e4-32ccc61a32ed", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "c9bdd8bf65f0276f48b4b1f2d83b58c6c5e313b9", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697983852, "uuid": "782e4a31-ad97-4ca9-9f14-fd371ff722ef", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "bcf8a6b1fbf4368015941c9d685c4b1b231835493252bd779fa0b8e6912a24e1c34f153f09db26859e292e57acb24cbc", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697983852, "uuid": "442726e9-7540-4fa7-ac90-c8bff85fd250", "value": "T18B3419657912C032D660A5B619F4BFF2C19DA815ABB149EF2B800F77DA112F33970E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697983852, "uuid": "b08172db-586f-4d5e-a824-0fe82b64fb7a", "value": "3865972614d44e518713c9a6183fed14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697983852, "uuid": "814b5d2b-a17a-4a8c-b053-137eeb1fc2b7", "value": "6144:LEPAc72ss5pKL93yMax7pH3F2d1ugMeSWp:LE32xpoaxBFg1ugMeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697983852, "uuid": "6f4ea1de-c486-4aba-9ef8-d236885790dc", "value": 249503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697983852, "uuid": "954be4bd-a2db-4bf8-9166-73829381d3bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697983852, "uuid": "a938e7bb-ec3b-4100-b109-d4a87da5e4ff", "value": "b39551b8a1458013a1d47648ba905f4b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e45d12df-709e-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697953823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697953823, "uuid": "087e7eb4-8457-4a55-a5d3-7493783251ee", "comment": "Malware payload (Formbook)", "value": "ad2bd950e0346a6fd9c2ed35f86660c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697953823, "uuid": "15f460ee-b256-480a-bd37-9e6beec26d48", "comment": "Malware payload (Formbook)", "value": "39aeae7fc4ae6d53c886452a12738b093e4b1cd9c7602be5fbd567b43d073ee2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697953823, "uuid": "06143784-4a56-4876-99cb-f9ab10f4b3fb", "comment": "Malware payload (Formbook)", "value": "c9c7af2402b81917b4ee3c80be1ae98b4cf61e7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697953823, "uuid": "00c229ba-0ad7-4a46-8bf9-65fbe6da260d", "comment": "Malware payload (Formbook)", "value": "f2812161f2d6ec804b0dded5fed4cbe92323e1436d4f4c0f76144d8ee650e10a7289561f8ac880d21a21124170171199", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697953823, "uuid": "3fe585eb-8751-49a2-bf6b-13d766d3dc64", "value": "T178158D213980D132EEF320B787ECBA2542ADE0B0071915DF96D85BEED7606D17F32696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697953823, "uuid": "af88b09d-4dbe-4557-957b-f71a5ca4fa44", "value": "440e77e14aa712e0e687ae6e10b63f30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697953823, "uuid": "cb2016db-f449-4c47-a473-16b4c4e3102e", "value": "24576:pBmtwAOC4b6HtHHHHHHHHHHHEsydhVrjepS:GOC4b6NHHHHHHHHHHHah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697953823, "uuid": "c649b710-e140-4d93-9fa0-1b8ec6237f78", "value": 938496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697953823, "uuid": "31efe44a-b47b-42e1-bb98-d66929d4c134", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697953823, "uuid": "77766ee5-b0b5-45df-a088-3ee659912393", "value": "ad2bd950e0346a6fd9c2ed35f86660c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1da4a60-7104-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1697997654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997654, "uuid": "945e45ce-3652-4632-b8c8-b880157a1608", "comment": "Malware payload (RemcosRAT)", "value": "e96e1839b0510dc2530c23cf5d9f9cd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997654, "uuid": "d0637d49-950e-4d1b-a5b0-70c34bd37db7", "comment": "Malware payload (RemcosRAT)", "value": "3a1f5e5b3bac9dd6da9980c66cf04cd274031cd3d7dd005c0e7250de89855663", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997654, "uuid": "bb4278de-12a8-42aa-b9b4-3d4a5d0b58f9", "comment": "Malware payload (RemcosRAT)", "value": "7ec9c3a39e6633a4041994f6a8ffaeaa4f34481d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997654, "uuid": "f276f19f-4e4c-4dfc-b392-1d4da9058f00", "comment": "Malware payload (RemcosRAT)", "value": "fa0d1ff4207a790e63e3aa8f31ea4a1c405dc2d53d1a493f6a167b7643a918a64ee912779bc100d813b5e2f8eadb1043", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997654, "uuid": "f724d859-36a4-4dc7-9d70-6e8dbd065fe0", "value": "T15E253350369F82BBE85CA8B3F4E783545B71E4EFD40BE72F1EEC265D20057C2A6065A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997654, "uuid": "e1c614a5-89df-422a-a14c-d7e1f8902d78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997654, "uuid": "8d109dde-9ae6-40f0-bae1-8c4322e522b6", "value": "24576:U2AhIXPo8S4lKIWtHASEmyHC5X+soDrcErJSKHgPc/kz:uWXx7lKIiH9Em2CmDrcoJSKHrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697997654, "uuid": "9aabdd10-8858-49ab-af4e-cd1617f3b1a1", "value": 1037312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697997654, "uuid": "5b9c6f63-0218-4806-ba9e-e7a01acceb8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997654, "uuid": "2f80cc7d-b6b7-4799-bc57-003cbf71442a", "value": "e96e1839b0510dc2530c23cf5d9f9cd2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62820094-706f-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697933419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697933419, "uuid": "ec64a296-feb6-4a30-8ee6-92efd13a31bc", "comment": "Malware payload (LummaStealer)", "value": "03adaae1d1b7eb5d9ddaf153cc1154d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697933419, "uuid": "1caef787-b3c2-4212-a5b2-e97a0b1421d1", "comment": "Malware payload (LummaStealer)", "value": "3accb6291ef265dcbd061664e02c3430f0858ad076e77aa66b315f7c91b4eeaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697933419, "uuid": "2fffe496-0154-439d-a9a0-871dea5b384a", "comment": "Malware payload (LummaStealer)", "value": "267d1ff91e07e34fada1e8ae6b6a256b821847bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697933419, "uuid": "06c5ea28-10fe-4b42-8a1f-819573a91f0d", "comment": "Malware payload (LummaStealer)", "value": "21d2d735000c5b0d49cae373b6805a9dfd089ec062bb66ad8ea098e8a2c4658bad17ba75d2dbdf773dfcd7f73ba2962a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697933419, "uuid": "a9b9d9d3-2fb2-4451-b961-ccc0179575fd", "value": "T1B5158D2138C49176EEF320B787ECBA76426DE0B4071916DF06D817EED7606C27B32696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697933419, "uuid": "6ef9454b-ad8f-46d7-9c25-d07bf0205e56", "value": "4c2ede2d1d1824f0fded580996722f5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697933419, "uuid": "9fa8451c-6d86-44bc-bf68-8e9b9f8f1a26", "value": "12288:sd5XAW9g1Azv0X5tHXSlVceJnMa5ifhNYwvumoQPTHm0:sAW9g1Azv0X5FUHz5ifxX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697933419, "uuid": "31678286-83d4-47da-af56-cbe91e0a8438", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697933419, "uuid": "61c96639-f1d1-4db5-a4b2-ffbe0c6bbc5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697933419, "uuid": "7ae2768f-00b0-426f-97a7-70af8646c2c9", "value": "03adaae1d1b7eb5d9ddaf153cc1154d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7be6af4-70f4-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697990765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697990765, "uuid": "38e874fe-5589-4e51-bc0d-33eb269e648b", "comment": "Malware payload (AgentTesla)", "value": "53492d6d1611bfefd27443a21b46bbe3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697990765, "uuid": "4ce1ea5d-ef49-4cc1-883b-8d4a3d0cb9ae", "comment": "Malware payload (AgentTesla)", "value": "3bb2611de3a7a698f49ab275bf39a9cf4845fec27f1158d2cf14a40bd1bb75d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697990765, "uuid": "0398c3e9-573c-41d2-878b-9bd2c31ffb8e", "comment": "Malware payload (AgentTesla)", "value": "6a49d1e2d050763187ac10f45c2c84214f49cde9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697990765, "uuid": "26e72fb4-b902-42ec-9937-b0c5bcebbd3f", "comment": "Malware payload (AgentTesla)", "value": "f49f6c51cb3e8cf526793ea9bff423d2a224fc3fb6ae6729fa7c5f94a19b9637593c65fa2ee1cd4486256af408fec70d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697990765, "uuid": "b0105a54-8744-4262-be8c-39c42a6962cc", "value": "T19055012973B85F5BE1B547FE4031019413F4252A5930F3983E95A0DF2EB1F289B92D9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697990765, "uuid": "86d86f3e-e1a2-40a5-8658-5949cb4246c7", "value": "12288:goX9KxWBkni/+YIplvdZYNwnmF5egDzIhsMIIkwmv3iwwC3D:gotEWslFZYKmzDzcslV55wC3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697990765, "uuid": "0a1bf9ba-2a4b-465b-a1de-6f05bb33585b", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697990765, "uuid": "f4598349-7849-462a-8e00-489fc3535c2b", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697990765, "uuid": "24f503a0-1e5f-4081-a080-1e57a817c938", "value": "MALBROS SOA M1123.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6142e9f-70aa-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697958953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958953, "uuid": "c043d058-1ade-4dd8-8532-889df8e1d81d", "comment": "Malware payload (Formbook)", "value": "7131f068a733b551e8950a7ad4dfe2de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958953, "uuid": "f978c9d6-e7e0-4b8d-a9a3-554c5ae8730b", "comment": "Malware payload (Formbook)", "value": "3cf758d2c8d5278c9469057a827574c6cc5aaf558f1e17467a341dd1eae306a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958953, "uuid": "47781b12-71a7-4952-a32b-f91f3645159a", "comment": "Malware payload (Formbook)", "value": "7af093f13992e56e9fcb649fdc7a682caa1a58cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958953, "uuid": "b2b926bd-3c87-44d3-8a81-62545a37b228", "comment": "Malware payload (Formbook)", "value": "067114e713ef1521925e895bf4d6f669e2a7f124bc6c36b1dac4b38d28fbe0be6a9674ce3e5907fc3df77a2ab073a3ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958953, "uuid": "8e108def-19be-4292-a186-209d5a1ac3f8", "value": "T1B5E4125632E99A23C73A5FBCCD616520A2F26C2A5C16D68BCDC132DE12CFB740611BD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958953, "uuid": "1527c9f6-da2f-427a-b089-412bf4122c2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958953, "uuid": "56320fa4-075a-4ab5-b6d6-50c32cc6e8d5", "value": "12288:dmKxt7s92w/c3z87ojZN5wjJF2gtt4clk8GW4+DDvDFw3c+ozNKxAL:dFt7s92Tuol2Jhttvlk8GW4+Dus+oz4G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697958953, "uuid": "ceae64ad-76f5-4f61-9993-706556bde022", "value": 700416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697958953, "uuid": "70b1ead1-6388-4b89-808c-b84a070c32c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958953, "uuid": "aae80e36-6141-4bc3-b10a-1a8a02c253fd", "value": "XOjonViZQlpsL8C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db4c2dea-709e-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697953808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697953808, "uuid": "531b91d1-03a5-4f4e-abae-7fa10de1cf11", "comment": "Malware payload (Mirai)", "value": "4a734c1696793c45439daf6e6be36ecf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697953808, "uuid": "c787cd0e-62e4-4a1b-860c-6ca287113179", "comment": "Malware payload (Mirai)", "value": "3d0b617a14a85af15f9bd1664fb6131e1974980038f397fdb8bcbed328750468", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697953808, "uuid": "d37af1d6-b7d8-40a4-a2f7-4e785f18861b", "comment": "Malware payload (Mirai)", "value": "39013400e02d1302afc8fe65ef60ee069ad8c0ed", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697953808, "uuid": "e520a9d5-0b61-42e0-ab36-cf7beedc22ed", "comment": "Malware payload (Mirai)", "value": "c981c11d461e2c39d1b73515c29051a0f483afa6ea1f944ec54bb0d9ca55d7dc3162523bbdf1357b06e9fce6b365d5b3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697953808, "uuid": "8ff125b5-e274-4b61-9bdf-718f2a63d7bb", "value": "T1A9C2E030A6EE2CB2C7500572F7F856C9BA430FBDFAFE2C90114146BA3D41D156ADA9C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697953808, "uuid": "065554d1-d47e-4762-ab66-5780ca200030", "value": "384:AOt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEt1fShymdGUop5hl:AWsoTAZ3alkXLvFh8nNEDqs3UozT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697953808, "uuid": "2dbb76c9-9c54-4218-85bb-de251683081a", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697953808, "uuid": "2dc62d18-9c0e-4ce7-886a-9a2e989d25f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697953808, "uuid": "ffcbc086-67e0-4468-979b-8234247e8c9c", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d447ba5-7122-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698010236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698010236, "uuid": "d63700d4-8771-45ba-98d4-f1abf9fac10f", "comment": "Malware payload", "value": "c73e323de6e1900606bba61106698ae3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698010236, "uuid": "9126925d-d068-4d6e-a8c5-57e8e06c782e", "comment": "Malware payload", "value": "3e5eb972ada7e1c4acc89eea60f1bf0042fa753c144f810ca458f42ee8878572", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698010236, "uuid": "30367302-d9d6-4145-8b5d-4fc5a166aad3", "comment": "Malware payload", "value": "6f98dbd2b7faf2656ad634511067d712cba37035", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698010236, "uuid": "c1a475dc-5cfb-460f-b811-887228154b78", "comment": "Malware payload", "value": "fa31205815a7f47d9a9ee877f3a6faf56d1048d7acdce2c0c46d684cbe7cb822c7d30bb76069f50dd63b598119b5908b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698010236, "uuid": "c6e5fb63-95de-4d2e-bd07-bef28605ccfd", "value": "T1E404CF21B6D0C032E1B368351970C2A11E7ABC72AB7550CF37683A3E9E717D19B66B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698010236, "uuid": "1bc1700d-f5e3-4cc1-a2a9-b0f4cce51099", "value": "b4dff5a08e23018869237b48ff2d1876", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698010236, "uuid": "8903d991-d6f9-464f-980c-91fc93364a16", "value": "3072:iyBNbfZueAnc2TnxshXwgj//rpBVNQjWjl3HOIzJh8GdBX:pvTAnXTnuhXwgjXrFN90IzJK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698010236, "uuid": "93efc90a-f087-4cca-b264-91e846727a0f", "value": 182784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698010236, "uuid": "c14ea398-23ec-4d2a-8803-3741a7ca535c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698010236, "uuid": "b00ed6e9-6868-450e-ac03-1102e55101f3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85c61b41-7121-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698009928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698009928, "uuid": "22edafb1-b62f-4107-b16c-da178a7f59a9", "comment": "Malware payload", "value": "47f987b03e24da52bfebfde931100fd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698009928, "uuid": "bfc4ceca-0e66-4804-8b36-6c903f852622", "comment": "Malware payload", "value": "3ec9c6f702632d0576786567b7cb5756a7de4c77e200dd0b744dc0e32f3e5ddf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698009928, "uuid": "da63621b-154d-4faf-9b13-42b8c306efb1", "comment": "Malware payload", "value": "9e3bab845efc3c82d28f016582dd2261b1213109", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698009928, "uuid": "6a54e0eb-30af-47ad-b35c-8c8330b2f14c", "comment": "Malware payload", "value": "bcdef7dc7ae7c77fa170aea93998a6df3152cc888dbe31e341eead77d95261c12bf64a324954985fbfae9254095f5c69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698009928, "uuid": "3e9b979e-5f8c-4715-a272-b96e945e44e1", "value": "T17204BF20B6A0C072D1775A31197082A52A7BFCB2AF6440CF37943E7E6E706D15B76763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698009928, "uuid": "bf68dfe7-eb1e-4f63-a933-067e85c5a56e", "value": "6ae03e1897875cb6ffee8a530dc88389", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698009928, "uuid": "5f72db9e-3b87-49bb-a923-299b8bd391b4", "value": "3072:9fyBN6fnr6AMsGrPxVCfRF7XN8wZAgjNyeaEBX:9O2+AM/rPfoRNXSwZbjYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698009928, "uuid": "826f711e-3c9e-4d53-88bc-cb762fc23651", "value": 183808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698009928, "uuid": "cdf15675-e730-4e68-9e30-90edf060244f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698009928, "uuid": "43a75b8e-6a78-4f57-ba3c-4196098b6868", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edf40a34-70aa-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1697958993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958993, "uuid": "86c90c38-90c6-422b-a24b-7b6375cfd80c", "comment": "Malware payload (SnakeKeylogger)", "value": "a73e719f752678044373f6040d958e99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958993, "uuid": "39ebcd5d-cf5e-469b-8688-b85e52a1ea18", "comment": "Malware payload (SnakeKeylogger)", "value": "3f17b75014b3eb38b7c62f4ced6ba7777733bdd04a164194afde81369ab9fb9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958993, "uuid": "32cdbbde-99e6-461b-bf8b-32c37966d631", "comment": "Malware payload (SnakeKeylogger)", "value": "ac782c945ea27230b1a87c6d1664cef5870540f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958993, "uuid": "5efbcc6c-c2d5-4823-a714-fd471f51d2df", "comment": "Malware payload (SnakeKeylogger)", "value": "3c27b4f1a1c499571fefa36e18ef48c236093acee37f62fa789a1a951f776ae866d9f397cbf53e6c0fa28869f7c9b3aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958993, "uuid": "9ba878eb-0cfa-47e1-9152-0f6fc0669b11", "value": "T174B412993398B2FEC933C1398AA41D586730647B9B6BC21668A714CDDD4E5A78F007F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958993, "uuid": "3dc258df-f7b4-499e-9f90-2b712ff0eea4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958993, "uuid": "da006c21-d9f1-4611-ab6a-517d168286d2", "value": "12288:s/jaavJ3PH+xVXbTUpYBFVUYpxsMstXWGogkqwz:sL/vd2XUuBw2xsMUWGZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697958993, "uuid": "8657b5ee-ed04-4013-9f14-4dd06729bc18", "value": 523776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697958993, "uuid": "a439df94-afd5-478d-90d2-23ff4540437f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958993, "uuid": "be906898-df08-4b14-97f8-c6adb22a0959", "value": "sfOaHOpvjEEpZRe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d349b00-70f9-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697992788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992788, "uuid": "680dd6f8-39f2-436c-a568-054671c29105", "comment": "Malware payload (RedLineStealer)", "value": "1dcc65367cdf5d7cb3531c1d682306e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992788, "uuid": "81b076ef-39a8-429d-b6a3-04734ce95561", "comment": "Malware payload (RedLineStealer)", "value": "3fadc1de1c8c15a141869be86b1afc68624dfec81775878cd784e59a108a071e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992788, "uuid": "fe853f61-726b-496e-b5ea-682e96f4ddca", "comment": "Malware payload (RedLineStealer)", "value": "851fdf258689898710103e080621d328d421b7ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992788, "uuid": "f3159cf8-1026-433d-9667-f26486efaa8c", "comment": "Malware payload (RedLineStealer)", "value": "650387b7ec2a4b06a6b7b53edd6e95a04ad9fd293fe3302bd302762fb50bfdd8d2499a3d47a1a81464fdfaa14ea72659", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992788, "uuid": "9ffde956-93d8-4d0e-b6e5-a0895209bbb8", "value": "T19AB46B51B0094F2AE3F2087CEACA5DAE4D507EED6F530B8F36C14B8167967D1A93910B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992788, "uuid": "c8375e85-072b-4b84-af11-f46d45e52029", "value": "d350427820086a321ccf21b695161218", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992788, "uuid": "f8a9249d-2a4a-476c-ac1e-62fb2f622bb3", "value": "12288:g8lL1Ur9QB2o97Hr62k3n/+pLsv9+eXUeF6O1L:91Ur9QkAr62k3n/+pAv+e3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697992788, "uuid": "b13ef102-07f2-4e96-8912-5f21cfb79bc8", "value": 507976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697992788, "uuid": "45f1190c-e834-4aae-945e-bbac7acbcc83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992788, "uuid": "45a63eae-5b6d-44d9-ba83-9935f5eeec25", "value": "SecuriteInfo.com.Trojan.PWS.RedLineNET.6.3700.32548", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "414479b8-70ae-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697960421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960421, "uuid": "07b396d8-52bc-4b58-a944-7f284ec4e6f8", "comment": "Malware payload (AgentTesla)", "value": "0535b224e7070315488a9adae46fe23c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960421, "uuid": "25ca4b9b-53e4-4e25-9dfb-a45f0b588eba", "comment": "Malware payload (AgentTesla)", "value": "3fe67d3a6b4bd8fe9b79ca73f3ec832a093005e8059a9f22e4cceb6ed7bb50c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960421, "uuid": "093b6ab7-3e8a-485f-9190-367fb7f51182", "comment": "Malware payload (AgentTesla)", "value": "6227adf385eaf0802a3e508bedfe4c72abbc3cc6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960421, "uuid": "60e37d05-a770-4c27-8f79-4d682fce9098", "comment": "Malware payload (AgentTesla)", "value": "e135d15699495e69b44ad6ea46bd9d7c390a3b631189784b57deb0ccd1235969aee54f2027ad5a3db662826e64231dbf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960421, "uuid": "93286cbd-da31-4dba-94ff-a96a6c2f48f0", "value": "T168E4124832248707E66847F12C358AA64BB59ED36653EA8C3CD576DF09FB7840213BDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960421, "uuid": "8c71500d-3a4e-44ca-bdc5-55fae06445a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960421, "uuid": "57c186ab-41ed-4483-a9d3-4aed4be7078f", "value": "12288:O8zS55mFzuxVr7Cs5L8q4hgG/W15wZwPebHqwvlKY3C+uItlP2e:Of55q4pR3EgTwuhwvXC+uItt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697960421, "uuid": "00f1a3fb-6dbf-4b1a-bda0-225477596655", "value": 658432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697960421, "uuid": "8be843d0-aa29-4ad7-8c5c-d5ff0e4ddbe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960421, "uuid": "38fe7513-aa7d-41c7-b780-ef262d03845f", "value": "4aTjWbZZ0o8x3GR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "430938d3-70e0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697981899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981899, "uuid": "1b114119-96d2-4c2d-8af1-9a5a074e85ca", "comment": "Malware payload", "value": "6189e07be41e4acb4e94dea3d149f7b2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981899, "uuid": "63ab2610-bce2-4786-ac5d-e257969d5c63", "comment": "Malware payload", "value": "40183148f52840484b1f6c2530b244957bef6b2c493109b52ff1b9e9e41eccde", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981899, "uuid": "3dce7492-4a00-44d8-ba16-a481a4999b2f", "comment": "Malware payload", "value": "384fa2a4d8e020feb1d148c884a5c77e0415c595", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981899, "uuid": "b0acc3d2-7c58-4249-b2e8-1c8d8f3cb995", "comment": "Malware payload", "value": "ffa172cae784644611be85398637c3ed97352bde151a13dcc58b49783f7f2082294222b565bda0c01fcd760938beaaee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697981899, "uuid": "4a0859cb-d141-4af5-8034-d3619b48ecae", "value": "T13AB2A658978F49F5CB5872334129484946FCB77EB30651FA78ACB3B133BE90C96A90B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697981899, "uuid": "0a60c635-89ad-4b13-ac2a-4de5e1747ca7", "value": "384:/E2l++W7i1+KZy6Fqf0abYeiO/IgsNMGHzJ+AqQiOVX5HusaD2:H6o+KZVFqf0aMeiO/IgsNMwzJyOd54D2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697981899, "uuid": "7cfac7cc-606c-44b8-9d55-56f7f7561d3b", "value": 24884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697981899, "uuid": "3536dfb4-e2f0-4b7e-9b14-8410e12d8e15", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697981899, "uuid": "43dc44ac-f426-4899-aec6-ba4b46dc306d", "value": "5ddc3f271cefc209efeec43e979753f10fcaaef355183a32eb75e15a.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "448f4605-70e8-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697985338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697985338, "uuid": "e05933b7-df00-4fff-a82b-60813a7966f0", "comment": "Malware payload (RedLineStealer)", "value": "e5f3d57228c890d9eac3e33e9a0dec31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697985338, "uuid": "517b9572-d77d-4987-a373-0b2137e50dd2", "comment": "Malware payload (RedLineStealer)", "value": "41352e9771b906b5913a9e6a9ecd3fe423bc3e91993a5373a67f7226a6eb6abf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697985338, "uuid": "2450aefb-fdaa-45d3-bc94-e5059c349007", "comment": "Malware payload (RedLineStealer)", "value": "941c05efc029a68413864ef9804242b72e6c3050", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697985338, "uuid": "710b0e7a-8c43-4100-b826-f3949b7677a5", "comment": "Malware payload (RedLineStealer)", "value": "5b212f9340bb2b4d4ca58638526338b9aea5ee3796e58e309368bf36c1c807ae4324dca527857c7f6a18f54cdedc15eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697985338, "uuid": "c0b9efcc-e305-47fa-9c30-4a81ca634a72", "value": "T183B45A51B0094F2AE3F2087CEACA5DAE4D507EED6F530B8F36C14B8167967D1A93910B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697985338, "uuid": "e2eef00c-fe09-44fd-bb85-c2349317c598", "value": "d350427820086a321ccf21b695161218", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697985338, "uuid": "6b03e98a-3876-49c6-81b6-c0b21be76553", "value": "12288:b8M07UjazQB2o97Hr62k3n/+pLsv9+eXUeF6v1L:CUWzQkAr62k3n/+pAv+e2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697985338, "uuid": "f1fbf0ce-a570-4665-9b83-c739fe5f5f64", "value": 508488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697985338, "uuid": "7b2cc02c-42a4-4195-a00a-1bc62d12f848", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697985338, "uuid": "dc81fffd-a9d1-4274-9809-44fb06c0769c", "value": "SecuriteInfo.com.Win32.PWSX-gen.11724.18545", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d89a75e-70c3-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697969595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697969595, "uuid": "22f7d2de-9f8e-48ea-97ae-ff6b6553c410", "comment": "Malware payload (RedLineStealer)", "value": "686ba7bc53b505598fa7b71f4cfa2295", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697969595, "uuid": "b0e8e161-00d5-4d31-a6c8-cafa322a4a0d", "comment": "Malware payload (RedLineStealer)", "value": "4193309d8a2a506d0726270845c5648d641cb275045a1b41f9423d64e4b9d2af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697969595, "uuid": "0d45313b-dfcc-49a2-b6a5-7d765340e773", "comment": "Malware payload (RedLineStealer)", "value": "f41b54698b4143f90f591cb41630e52fd3bea3ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697969595, "uuid": "63648e96-188c-43b1-915a-e752691e5b97", "comment": "Malware payload (RedLineStealer)", "value": "68280ead59f2436e5eb6aa52cae3ea1a179b3f0ead4612132b33a3b28404f574d072c602889529afe74023c9d6b96cb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697969595, "uuid": "905b1055-891c-48db-b830-8b3640378275", "value": "T1BC65230375EE5299E476277078FA43431738BC62AE78534A7BD2B94E0C225C8F571B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697969595, "uuid": "92129172-37f7-41fd-a141-a0981da1f364", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697969595, "uuid": "087d825a-1d0a-4a5e-8fc3-be5e497b8a69", "value": "24576:UyYjScM46ryOVfjBDh1CphPvAfdc8vnX//CCOt4Zdi/S9+QNZKRsi6sxIukRAAxc:jbP4uyOVt1Q6dvfPKOi/S9+QNsRtIukv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697969595, "uuid": "6a22a2ca-5c9f-4809-9d9f-74cd0b12042e", "value": 1493504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697969595, "uuid": "052a1f9e-9331-4fce-9450-aed61b1aece2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697969595, "uuid": "b9f6e3a3-3f86-49b5-b15a-e0cce8eed33b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa1eba7-70ab-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697959363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959363, "uuid": "7608f501-4bf0-4ef8-b236-86a34eb1cb5f", "comment": "Malware payload (Formbook)", "value": "5f982e7e8ebdb94fae2b8307a9473c5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959363, "uuid": "80bd31b3-6bb8-4470-9914-10a56f44ad04", "comment": "Malware payload (Formbook)", "value": "42409ca4edfb20f9a4b449b89e00f76fa75b40a50ac597f12fc4a39d9b1a69d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959363, "uuid": "0a494ba3-4160-476a-8838-7f33eb297fc1", "comment": "Malware payload (Formbook)", "value": "40b92309de360219692fafa41b8ba8410aa77e57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959363, "uuid": "8fbb4939-5717-4bc4-9c0f-3bd5bf95bfb8", "comment": "Malware payload (Formbook)", "value": "60e41296c53da666265f7be4a3b1f809eb50898f4849039a8e531b3cd95df5bdf49a383ab1002985d5b7d1c74d03cb84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959363, "uuid": "8b5f4279-70dd-41ec-bceb-23469b1c172e", "value": "T10235AF3D1DF88227B978D6A6CFA0C432B161D6EFF5629D29D4D746818702A03B4C71BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959363, "uuid": "5def963b-b9b3-4016-aa1b-c24c5f4a9f40", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959363, "uuid": "e9418a2a-7746-4231-86ba-26ae7d17cebb", "value": "24576:4yjv9QDZnQ/Z4eQEX/rxgqTxQHRHqCFjz:TQVoZ4eQEPrxgcYRHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697959363, "uuid": "b1a21ed8-f693-49d8-89bf-d87dfead03c8", "value": 1083904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697959363, "uuid": "b7a9c222-e15b-48f0-b7bc-7d7efc81b5b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959363, "uuid": "118eeb8f-468a-4462-a3a7-d6620ea432dd", "value": "5f982e7e8ebdb94fae2b8307a9473c5a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d85034-712d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698015003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698015003, "uuid": "57333e58-cf88-4f81-b561-a602184df411", "comment": "Malware payload", "value": "42ea9083e8611119c78bac34e9ad408f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698015003, "uuid": "8be53469-6dff-4005-8efe-1e3ff4e48887", "comment": "Malware payload", "value": "42a14329c33780338aa5b8e387a6900c495682a3ac37c5d3a7d6392edfaf144a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698015003, "uuid": "a8496cb3-25df-4aaa-beaa-3d8b13a49edf", "comment": "Malware payload", "value": "6e667ee6cd2a8be9d786a15916131945d9580619", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698015003, "uuid": "7aecad3a-6bfe-4e24-8cf4-64dee3863bb3", "comment": "Malware payload", "value": "56cbaab911aaa7d649d006337462f8327e3b970fe5cf487da25d4fd83bbcd0ddd4d94460f93c846b9bfec3411b3ef0e4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698015003, "uuid": "401dfc2b-40b3-4b0a-9a20-d2c8401b0d0b", "value": "T117734B41FC819722C6D2667BFB4E428D372A47A8D3EB3303D9259F21778A91B0E77251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698015003, "uuid": "4800a56b-168c-42fb-9d16-9fa670f878a3", "value": "1536:0c1jRnv1b/hok63fcnPQwzUQn5+jkSj744pIjYWNDAvF:08jRv1b/u2eQn5+jkY0QmDWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698015003, "uuid": "83d5294b-0785-4d31-aca1-1d53735cd682", "value": 79776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698015003, "uuid": "97383f66-1f0c-4e43-a878-1799bdacd557", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698015003, "uuid": "6576c78b-ff3a-48b5-8da9-88b6ba2a5923", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6afff98d-7103-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1697996998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697996998, "uuid": "cb0cec06-3bda-4bee-a13a-e8eaa48e6e00", "comment": "Malware payload (DBatLoader)", "value": "a20bdfadc944dea11cd2452a7fffe73a", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697996998, "uuid": "0899e276-c0ee-4eb4-8635-2184ad21d497", "comment": "Malware payload (DBatLoader)", "value": "4397154fc1574bb682c055e6c5cefd36155aa07928edce3593ef38cb975b1f0f", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697996998, "uuid": "09526c7e-b956-4b07-871d-1e03f168cf85", "comment": "Malware payload (DBatLoader)", "value": "9d85318548b9411dc4748dc20bf1323b5d31e508", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697996998, "uuid": "0cc8abe5-3e77-44ff-862b-c23129476913", "comment": "Malware payload (DBatLoader)", "value": "0227709624fd2e3b8b67adc65b848a98d9cc0d223c0182de8fe16b15c12e94dec4e8a7d47c85d64d4519fcdbd7a2686e", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697996998, "uuid": "68cdf2c8-b68c-4e40-88c8-e72e06aca011", "value": "T1A8458C12BED19C32C4F3497CAF47EFF8A81E39F1192459A97ED8294C4E703513DA918A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697996998, "uuid": "d0d6a609-ac0a-4dea-a366-2e2082745008", "value": "4df0e13d93cb581937cac481e3c87c38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697996998, "uuid": "9a04eefd-e615-4f70-9e4f-d9c43a39f71d", "value": "24576:qeA4Puy3YeOyFbcA3l0xdapY2bwplPYlpQZlo/:q5cZ3BmdaG26tE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697996998, "uuid": "1c37b650-6fc0-4432-a7a3-f266952681df", "value": 1263104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697996998, "uuid": "524b36c8-1864-4272-91ef-13f9bc96b411", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697996998, "uuid": "93fe750d-8938-4ba1-8107-ffa9703c34fb", "value": "a20bdfadc944dea11cd2452a7fffe73a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d4d9cc-70aa-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1697958790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958790, "uuid": "50e6abe0-862f-4f06-9724-165e0869f2dc", "comment": "Malware payload (PureCrypter)", "value": "f5c77a19f261493f31332bd2d0f8975e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958790, "uuid": "bd153b90-0020-49ad-a663-61cfa19bb20f", "comment": "Malware payload (PureCrypter)", "value": "43cb9f83a18f652860eab66b131d1f8a1545c44594fa81f301efa3b44a6b6148", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958790, "uuid": "ea9e3fa3-621b-4c0d-ba77-872ff800bdd9", "comment": "Malware payload (PureCrypter)", "value": "3cbbf9855b287b1a8edd1c1c14488e30668a2361", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958790, "uuid": "d392e5ab-7928-4062-b6ad-2bc7418bab21", "comment": "Malware payload (PureCrypter)", "value": "ba1627235f7ea3410f5f45f1f80a3a11142f52c03ecdb775e299aa915b26c90b97439231ab703c2bd3fb59bc3b71138d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958790, "uuid": "36947290-3881-4a12-959a-af7e1065afd3", "value": "T141447C49778A697BD3BF567364A107140B78DA0EB647F7AB3AED6DF10C5238026002BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958790, "uuid": "4d6e7335-c5cc-422b-9998-6a2b8b8ba000", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958790, "uuid": "c84ebbdb-2a9f-496f-8e5e-ad38f4ab7fb3", "value": "6144:aRPxunMnRQYxJLLbZUZLR2n4Ns4yFK2FDmP:aRP7RQYxJzZoG4yFK2FDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697958790, "uuid": "6617239e-9fa2-45ca-bfc7-7d9c28d5f59e", "value": 254976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697958790, "uuid": "b11b9ba2-2d85-42ad-816c-3fe4b94e8631", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958790, "uuid": "a8a1264e-3859-40c8-a448-2723c5897e01", "value": "Kajjjestipc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be67c0bb-7117-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698005728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698005728, "uuid": "78832a72-f553-4a03-9f2e-4a578f24372f", "comment": "Malware payload (Formbook)", "value": "b88275284de27e79b1a246d42ef6d24e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698005728, "uuid": "1da2a798-ac01-4e84-bafb-190cb10ed13c", "comment": "Malware payload (Formbook)", "value": "44eabd4d8e31d2500869633db46b0118f9b1a59629d3f72ee085d3dddf5e4bcb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698005728, "uuid": "853326bf-4c3a-4e4b-a75e-100b4b806087", "comment": "Malware payload (Formbook)", "value": "4cd3eef2de125e2058f21238a0b025fc2cf20cd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698005728, "uuid": "61f580e8-a963-4711-92ef-572b0956f802", "comment": "Malware payload (Formbook)", "value": "e5cc5ff11a437dc7aaa17423872c9066109214ee658095951fecb6b8c3055b985cb48eb1bf69d4d8587e0a6fdd0ee4a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698005728, "uuid": "00b28037-9e13-41eb-9169-93102cb67cab", "value": "T171E3AE12F5C1C472E57318350970EAB18E7DFC30CF54AEAB63981A795E606C0D939E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698005728, "uuid": "ff163679-df6e-432e-a7fe-c713ef58b809", "value": "28c7c58d6ab216358623ab8e3b898f92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698005728, "uuid": "896b5a06-b068-4b68-a500-08e5715ac4a5", "value": "3072:jMDnJUcNtd2e3bfk3W5iOMVGDTZNcgujzYQRD2SfTjJ0+cpI8TJn:+ZEe3bpi5aaY9SfJCI8TJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698005728, "uuid": "aea92bd4-67a9-4b22-a349-ce90d8f10339", "value": 148992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698005728, "uuid": "e1a08fdc-95d6-492c-b008-348b5d61e43e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698005728, "uuid": "72fe0a38-a4a2-4d97-a4f2-68c8871d76c6", "value": "b88275284de27e79b1a246d42ef6d24e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a294a045-7083-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697942116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697942116, "uuid": "6038ff0a-84c2-405f-b409-b2da7d3e0a56", "comment": "Malware payload (RedLineStealer)", "value": "0789c008b2eaf3b8dcaafe7ecdea4a12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697942116, "uuid": "1849cf44-8cf0-413c-911c-c9be21093621", "comment": "Malware payload (RedLineStealer)", "value": "45aa4cd8895cde34a9e5088e968f73a2776e28a404cea75b639fe875cb66dcf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697942116, "uuid": "92176244-ce0e-43d5-8696-d73c7a754eb7", "comment": "Malware payload (RedLineStealer)", "value": "b23dc210c54f0cd420a91e862807e5936ce305bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697942116, "uuid": "590a7002-8402-46ec-8319-fedb3266dae7", "comment": "Malware payload (RedLineStealer)", "value": "53c421e7a73f6de732b7fb8d309d1935efc0428a2b34ec7e83b83cb822cad1f6ebd10a8662c28e8614283952a36693ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697942116, "uuid": "a00943a2-9cfe-4513-a17c-658399ab6ae3", "value": "T125840263FAE95077D8B5177018F703C31A32FCA18938935B3795A99E0C72A94A53137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697942116, "uuid": "6a9ba82a-c54d-4c32-8d45-5497dabf3432", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697942116, "uuid": "b5bb8732-30de-4d6a-850c-514e984ca69a", "value": "6144:K5y+bnr+wp0yN90QEQdNl4whvAUrigxrvCbw2OMihB1+Q4BlR6Jkz6KVr:fMrMy90qlBhvA3urab3TDR6J4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697942116, "uuid": "0f99faf0-cab2-4d2d-b894-7f4b6c6101ad", "value": 388608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697942116, "uuid": "a4075234-329e-4edb-ac9d-2931d570062c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697942116, "uuid": "e7edf6f2-c99d-4924-a960-312798c31b45", "value": "0789c008b2eaf3b8dcaafe7ecdea4a12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5909ebb5-70b0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697961320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961320, "uuid": "aaa1503c-a497-4248-aabc-3c73cf3e14b6", "comment": "Malware payload (AgentTesla)", "value": "27e1f1d3156488c26e93e6f05b85179f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961320, "uuid": "ff7aab3f-3de1-4477-a11a-281c0afe0af6", "comment": "Malware payload (AgentTesla)", "value": "45aa5d4ffefa0719c08c17fe7c5247f1f6dd44914341ce72b5d9efd85720fa9f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961320, "uuid": "d1ded5d2-0515-4430-988e-5f08529e0a23", "comment": "Malware payload (AgentTesla)", "value": "ba431bc31faa40cd631a8f83403c26e61431a838", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961320, "uuid": "17cb80f4-8c0a-46ed-a7dd-49db0b1ea3f6", "comment": "Malware payload (AgentTesla)", "value": "aef104b66276a15ae6ad2dd494edae7cf285727bfd7f1dbe715240da6d937943988bd5ed154ba2aaf630dd43404af25b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961320, "uuid": "c9b6d34c-d693-4072-92d6-e5b913a4e444", "value": "T1FCF423F83D79CE76E6B4BB778559220029493FE3EA1C441C19099D7B37732326B89A07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961320, "uuid": "2c80fcba-e8a9-47ac-8424-0d856a355e44", "value": "12288:jEMxxC9I7oRGFATPrcuOM1livT/Iv7IeTf7HVgVs+9cGYSYEYPv:jZxxKI7oD4vT/IvNfbCVhnYNPv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697961320, "uuid": "cd33e604-55c2-4637-8cbb-a25d42dbff19", "value": 754667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697961320, "uuid": "750f0d0e-9a3f-4193-8def-8f3936528714", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961320, "uuid": "97b4ec18-bea4-4f5a-8a26-0b23a0dac7a6", "value": "PO-4501336854_WJO-003.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f24013c-7105-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697997757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997757, "uuid": "3c11d20b-974e-4adc-9ddd-5e6ffc43a1c8", "comment": "Malware payload (Formbook)", "value": "39a4e1c4bb46aaefee6e0b13c465b0f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997757, "uuid": "1941c156-6b50-4add-a464-8e4bdd2ada16", "comment": "Malware payload (Formbook)", "value": "465321ec4fd0e23318868b635af91005ce63b2d2d4a5a07fc40f6059b090cddf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997757, "uuid": "0958b435-0653-4c54-b2b0-70d2c53afe8a", "comment": "Malware payload (Formbook)", "value": "d1b332736a42d9750b4e2adc5a715e5fed6d115e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997757, "uuid": "8550955b-2755-4552-a9a2-6a5c7f398cad", "comment": "Malware payload (Formbook)", "value": "f5b1bfefabeff806da4930f357265b5289bc6024248c951f1b21ec0d44e3a5b1842953888eabe9fe498935f9e513bdb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997757, "uuid": "529a1216-0e33-4040-9ce2-09e163e95d72", "value": "T1C9F4EF423ECB9E59E5F3C6BD0DC18D78CEAE79DB1434C27D3A8CE19E18552104D4CAAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997757, "uuid": "731b7579-5e81-47e5-9f86-b7bacc71f3d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997757, "uuid": "ffb40271-d133-4435-840c-4e1fa29569d5", "value": "12288:MzfqBuYLGzcR1inQ4f1oQHqRMgKBuR8SLH2ocAKBGwSMXx:MT6DCAUplHUqB4crBlzXx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697997757, "uuid": "6ec4ef0e-1b17-417f-a783-4a0de240cec3", "value": 762880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697997757, "uuid": "7e018726-3794-474a-a7fc-64f000c6d8dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997757, "uuid": "ae4f78da-820d-4d67-be92-5f67777f6a89", "value": "Pray.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cbc6452-7113-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1698003927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698003927, "uuid": "bc3f501b-edb7-4982-85ec-47122d745034", "comment": "Malware payload (Amadey)", "value": "a67410e6523af5495d16dead1c206dd8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698003927, "uuid": "e2b2aadf-1428-49e7-a06e-89992a979425", "comment": "Malware payload (Amadey)", "value": "46d36cf735f059102b5722d7aaa33c69dfa3f6d6a4f63a8d3528e56952f7a53c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698003927, "uuid": "42a320e8-395a-4cb9-926c-2aad2f3331cf", "comment": "Malware payload (Amadey)", "value": "6bbbc62759e4c8812c5f8f8f0495f19cc5e3565a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698003927, "uuid": "d9056029-c6f6-4e69-95f5-4912349c0283", "comment": "Malware payload (Amadey)", "value": "8015fcee21e4ef488bda5ddb29e299eba279a66436592b08016277d5877b8fe3ea1291838255efebf1dfb6451f309800", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698003927, "uuid": "054f2676-f031-4d63-8a46-95fd9cd7c8e7", "value": "T1718523929BE44472CA75637455F703C72334BCD05E78472B33C8E98918B76A1B9B8B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698003927, "uuid": "4d1c486b-d902-46b6-b167-1cb6e20621d5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698003927, "uuid": "36a3fb16-c33c-49d3-8de8-74524a71f7b5", "value": "24576:qywDKyNfnH7gvKTJVkxhsAfxEtGiutS7fMPUDRZxQM0/p7TAKk5ECvkhU/C19Nk8:xw+UH7gWk/bfCg1ifDR8M+UnvpL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698003927, "uuid": "81038bdd-6eb2-457d-acc3-093a1dccce1f", "value": 1824256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698003927, "uuid": "94832443-d1ae-4958-8e61-5982ca625e11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698003927, "uuid": "36f6460b-51a6-46fd-a529-5559f60089f7", "value": "a67410e6523af5495d16dead1c206dd8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "484e42bc-70d9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697978901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697978901, "uuid": "2fc27d03-e84d-4d6a-821c-09e275031159", "comment": "Malware payload", "value": "0b70a8cb2a2a14f0e3eb10f14456377b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697978901, "uuid": "f3f49888-7e6b-402a-b468-07f972a13408", "comment": "Malware payload", "value": "46eeeb92ae6f5d02ec4fd4104a8b3666407568a0afcb5ded90f6add9dbd94e6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697978901, "uuid": "0934bdd4-6a5b-4128-b3e5-eece4cea05eb", "comment": "Malware payload", "value": "33b4f2568b86f3b7b33a8e4582fbb65c0a0a595f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697978901, "uuid": "b964ad2c-bb5a-4e9d-9fec-fe664298ff02", "comment": "Malware payload", "value": "6adcfcb5a94e5491208358b9251823f39245f642e55106fc9aadd6a87068634dd6bb2e5c19a41b11655ca08445ff32eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697978901, "uuid": "86f23abf-a859-4513-997e-a98b3bac9957", "value": "T10D263309376C34B9F1EFDD3018657C50FAEDE1562E063C270127F973AF9898256AB12A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697978901, "uuid": "422c6d07-73e8-475a-84c9-239edc3bd3b6", "value": "9aebf3da4677af9275c461261e5abde3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697978901, "uuid": "b82f5f96-ab07-47a4-8f68-aca793c1b107", "value": "98304:n8+i0yMBXD5V/9NNtoDc0xFl1sLYV4QJP1ogKF:nLYMBz5DtoDcOjubQJNs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697978901, "uuid": "13fc9d72-9f3b-4db1-be87-725fb2678d85", "value": 4561408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697978901, "uuid": "bbb58039-79f6-42f0-a037-898e74ed84b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697978901, "uuid": "1caa529e-9e3f-456a-a06e-3fd47107491b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf961688-70aa-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697958942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958942, "uuid": "c21c85e0-a847-422d-a4f0-b07f13cffb06", "comment": "Malware payload (AgentTesla)", "value": "c04155eea539fb1854534e16ecf1f91b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958942, "uuid": "f4467e75-5e58-41cd-8a81-d402269aa463", "comment": "Malware payload (AgentTesla)", "value": "46fca0c0e3f205ee0c27db0a09be4ea3296b40bd92dd66f3133dc48f8862c761", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958942, "uuid": "31e83aa7-25eb-42f4-a5b7-e4e8e53d4396", "comment": "Malware payload (AgentTesla)", "value": "1b0ccb911b29a5a0430dbbd0f266b06dd9c25c65", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958942, "uuid": "55771bb3-9916-4d26-a179-4dc0e19d73a3", "comment": "Malware payload (AgentTesla)", "value": "e34a2b7031fa43e164d1f393a99c0ec93d8f4fc76534113f2be104c8f3e8913d792f5428d763d9656928a55ea384c94c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958942, "uuid": "ee160d94-60b5-4c0b-a600-6cfe6173b0ff", "value": "T1CEE4120273D88637CBBA4FB58D622201E2F5AC655D21D39BDED922CA059FF3402257E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958942, "uuid": "c528dbfb-dc8f-4ad0-84f3-2b6f01a50555", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958942, "uuid": "12895866-8160-43de-993a-ed03d32af16c", "value": "12288:xJfl7s9fwtJVAvtOrzhpTjv92W6f4Iej+2v1wM0fM:rl7s9fPtO7TjV2W6fcj+2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697958942, "uuid": "ac11eeb0-47f7-400d-8953-4db34a643d4c", "value": 709632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697958942, "uuid": "769c692e-391b-486d-9dd1-80a96fe85d8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958942, "uuid": "3af268bb-cff1-4544-a465-be7d7b2370d5", "value": "RTL-2023053001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8e69434-709e-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697953804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697953804, "uuid": "25ddcfab-c427-4fbe-8724-05400e4e1b91", "comment": "Malware payload (Mirai)", "value": "9e47df636b67186d8ca06a65a29861f1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697953804, "uuid": "bd01227a-7b5d-48ac-b165-52d47ab05fbb", "comment": "Malware payload (Mirai)", "value": "478e1c81bb893fb89bec9dcb25050553ab5db65615f01a6aa94b5a350ecab4b5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697953804, "uuid": "3827d9ad-f0fb-44db-8290-d88744722f4d", "comment": "Malware payload (Mirai)", "value": "af2c76d79459de5de3075065cc0b911aed0a22d4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697953804, "uuid": "d6658dca-7b65-40d2-9285-b4e58e943c42", "comment": "Malware payload (Mirai)", "value": "03e7dcc0b358f4d0e83e6207260f93646e24954b8b1a833ab8d0a24e23fd5adbfa97f8898e4afe0bd77e7f68bd1a297f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697953804, "uuid": "13f18bd5-3cba-40c0-af72-845b151e5e46", "value": "T1323302B267AE6AE251F04773FC33BC56629C17F8996730963CF0661977C18020AF26C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697953804, "uuid": "105fae95-5336-44e9-9165-659f4e1f2780", "value": "1536:s9O/ZMAXIxNUk03nzLcPqF1aBexo4opKZbT:s9O/ZNKy7nzLGqFUFO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697953804, "uuid": "f849a968-37c7-4cc9-b81f-e38d3c31ab03", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697953804, "uuid": "275236cb-56bf-45c5-b4a1-74bc70fc44f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697953804, "uuid": "8035212b-daf3-42eb-b113-f1939d785cb5", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c45df159-709c-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697952910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697952910, "uuid": "88125f72-4650-4391-bd1d-ecb402f31ac5", "comment": "Malware payload (LummaStealer)", "value": "921cb3b8a75d038fc32114c0f7536bc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697952910, "uuid": "d38ca02d-ab36-4f52-9a55-3110c76fdf8b", "comment": "Malware payload (LummaStealer)", "value": "489213de6c0ad30e33ac65899d393ee0b6f679128c9693ae606436ef8662686e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697952910, "uuid": "86f77f81-8a47-4285-82de-d0256ab2628d", "comment": "Malware payload (LummaStealer)", "value": "cd127197f9f3c4bfa2bb2d0c447c27af9395960b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697952910, "uuid": "ad2e7986-aaf1-4783-b481-7e4e8a847e66", "comment": "Malware payload (LummaStealer)", "value": "a6ec83b28678aab97a3c6369bc351a926ca2885575ee9477aea843f6e9cb8f4d1d9071696c9f67b75b2be7f5a2827338", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697952910, "uuid": "c161e2c9-5b90-4bc3-91ec-1aeb5edddceb", "value": "T18BD4CF01BB426531E360C8FBC75D6CDDB44C7EBA03632CBE1656C9E5890FDB614B12AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697952910, "uuid": "61a2c046-5aff-47cd-aae0-d469df0255cf", "value": "74b0d004a012cef41e106f80a1b919df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697952910, "uuid": "b7daaa95-89b2-41ed-aa3b-2ee0cf7c88d6", "value": "12288:dgvHswFQi4PVMUftmj9Zha0onrCxMRibcnQf/xStibwzeAAZ9z/CUH:dwHr4VMgmjXhsrCxMRibcnKJCeJd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697952910, "uuid": "688f3478-38c5-456d-bd8d-7f302c4bf0b6", "value": 610816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697952910, "uuid": "4d570fc9-5885-496e-a3e3-9175d3650b0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697952910, "uuid": "622aff93-7b5f-4249-8950-3683217b7202", "value": "921CB3B8A75D038FC32114C0F7536BC6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f86f951-708a-11ee-8907-42010a9c0042", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1697945117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697945117, "uuid": "091dfb41-bc64-4700-b801-15300497c3cc", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "0f5c26ad6a634127ebe679dbddd3b9cd", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697945117, "uuid": "74e57ec6-73c6-42aa-959f-c6c0584a175a", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "48c4050aea9586034ad3549cefe0acf515c1c24fe4707ca7789134a4cb3bcb08", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697945117, "uuid": "b7727d5b-965a-4bb9-9740-9378d556459e", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "0fd68c0a9e4732e1d9bc9ecc132f55ce8be3969b", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697945117, "uuid": "f26c0ca8-e618-498e-8dde-9f77103e1335", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "6ead6231d2e3e12c53fc4b569929d2d8722444fe9411236aff8ccea4bb77df0d959e2ca65878f18961cf9b8eade59a3f", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697945117, "uuid": "6de0512e-9249-4f93-8706-e84764840d46", "value": "T110C41242A7E85432E8FC1BB128F703870A35BCA0AD74879B7795595D4CB26809A7337F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697945117, "uuid": "aa7e1e77-dab0-47de-8477-cf83b5429d3c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697945117, "uuid": "8a97b602-627f-4eef-b9e1-fd0eded26db7", "value": "12288:YMruy90XzZKKBAxkOegveeiXoJ5QtTiENK65EM/V7YuRaDq+:my2IK+xkOegveZXEQW6feuQDq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697945117, "uuid": "031e2e20-a11d-4674-b112-48db15a53735", "value": 550400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697945117, "uuid": "2218a104-4c37-45a6-ad81-db00ae5c66cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697945117, "uuid": "1ac4975a-ed0c-4d5f-a15d-5dcdb05d5272", "value": "0f5c26ad6a634127ebe679dbddd3b9cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "932bbdcf-70c6-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697970867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697970867, "uuid": "4ae67ed2-0029-4c61-9695-327da346d6a1", "comment": "Malware payload (RedLineStealer)", "value": "2858e007bb23b694663feea4204fdfc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697970867, "uuid": "31d97725-b998-49e7-80e3-a51c48aed5a9", "comment": "Malware payload (RedLineStealer)", "value": "4ab87e55440b2c6fce5143d135e440189d9fef89e08c5ac9c0cca9718156cfaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697970867, "uuid": "7815eedf-5431-447e-8c3d-c75be8b9e18b", "comment": "Malware payload (RedLineStealer)", "value": "26b0faf1b6bc64a90f5ad50cf8eaf9f40f800e48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697970867, "uuid": "d3ea2857-8cb1-44cd-8c7d-0058bcae21f3", "comment": "Malware payload (RedLineStealer)", "value": "953d11e610a9e7ed764f99e688750050a47e597678fcc21699882d8ea6195e00c9bef5432daee734c9644b522a5e089c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697970867, "uuid": "bc1f7fd5-67fa-4aea-b635-696842dd028e", "value": "T10F652367A3E85027EAB40BB049FA06970270BDE346B853126BC9D5BF1CB36849D71737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697970867, "uuid": "cda21e7f-0c5d-4441-9912-e8cd3d9d7dfc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697970867, "uuid": "162e6bd2-eadc-468e-8188-25e5cc3ed4e2", "value": "24576:PyXUoz6S2XmI2A1jRC/65NwQgAp+5ZWSUv7g8sSxbeAmQGiwhNnhLsj:aXd4Xz2u4/8Sr4+mS97wXuVhp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697970867, "uuid": "4ee91709-c354-4302-a98a-c49a3ff79355", "value": 1492480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697970867, "uuid": "a15ad671-1b4d-4dd4-b352-199df225ed8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697970867, "uuid": "99564089-f9f9-41eb-86c5-a21d706dab53", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5af312f-709b-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697952510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697952510, "uuid": "9125748b-260d-46e4-b01d-66f5d4e429ae", "comment": "Malware payload (RedLineStealer)", "value": "769b7c813b1caf9c938e920c4b0bd0ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697952510, "uuid": "95500397-2496-452f-8a6d-0d2c3f2ff932", "comment": "Malware payload (RedLineStealer)", "value": "4ac8aa678d794bcb5e1aadf9fd039d8b6af621d83a836d3af2b3b10460794587", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697952510, "uuid": "7b656ea2-992d-41ee-a405-161ef7b28033", "comment": "Malware payload (RedLineStealer)", "value": "8e0b9baec20dd0d84afe562c13ca5d88a50a1cc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697952510, "uuid": "fbacd5eb-0684-48e2-9cf5-3dac05ea8298", "comment": "Malware payload (RedLineStealer)", "value": "f59760f6f0e40b8c64f7695ab3cc8a1fcd56ee89aa563c676983517112f89e0c9ea3c31923d8d1a9e2cf360a6bd7bb00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697952510, "uuid": "047ae528-f0a1-4e53-b9b7-c4ce97e0646c", "value": "T10E65235274F0616AE8F62B705CF607C36739BD848A74977B3392A84A1C73B89647132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697952510, "uuid": "31e90b99-fa44-4e09-a9f1-852f2fa16e66", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697952510, "uuid": "afdfcb35-3aae-47f2-98f3-db4227acfdd2", "value": "24576:PyQCpbIaGuGhZ9Gx3Zt5YlAL1jvNjtBWAw8R/6VG7CN5akRcswqIMI5yBke:aQCpbIzF4z5Gk1Nhw8RL7CNEkRcqIMXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697952510, "uuid": "db73eb34-9662-4ada-902e-0c1cded7972b", "value": 1496064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697952510, "uuid": "6bb18712-80c8-49cf-bfc2-ba0a868475dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697952510, "uuid": "d9e21c84-c73e-4cca-8244-9054a2aee9fa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ef76f1-70d1-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697975748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697975748, "uuid": "aeda02ed-042f-4ea0-8a9d-27295f0c105a", "comment": "Malware payload (RedLineStealer)", "value": "b0db257c306058635683c5d1ffb14840", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697975748, "uuid": "92d2973e-ea03-410b-8faa-8f71fac5362b", "comment": "Malware payload (RedLineStealer)", "value": "4cdf57094405bc954210be5c2fef7c288da7b9ce7e18b718692e2f49d53291a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697975748, "uuid": "a11070a9-f62c-40c3-825c-a8d9e7ffef71", "comment": "Malware payload (RedLineStealer)", "value": "ab6452f3bb2ee73cc6b07433662579db48323c14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697975748, "uuid": "41cb332b-ff03-4bdc-8e48-599852b5470a", "comment": "Malware payload (RedLineStealer)", "value": "44d37ff0c3abf4186513a9c363beb8d219778c6ff2856db3e74599a9453dc270f8aeaab66577d8bfd8873009d3e965cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697975748, "uuid": "7231f816-d20a-4bdb-8f99-17151adbbe9a", "value": "T1CB156C7D1DF88227B978D6A2DFA0C432B061D6EFF5629D29D4D756818702A03B4C70BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697975748, "uuid": "986b0d64-d2d4-4044-99a5-96e4942360c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697975748, "uuid": "7c58272e-1f29-437d-abc4-cb797be26111", "value": "12288:SVQaMFM0Mvxv92HAGuMO9qRa8OHhkS6sB3m9GnVZi/XZqe:SVjv90HzO9T8OiS6s3VZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697975748, "uuid": "296193bf-5e19-4467-a76f-8ba8a236833b", "value": 939520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697975748, "uuid": "2659fc68-ea55-4727-acf2-b467d877e88a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697975748, "uuid": "9f41c709-55dd-49ef-a374-141ddfad0d2f", "value": "b0db257c306058635683c5d1ffb14840.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee0b7bb9-7105-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697998077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998077, "uuid": "d7cf6fad-9c46-4756-867b-f2e3dc28e6c1", "comment": "Malware payload", "value": "bd0e45e4222d4a0159ae1347f9e6683c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998077, "uuid": "7aaf667f-f113-4308-a2f4-705d90f016e9", "comment": "Malware payload", "value": "4e925845732ac9682d1c35e5a8b2b495ebae048759eae8546974c74ceb661656", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998077, "uuid": "84c23333-350e-4a29-b733-75f10cb7a31d", "comment": "Malware payload", "value": "4816fc4e5cc109d5108ba45c55b735d9e934cd54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998077, "uuid": "2fdc04a7-1652-496b-ab6d-5ffbd444b23a", "comment": "Malware payload", "value": "2a16ae6b2d69cfd0e9c17857274c37a2cfe6179247933e5331a7ab0660766155123be9f5d8410b4142fe110dc6b94923", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998077, "uuid": "eb5a171a-4438-4c44-b371-fd30dda14025", "value": "T14916339940F183AEA6F9E52F28302324F283F55DF3857F852C44B15A09B76430FA99DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998077, "uuid": "79c5f7b9-5b45-44e7-9e54-cf6a7a11886d", "value": "98304:pHrMX3ZbN6mocwdMpXYI6A2XwY0o7r5QBa2lAo3WTsKVndJ:1MnZZPocwGpoRRXwY9rb2moBKVdJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697998077, "uuid": "5bcfa1d4-7f78-4ef6-9c4c-4071086650f1", "value": 4134675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697998077, "uuid": "ea6e64bf-5e5f-4b78-bbb4-bdb5e6dbcc67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998077, "uuid": "34bf5651-22fd-48f7-889f-dbc28f1f9ebc", "value": "bd0e45e4222d4a0159ae1347f9e6683c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f611bfc-70e0-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697982000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697982000, "uuid": "9efc8aa5-e533-42ee-a280-7b7a0fab5bed", "comment": "Malware payload (RedLineStealer)", "value": "5ae594f7be03d4d40dc3c9ea330e4864", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697982000, "uuid": "3ae97df6-b960-403c-8f6e-710be5008897", "comment": "Malware payload (RedLineStealer)", "value": "4f4f82c15bbd29e48006479f58d2dd1f9abaeed7fd344df5b693d018a189780e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697982000, "uuid": "335c845e-33b0-416c-8014-288ba2d265c9", "comment": "Malware payload (RedLineStealer)", "value": "a9a0df3f9b504e50e2702a95b7b8bb53434d5f59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697982000, "uuid": "e3d53134-ac01-47d0-8a84-9ff6a70bc0ba", "comment": "Malware payload (RedLineStealer)", "value": "004241c0ada98c4895fe05c7b27c70cf7dc78b7cf9697c5c6100909ad2a6d4fcf7f67ea52f2a3d9abdd7a9af57413f00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697982000, "uuid": "331662b2-7c13-479b-bd05-152988c69585", "value": "T1F18533ABF6B89C23C5B017B050BB47933A317C6D4A7462363B12D5AD29372C2B07572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697982000, "uuid": "899c1443-a52a-419a-b71c-89efdeaac661", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697982000, "uuid": "42379590-edb6-4478-9221-ba1082109889", "value": "49152:KJ4K6nSqP9QgCTeE3wDhuxKDauP8X1BJdr:QF6nSqGXhwDhuweL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697982000, "uuid": "5f991d06-d2dd-4c1c-9eeb-bcb376fd42c8", "value": 1842176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697982000, "uuid": "926fbf75-053f-4a17-8914-75b53feac57f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697982000, "uuid": "c431c23c-e83c-41e0-ab08-6157a346efa8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a08c5a0e-70f9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697992793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992793, "uuid": "78de33a0-b3d5-412c-bd9b-283a62ff6520", "comment": "Malware payload", "value": "2eccb9b29ae2f70d206e2c029a062ccc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992793, "uuid": "cecf3c67-a3a2-4ddd-8888-e625eff30413", "comment": "Malware payload", "value": "50975fad096dded9784fc21b037410530d3b1e0b43fbb68ba573958e68b18b45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992793, "uuid": "199b08af-87fd-4520-84f9-0a76a8affa03", "comment": "Malware payload", "value": "d323456f8b974b404e5b49ddfc357b3287de234d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992793, "uuid": "88f6229a-f172-4460-93a2-0d1abb84da89", "comment": "Malware payload", "value": "8f1dce614e33f3fb0b203a2145ecbd8f6b3d70c8c31c2a70c101110d2100e6a92e3620a43b27f565eed17de93bd70fb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992793, "uuid": "308608a7-4c80-402a-8305-48ff5584cebc", "value": "T194358D52B5C280F1C605193104B667369D399E8B5B29DBC3F3ACED6C6E33191A63B21F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992793, "uuid": "d3a19b29-a4db-49b2-8194-791a789c6dd8", "value": "7b8d0f3386d50352af66343ce8c076e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992793, "uuid": "85b77322-fa74-418e-b0b3-e1ea5450857f", "value": "24576:BvwjMEiFhZHhc3EGaS9coiBKEvorlG4WWNChK:BvwYhZHnGaSSSlG4W4Cc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697992793, "uuid": "add3934e-0a5c-47c3-be4b-642d3653aa9d", "value": 1073152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697992793, "uuid": "7dfd64d2-f99e-40cc-9047-b266a4c7e305", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992793, "uuid": "cc1cc628-84ce-4e0c-a8d2-6c1ac20dc752", "value": "SecuriteInfo.com.FileRepMalware.15605.20572", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "119fbd67-711c-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698007586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698007586, "uuid": "cc7988c3-3ce8-4ca8-9395-fc6cd5da618d", "comment": "Malware payload (RedLineStealer)", "value": "65c7b30c6293e1ecc3830d07aede9b0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698007586, "uuid": "81cc56f2-f66c-484a-9b73-c0ee012a9c50", "comment": "Malware payload (RedLineStealer)", "value": "511200316cb76da22104be6e9fa680130d547e83b2b00c062da4719f441df3f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698007586, "uuid": "d644f2f4-d184-474e-a966-c5155ab672ee", "comment": "Malware payload (RedLineStealer)", "value": "16986d36029df6dea29142da907dec7b4dfa4e31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698007586, "uuid": "9b00676c-fe54-4733-b453-dcc0deb25f8e", "comment": "Malware payload (RedLineStealer)", "value": "0254251ae77a2ef367709c840c04f969c481887c4d1b5d373b16b058232f85a23585ce77a86014c70b1b89a62e6b5258", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698007586, "uuid": "20bed769-c5ff-480f-8283-4e95fb14d12a", "value": "T1FFB46B51B0094F2AE3F2087CE6CA5DAE4D507EED6F530B8F36C14B8267967D1A93910B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698007586, "uuid": "0b8e8abd-16d4-4620-9190-027ac06f4bdf", "value": "d350427820086a321ccf21b695161218", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698007586, "uuid": "92d3e979-a07f-47a1-b98a-8d596479a196", "value": "12288:68lL1SNQB2o97Hr62k3n/+pLsv9+eXUeF6O1L:b1SNQkAr62k3n/+pAv+e3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698007586, "uuid": "5090796e-04e0-4cb8-9535-76430f682d80", "value": 508488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698007586, "uuid": "1b5e2a73-4ca8-4955-bd15-a7f84d4282ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698007586, "uuid": "53b669a6-61b4-4d75-883d-64d5686deb75", "value": "SecuriteInfo.com.Trojan.PWS.RedLineNET.6.30351.12882", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daa3005e-70ab-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1697959390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959390, "uuid": "1b3c3bea-4801-40de-bf50-68eb56449202", "comment": "Malware payload (SnakeKeylogger)", "value": "219d233c4c50db433d953f5f7fdffed5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Product 4", "colour": "#A52C5A", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959390, "uuid": "a1284e09-61b0-4ab1-8b43-fc9490440ad1", "comment": "Malware payload (SnakeKeylogger)", "value": "5304e329eb59cd3685412e48275824e7a235f28186493d08935c9db576d6c2a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Product 4", "colour": "#A52C5A", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959390, "uuid": "1270a96a-c438-4757-bb55-d6fc379c85d8", "comment": "Malware payload (SnakeKeylogger)", "value": "49079a1e8bbba9e82a4ae8e9aaf098ae5691a458", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Product 4", "colour": "#A52C5A", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959390, "uuid": "8452bbf8-ae17-46d9-b9e8-a7161f541df0", "comment": "Malware payload (SnakeKeylogger)", "value": "797f7eaf3255aad6cb640c9a85a3f13e72ad6bce9d93051a76bbdc5ebeaa45ac9b449c2aa54f7d16ea1148bceb9ec7e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Product 4", "colour": "#A52C5A", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959390, "uuid": "6ee4e7a4-45ce-4728-b425-89c234ce387c", "value": "T17DA49E8EE352EDE4EE2F0379B53109222F159C6BA199361C248DF6613D3721254A7CFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959390, "uuid": "de4e29cd-a9bb-48d8-9f9b-be2b20dba2c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959390, "uuid": "27aab805-016a-4614-b993-8e7e8364f893", "value": "12288:mJfD2S+nRXKQV+dHhZdZcZm2TPZHhBak6ceXu0mOFH2m:GbzgRXKm+dHhZdZcZmyEk6Lz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697959390, "uuid": "7144483b-7225-4bde-85aa-ab76d7704cb8", "value": 458240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697959390, "uuid": "08b5be9a-08a0-4396-b5f3-581577e5dd79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959390, "uuid": "4f1a89a9-f460-4b22-896e-d569715ca92a", "value": "Product 4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf60c2d-70aa-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1697958991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958991, "uuid": "431877ef-2ec3-41b7-b68e-0ce087361ecb", "comment": "Malware payload (SnakeKeylogger)", "value": "936c36ed8de42ea9e4b00dab1fbb2626", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958991, "uuid": "c1aa7923-2b7e-41d4-845b-b7c98b280242", "comment": "Malware payload (SnakeKeylogger)", "value": "5373e9d6ad3ab1cd51719fe04f4abf7371b6f87ac5d007d940d31d4861442e0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958991, "uuid": "47e2b9fa-97c9-4d88-9ebf-4776d2b627e6", "comment": "Malware payload (SnakeKeylogger)", "value": "1bcee14dabce9052cbb7a23649f1735771b41d07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958991, "uuid": "2b1dc5bd-bc94-4810-9364-fe436ea2680b", "comment": "Malware payload (SnakeKeylogger)", "value": "ceab4341513d363e78b0c151da0f6d183b9275e8578ff11d2bf29f7313e5deab5692c0d989bdd275699e0e9cb9cc062a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958991, "uuid": "8388dea0-7679-4637-bbc6-11bbeb42cfd0", "value": "T1A4D412A8736072BFC667C63585E06D509331B977A36BC20798A710A98D4DA8BCF107F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958991, "uuid": "fb9af68a-c91b-4b49-896e-2b57c8e96c45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958991, "uuid": "3759d83c-24e4-4cf5-a3d1-3fc1d17f5c54", "value": "12288:o/jwFVPnZiYLcYspft4B5Bu59Qm3OJrOT9MAQm5Cq+XIjP:oLqPnZbgYsplIHS9Q+OJCMAC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697958991, "uuid": "230c6b43-8a45-4df7-82f1-323cfb1c7063", "value": 639488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697958991, "uuid": "17f1832f-6cac-4350-9964-2308dbdb97a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958991, "uuid": "99232b4f-131c-469b-a598-5189e0682015", "value": "receipt_#8282 554.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b81c624-70ab-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1697959204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959204, "uuid": "49d8cda1-2908-446f-b027-a89cf8119806", "comment": "Malware payload (SnakeKeylogger)", "value": "91a9f326d7e91c935f1e9941d3a8c73f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959204, "uuid": "637f360b-82f9-467e-b3f1-01256009cbc5", "comment": "Malware payload (SnakeKeylogger)", "value": "544a423942e01fe57cdcb5a57d43d428bc2a03c373135cbb9d9c4d727acae4b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959204, "uuid": "134eba7d-2cc0-45bb-8ef5-5bcde9e7455b", "comment": "Malware payload (SnakeKeylogger)", "value": "c41b0fcc02c12fe5dd7a0137f68cbddd0521ff18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959204, "uuid": "13e58c51-9027-41ef-af96-f509754d783a", "comment": "Malware payload (SnakeKeylogger)", "value": "5327647d3a8ccfdb50b97fbed63678848dd47bdcd69dc4c4ab67d8c282a29fc8b5605326af8d963125bd6bffe9aa33d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959204, "uuid": "b78004da-a053-42e6-ab0d-0ab4c926de2d", "value": "T17474029E05D8AB14C11F5770C65643105234A137E246F3185FCBB5EA3BF722A9E0ABFA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959204, "uuid": "ce214f1f-efd1-4805-ad39-bfb89c8ab136", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959204, "uuid": "fa552a43-37b1-42fc-84ff-e39881ed1848", "value": "6144:S0nHBIKD2SJMzodRpUZNFvzZyMGp624yu1Bvuw+SlLdkD6dk6ceh9X3P9zPAtO:RHfD2S+j5ZyM924t1Bvuw+SlqDAk6ceF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697959204, "uuid": "dfd1078c-bb7e-4ec6-ae19-7ec981099249", "value": 365568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697959204, "uuid": "4a57c5df-9dc0-4ad9-8a84-dc54bac69820", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959204, "uuid": "b10895b0-464a-4647-b445-f7657d7c2b3d", "value": "SGH00987789000GH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9255592-709e-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697953804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697953804, "uuid": "bf808211-571c-4ebf-82a5-465d9bfa9cfb", "comment": "Malware payload (Mirai)", "value": "299c68ff9674bbfdc72438b24405b90b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697953804, "uuid": "1cba54eb-aa3d-4e66-83c3-19ea07f92123", "comment": "Malware payload (Mirai)", "value": "5486447f34c8f93874cb9c64a0f0f3374967af103c9c913c221d02856e3c718c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697953804, "uuid": "f5a71bd2-b28b-4276-a7a5-02778ec2c1ed", "comment": "Malware payload (Mirai)", "value": "736d5a97c985ca0bbd47480e766564807da02ac7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697953804, "uuid": "bb75744c-2936-46eb-8433-b83e8664137d", "comment": "Malware payload (Mirai)", "value": "d71f81395fe06ebc0257fc82d1bc43d1cac5b941811c47239572f722d3c2b57c14a1af42cffb609b786e76a5e0f7e62d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697953804, "uuid": "34a9975d-5842-4285-8145-672ccc52685c", "value": "T1AE230271490E9EB124303C76DBD99793B6E02AB1C6673013D62D0B3C2F65B531E5BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697953804, "uuid": "04c8483a-ff2d-4331-9616-399f057ec603", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b31i9q3UELbUXfi6nVMQHI4vcGpvG:DECFd+A6YHAx1XLRQZG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697953804, "uuid": "a08e5981-af33-4747-bb09-4f638fce715a", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697953804, "uuid": "1c66d562-8bd4-4171-935e-29d711d0009a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697953804, "uuid": "9ba2c2ce-962e-4ec1-abfe-a876c2f589bb", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde26c49-70d5-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1697977488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977488, "uuid": "cf451844-e7ed-479e-966c-883d5124606c", "comment": "Malware payload (Gafgyt)", "value": "f20a3418bbc7a8f590681a5d0ca0bbe1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977488, "uuid": "563f006c-463f-435c-8f00-a63e4fd74dc6", "comment": "Malware payload (Gafgyt)", "value": "54af5fbf82e379edb9e0bbc4a7b8491df36fa64cd907b91ac6a56b61bad60a62", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977488, "uuid": "c3e6805a-2d3a-4490-b959-f4c4b4ca81e5", "comment": "Malware payload (Gafgyt)", "value": "e2f68a3825b84330ac07108c7aff9c8d0de7f744", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977488, "uuid": "e1aed029-e9e9-491a-aa87-a3f8f0c85f72", "comment": "Malware payload (Gafgyt)", "value": "fb81297c2c7626d0a39bb21d9106c43190f64191f539c125e5f7400bebb4a6910d7f835329f3d9e5fd7a624f1af41dc2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697977488, "uuid": "814b4868-c0b9-40d7-b467-81b6a421c190", "value": "T125E3D73B2B170E23C0C610B101E30732ADA5DF9B34B956D7AAD07DA96F36A843456BDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697977488, "uuid": "72ab1c98-9bf7-4e07-b92e-743e6e62ade4", "value": "3072:77VYLAtQHhUdGrd+BV7SIxK2lMqXaDs1iNPhgeBVBUiam4uME13SyapNb:77VYLAtQHhUdGrd+BV7SIxK2lMqXaDRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697977488, "uuid": "58fedcd3-682f-4ed3-9ef9-b67eb7a83469", "value": 146153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697977488, "uuid": "ed3b049c-a9ed-4f9f-b119-d4da34c1d329", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697977488, "uuid": "cf6fcd5d-d7ac-44f1-b7af-7ce66dbb548c", "value": "f20a3418bbc7a8f590681a5d0ca0bbe1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99eaa05a-70f9-11ee-8907-42010a9c0042", "comment": "Malware payload (Adware.Koutodoor)", "timestamp": 1697992782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992782, "uuid": "9f211a33-7905-4248-bfda-f3d47a2f70bb", "comment": "Malware payload (Adware.Koutodoor)", "value": "83da3b0418f749cbcddf380af9f8cf54", "object_relation": "md5", "Tag": [ { "name": "Adware.Koutodoor", "colour": "#851353", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992782, "uuid": "60b6a3f7-a5af-432d-a031-959985429691", "comment": "Malware payload (Adware.Koutodoor)", "value": "5539c24148a8f4348b44705e441fb22b74dad47072cf17faa8593350bbe514dc", "object_relation": "sha256", "Tag": [ { "name": "Adware.Koutodoor", "colour": "#851353", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992782, "uuid": "c34b3549-483f-43ba-a2a1-c567d1782293", "comment": "Malware payload (Adware.Koutodoor)", "value": "740625c8a4b8972a42cf9e22c7afc8a0dc0d167e", "object_relation": "sha1", "Tag": [ { "name": "Adware.Koutodoor", "colour": "#851353", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992782, "uuid": "b2493bec-f4b8-4450-b676-ce1a15ce85df", "comment": "Malware payload (Adware.Koutodoor)", "value": "ca74e6b0efc87ffdbbb57f99eb115ad90533415b875690a61e2de97a2e37a03575dddcc0b4e0fac52754fd513294e0af", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Koutodoor", "colour": "#851353", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992782, "uuid": "02643736-1d2e-4482-850c-5eac66a07137", "value": "T1602633E9A1613319F5EC78345F879EA2B5A828CF557488F7F0886C9D3EF44D320A5E90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992782, "uuid": "ef72a836-133c-434d-9892-75b95bb95e59", "value": "4ccce55916b2f64f59ea71ded9d0c425", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992782, "uuid": "0314d5c0-a41b-4da4-944b-824338c6c305", "value": "98304:ibcEfTZlGjsEom3NagAIlR7TwJgH2s4Vx6OocoFSf6Q375FC:ibcEfN4gcMc7QO2heFcoFSfp7r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697992782, "uuid": "460bbc65-3366-4b56-aab2-a2b996aa7fa8", "value": 4489216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697992782, "uuid": "5810990d-e78d-4e2e-9487-1d3680467908", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992782, "uuid": "5d0ea4d4-64d2-4fa4-82f2-28a27a3371ca", "value": "SecuriteInfo.com.Win32.Trojan.Kryptik.HK@susp.11565.26013", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a668e82-70dd-11ee-8907-42010a9c0042", "comment": "Malware payload (Tofsee)", "timestamp": 1697980703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697980703, "uuid": "26c74c8f-51f0-4327-a816-682cc388bdc7", "comment": "Malware payload (Tofsee)", "value": "dd57a0a99fd177b6d0b461202be232cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697980703, "uuid": "81dde0fa-33db-46d3-bd6c-5a0d14a3085a", "comment": "Malware payload (Tofsee)", "value": "55db4b020cad1fd3721568b9a128f9bf5d72a8171546f65a3d9237f21e095891", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697980703, "uuid": "7f55a8e2-be19-4b27-acf9-5c5faf6c11ae", "comment": "Malware payload (Tofsee)", "value": "a5b315a4164be00eb994e2de727b59f38714a910", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697980703, "uuid": "72965be4-f021-462b-a068-4d81df989593", "comment": "Malware payload (Tofsee)", "value": "12d35550ec85c61d6410053296a83b4052dabdba4cc1fef98a11b407a40aae474d414bafba0d8f9ec2e903abc66ef3b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697980703, "uuid": "0df7b0fa-c5e9-4f07-8047-9bbf4ac39df9", "value": "T13E44D021B690D832E4A755341930C2561E3BFCB2AE6680CB37983E3E9E706D15FB6753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697980703, "uuid": "d2d46e44-1bb9-49be-8c3d-a8be18b799db", "value": "d2a54e4207f7fb1f334f58a667aa3417", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697980703, "uuid": "11d0e89a-1ddd-41ff-89c2-510e877405a6", "value": "3072:ayBN7PcxA0GiNw3FpT+Dc3c8GQC00GRhuEkX1f4pdJk556jHb:xdP6A05Nw1p2csuC0hR4EU1+dGj6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697980703, "uuid": "4673e9f1-a7a7-48c2-9486-3a0497893bc1", "value": 260096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697980703, "uuid": "b73f376d-d999-4ba1-a8c3-19bad15d6a74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697980703, "uuid": "ef0ca25d-b270-4546-8589-79aa719917e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44f2f8bd-70d2-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697975889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697975889, "uuid": "fbdae0b7-7718-4d48-8068-3558726bfc3f", "comment": "Malware payload (RedLineStealer)", "value": "f081424532acb4f6dfe856ac70afd62a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697975889, "uuid": "69b72ebb-cb39-40b1-b353-734671425594", "comment": "Malware payload (RedLineStealer)", "value": "56910e64939e6c27344a4a02ed01b8a54ac5d5875bfacea6baf2971ea50ba44f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697975889, "uuid": "fcb4ee85-5b0e-4c04-97f0-81160ceb8648", "comment": "Malware payload (RedLineStealer)", "value": "38e8a156ab23a493e5946d580dbe0446e3e41b6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697975889, "uuid": "ca87291a-6b00-4859-8065-77f4c1dabafb", "comment": "Malware payload (RedLineStealer)", "value": "b224ecc3d4b3d2fab3a4ed0dbeeabed75cace49eeddf23a5ccebf25d5fd605a4b5070c6fb4b64f3e3bc722c1c0dabffe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697975889, "uuid": "62c5cc0f-f65d-4b62-8dfc-3c91ed56fc99", "value": "T18C457D3238889161EEF610B2C6FCF974825DE5BD031525DF96C8D5DEE2583C1BB32686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697975889, "uuid": "6fbd9df3-60c5-4ebd-b5f2-47fa1d458a6e", "value": "440e77e14aa712e0e687ae6e10b63f30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697975889, "uuid": "b45e6a0b-af5d-448a-ae7c-4ed640fd069b", "value": "24576:8cmtwc+VoLIe9GHHHHHHHHHHHmGV/TrjVBdQIHgo4ly:8X+VoLIesHHHHHHHHHHHRTxQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697975889, "uuid": "76d61a22-a6bf-4c17-b2c0-f64356e7623a", "value": 1175040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697975889, "uuid": "df242db5-a903-4245-8aa4-6823f141e42a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697975889, "uuid": "430256c0-1ad3-4967-a4d3-4bbaaa356cdf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23cacc7f-7105-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1697997738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997738, "uuid": "b5fb9375-da56-4a57-8ece-666ac6f73ad1", "comment": "Malware payload (RemcosRAT)", "value": "3ec5b3acbc510443b1102abb60ba347b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997738, "uuid": "a5eb994b-e9e6-4841-a1dd-4f0520baecda", "comment": "Malware payload (RemcosRAT)", "value": "5713b67f81b494c23cde9b38b3216f504647a6e5a0297adc10bb08895e4ed01a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997738, "uuid": "4ff0f089-3ce0-49b2-913c-55d9fb6a2cc1", "comment": "Malware payload (RemcosRAT)", "value": "6613fb6d58d8eb765e9f309b22277cd2bb921c99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997738, "uuid": "307d6899-68f9-4335-9d1f-d9b440d385f1", "comment": "Malware payload (RemcosRAT)", "value": "7f4bb33cfa15d52a728db7ff8c500c35a51a8d803f26c3dddfef819df65cf9092ff63785339c58e53143784bbd8a5d55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997738, "uuid": "1f92fad4-d87c-44d6-a8e7-491d5cc012cc", "value": "T12C355B72B685DC72E02689789CCAB95E151A76F02A4B68DED59C7BD537B03B03B4C0C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997738, "uuid": "52e46b25-ead9-4deb-b7af-89d9a5234a2d", "value": "cd0bc3eafbc3cc9f776d6c66674b72bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997738, "uuid": "b860c62b-3754-4374-b20a-fa90bd60d447", "value": "24576:BnoM7x5Y77KKc2ON3txt+PAidyEyr1VW9:BtH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697997738, "uuid": "07307ffb-3d9f-4cb2-87fe-bbd373e07a43", "value": 1127936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697997738, "uuid": "e94e94f9-a68a-40c4-a8d0-62473ce91d99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997738, "uuid": "af203b1a-0985-4dd4-aa6c-d102e5fb1ed8", "value": "U3766766.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef85389a-7104-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697997650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997650, "uuid": "a5b01c96-ae26-4145-9ff3-1e8c14a6c804", "comment": "Malware payload (AgentTesla)", "value": "32cdf8f3e2956ebde2c4e83dafeeb16a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997650, "uuid": "54742252-2ead-490a-bc73-cf2aa56b4084", "comment": "Malware payload (AgentTesla)", "value": "57d84a2c7393487e69ffb372c04bbb499408e4a56572a6df9c8353b7fb2e4ac0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997650, "uuid": "e1a5e2e1-7c24-4c9d-b1be-38954f4c6244", "comment": "Malware payload (AgentTesla)", "value": "ac7b26fea9a37c10e29f4c8f7728ed55d0538081", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997650, "uuid": "520a05b0-4399-463c-a39a-90961b414c55", "comment": "Malware payload (AgentTesla)", "value": "0a0a2389c10bc42d93bebf2be505a467304874ce1a9227477283fe0167fe527b5a9fae6f567cb54a8ba962b0f177bd39", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997650, "uuid": "cbace509-9430-48ea-9b57-6b8e153e2b87", "value": "T1E1251202FAC148B2C4721D365B75AB31A93DBD201FB98ADF63904A2DDE715C0DB32766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997650, "uuid": "dc376ce0-2831-4dd7-b652-91a5fded59d0", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997650, "uuid": "1d0d0c70-0adc-4700-9523-32ff3ef00a13", "value": "24576:NTbBv5rUanXwu8Ii+aEJLmwVmNBf+sLvgWP/FM+PU:HBjguQ+Jhwv/Lo0/JPU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697997650, "uuid": "b15e26f6-c6ba-40f6-b826-3e62b315ca75", "value": 975776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697997650, "uuid": "734c7503-f7be-4738-80fb-9fb5f0f65c29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997650, "uuid": "37e8c75b-f80b-4494-8578-178af3c36920", "value": "DOC001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ec7a54-706f-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697933426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697933426, "uuid": "ddfc238f-8aac-4354-a09e-8feecfec7b25", "comment": "Malware payload (LummaStealer)", "value": "081d5f3b04bedb4a12e63bd0dba1a7fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697933426, "uuid": "a1225a4e-d7b6-4e41-9a0c-a7ee6b0f9cdd", "comment": "Malware payload (LummaStealer)", "value": "584fa9a7461d3350f9139162dee752e5080df8ce10c0348d8bab93f0fa5d7f83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697933426, "uuid": "d7478915-27be-4d40-bd58-1128014608a7", "comment": "Malware payload (LummaStealer)", "value": "545bd0db9002ec6b6f3ad4bafa5b8a9e3a6acbcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697933426, "uuid": "90b735c9-8795-4467-b153-90ff0b36778e", "comment": "Malware payload (LummaStealer)", "value": "d10d2329819259939cb1071c0c30964b6f180029f763592ecd64c0da8db2c9511e722dc6aa35581428dcd03625aceaee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697933426, "uuid": "01f426ec-74b7-4f3f-899e-079c871807a0", "value": "T1EAB4AE15B9C280F1D823283101B9E7765E78B931C9768DCFF7D42C38EA35680962A77E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697933426, "uuid": "b2649a31-e2ab-4f33-ad94-3185c2650055", "value": "a3147c283328ddee0b7c7c6e4695dd00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697933426, "uuid": "f3842630-ca17-4510-bcb5-94da716f816e", "value": "12288:VFTTWyVmRw8r6+y3QqBZAnYanJ252Wjx1ZP2BJ4KP:VFxVn8m+y3QqBZ6RK11Zw4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697933426, "uuid": "d4d9ad69-1ccc-47d5-895e-3923400be23d", "value": 513024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697933426, "uuid": "69eae4ed-4017-400b-b535-78c9ca3f1d94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697933426, "uuid": "c467e49e-962f-4689-b710-174bf9b7ca25", "value": "081d5f3b04bedb4a12e63bd0dba1a7fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6febfa6d-70f4-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697990564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697990564, "uuid": "4f1e35cf-4ebe-452e-9077-c831202626e7", "comment": "Malware payload", "value": "a8ce704f13e1dafef223e8f082cfedd9", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697990564, "uuid": "89f34ae2-6566-4092-bd84-5cc72cafe08c", "comment": "Malware payload", "value": "5866c5a32934fc71b53b03ee7bd9fba62454c223eda23d39d5a4e63ce8a89fec", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697990564, "uuid": "75a49869-c07d-410a-bea5-8bd40cd14e89", "comment": "Malware payload", "value": "ce4693b129e9025c18cb6fb5cf283f692f9ed965", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697990564, "uuid": "12b90d13-3f2c-4633-b977-8b2dba70e4ca", "comment": "Malware payload", "value": "8908b54db082120cfac53a983ae3355107edb10ec700f3f65412919fbe8cc9adf8c8afaa3dfe7f4290b84b65344ce428", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697990564, "uuid": "dfcc600b-f79f-4f51-bc11-c585adb7c41e", "value": "T1E2E4239206D2CFEE170499F5BB05E022E10E7C54881B5F8AB6DBE1C0575BABCCFB8591", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697990564, "uuid": "f7399c91-d1ed-4ab1-a420-369508e5d2a1", "value": "12288:H+Aio+c25Qur38s05J8GsVSc+nbLPqOX0dC9uQIHTWeMUGHNzOkG:H+Aczf8socWNkdC9uQKTWeYzOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697990564, "uuid": "99eecb15-c6a5-4426-9321-c7a844f11db5", "value": 658583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697990564, "uuid": "2ba238bc-9338-49c3-bb84-02a7a0ee9601", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697990564, "uuid": "2fd3aeb6-0892-42c7-a022-c58203ca24f2", "value": "Shipping Document.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d451e88d-7105-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697998034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998034, "uuid": "2c95b435-1df0-47c2-a64b-eada01062eb9", "comment": "Malware payload", "value": "33301baa87a2dc22c5493f90b043d827", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998034, "uuid": "07f15465-073c-40e7-b5d7-f66aa7b9efde", "comment": "Malware payload", "value": "58d27b401ffca556412f8f06fb2e8934a37aba2ecbb76019bf309dd64b63c36d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998034, "uuid": "4cf339b0-101c-4f2c-a4bd-2b3aed1d6734", "comment": "Malware payload", "value": "070f36de668ffbf94e833daa48ff4388c882051d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998034, "uuid": "7d8c173e-f6b7-4fc2-b680-17f1401cf105", "comment": "Malware payload", "value": "3b8c013362dc8bb71f483da7313cfdf54a098c7a1af17ff5690922d888036cac46c8d5292576653f996ed30e49656144", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998034, "uuid": "0928fc14-ee41-4493-b65e-658a51cafc95", "value": "T1A816187F72A49279C11EC23FC0934F40D533B9762B33C6E7129112A95A669C89F7FA24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998034, "uuid": "7bf8ff23-9b83-4808-8b02-b0b13efe4899", "value": "7495bfccd8e07c22237460b8d82e6387", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998034, "uuid": "4b2138fe-43f3-48f8-a4e7-52780c1f21a2", "value": "49152:Cgh98D4xlsAOPmUIkUI8RUyvhoDCfVC0fLqaNl1XvGTx/S5rcWYjXNO:Ya71fMO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697998034, "uuid": "71865f44-3eec-4cd7-ac70-9e0e27dbb194", "value": 4068568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697998034, "uuid": "8a98f6bd-7697-49f7-a9c1-7a3314ef0aca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998034, "uuid": "110d70f7-1303-4f74-8822-d8c5a036c5e7", "value": "33301baa87a2dc22c5493f90b043d827.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96f571c4-709f-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697954122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697954122, "uuid": "2c0b2678-b514-4b99-a264-448764cafc49", "comment": "Malware payload (RedLineStealer)", "value": "a253ea033a27f83887c8b78f8b375360", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697954122, "uuid": "8aa51107-34bf-4386-9707-6b0f54e8f466", "comment": "Malware payload (RedLineStealer)", "value": "58e8465e01f9f9c27e72127a03c5fea1f89a81ea59e54b5516fa541253425a8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697954122, "uuid": "e5a6df17-c686-4341-84d1-e72804be4794", "comment": "Malware payload (RedLineStealer)", "value": "2ef2a353e95e6631713c0bc94fd0a5a92aa3f7a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697954122, "uuid": "4d1ca9e7-1f63-4afc-a541-1f9d3f49ad8f", "comment": "Malware payload (RedLineStealer)", "value": "41ac10a8544b58fc19662393a14f8fe756c3a7eb69c960c9e88bfcdb944218e4e792c26432ad053ade03009fc827306d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697954122, "uuid": "bda65d86-9af6-4f22-b9b2-44c805af26e5", "value": "T17CC41203ABD89573D8B2377059F602C71B3ABDE18E38875B2781A95B4C32784A57137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697954122, "uuid": "17190a03-ea75-46c5-9e54-206b64a1c69f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697954122, "uuid": "908926d5-6f9d-4a36-a5bc-e6b438c89f6d", "value": "12288:+Mr7y90dXndm+y1Pl487gysEsmR3JOy14NJWRoA9wQMLU0:Jyady1N487Psb2JFqyr8U0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697954122, "uuid": "12228821-6574-4d8b-be00-a43c98c55f04", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697954122, "uuid": "11c0e5dd-37b2-41e6-a33a-630ff9048d27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697954122, "uuid": "33f0c116-67b5-4957-925d-78dcd6d1e2e1", "value": "a253ea033a27f83887c8b78f8b375360.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4245b35-70ab-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697959299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959299, "uuid": "07d66495-54a5-48e0-8f32-0ca51ff1d8ae", "comment": "Malware payload (AgentTesla)", "value": "ef48ec0ef8542cdd2df084d27ab14292", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959299, "uuid": "8a389753-abcf-4f66-8f60-c8c7f7ff7343", "comment": "Malware payload (AgentTesla)", "value": "593b05e40af78bb7a13b652cf12fdd3a506f38e9c99f3a08228d17ea66d66870", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959299, "uuid": "c5ef8446-9191-470b-aabd-f412385ffbf2", "comment": "Malware payload (AgentTesla)", "value": "c69d9f0e69ada9063063e4071487782b31f1655b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959299, "uuid": "efe8f475-1228-46ae-b627-6258789e1cbe", "comment": "Malware payload (AgentTesla)", "value": "571059ca44bb874c4a0625224b3da45ea09d227427f16ebb7438fbf4be98dbcc24d909decdf6a6f630c71b54d689a160", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959299, "uuid": "b3e0b79e-28b5-4ccf-8884-b8c487b7942a", "value": "T1FDE4E0AC7650B5DFC867C8368AA82CA4A721747B530FC243A05312EDAE4D99BCF155F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959299, "uuid": "a504c1e8-922d-41b3-a63a-b216560682ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959299, "uuid": "7a10688e-55a1-46a9-883c-0f1cad98477b", "value": "12288:hiY/j+BiJl7Unz+Yjk0zhI5ogvErs/ksbdrKsYI7R9GGBLGboMGmvcE9gaa:IYL+iJlAKXB5oHsDbZKFgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697959299, "uuid": "d876bca3-4d23-4e44-b5d2-9589ee96c110", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697959299, "uuid": "d11da6cd-59f5-485d-a280-cbac084d167c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959299, "uuid": "57986c8e-e13d-482a-9c47-cd4afcff5b24", "value": "Rendel\u00e9s PE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e911719-70ae-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697960443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960443, "uuid": "812c908e-b920-4649-b0b7-00b30d7d90b3", "comment": "Malware payload (AgentTesla)", "value": "1fd8888d883175f52abba453a390244b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960443, "uuid": "4369ac32-358e-4c4f-bafb-c171d4eca1c1", "comment": "Malware payload (AgentTesla)", "value": "5977996d323c55bc5c986f78eac6da795ea114b0ef57d4f062ca618de28daea5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960443, "uuid": "71c9cb70-1cdf-4090-81a8-f8c422dce8af", "comment": "Malware payload (AgentTesla)", "value": "4748ab3f1fc3a823ce1ae99db2661ff49351c668", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960443, "uuid": "91b6eed5-87fd-4cdc-9cd9-91d81b960ef6", "comment": "Malware payload (AgentTesla)", "value": "9231e5911a613b24a079494721f54be8c26d64d97dc2734f9fce61832647532772e9905a94811f4b70858f121fae58a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960443, "uuid": "34aa0074-7a86-4114-82f9-45c111e50fbc", "value": "T1D8C4120423F54B6BC077D73995B50321A3B235585A72EB18AF9CE5A92FA3F880341F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960443, "uuid": "a3e1467c-6e64-48ca-a5c6-916e5e97e3d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960443, "uuid": "b720b9bd-ed3a-4495-bac7-bd13adcdc15f", "value": "12288:u61k1vjJGGna1czoz0wC8tCARM9r3JJLlO+G7uhdbQ87g9J8vH0iu1:P1k1LJ1na1cUzLC8tTRM9/R67s2L93iK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697960443, "uuid": "4f185bc4-0014-4a8e-8098-331cb293fae2", "value": 587264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697960443, "uuid": "0011d088-a3f7-4501-b755-0d3767a597a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960443, "uuid": "16486b5b-51fb-4284-a20a-1d78b00d9e37", "value": "Payment Notice dated 09.10.2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ecc6f69-7105-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1697997730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997730, "uuid": "dde39969-8023-46ef-993e-2a551eebda2d", "comment": "Malware payload (DBatLoader)", "value": "4df53542d922558e40dbc442a944b0e0", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997730, "uuid": "b9eec1d7-0fb0-41af-9a60-4c2adc9775d6", "comment": "Malware payload (DBatLoader)", "value": "5a7a2248d2e7ef9b64a4210bae505a0a86a55d560f4f1c115c235a49f106c188", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997730, "uuid": "18c0ab76-ffa5-41f3-ba5f-01c8f384b422", "comment": "Malware payload (DBatLoader)", "value": "859565a2c9c4beff62fe13b52b7e236a8459a4d5", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997730, "uuid": "406c1749-e23c-4869-b517-3591908b9257", "comment": "Malware payload (DBatLoader)", "value": "74d7cec3046ef8a6ca9aeae1c69bbeeb4b3b293b595b50dabc2f3502ea0e3ee6d8deb958ec32491c59134413a5578740", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997730, "uuid": "a3c176b3-bb48-4274-87cb-300bf1c5eba0", "value": "T117451A4ABFADCC60E0A127BD8C8D5BE5786D79C136B5CC9122683D4B09113E57DA80BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997730, "uuid": "d340a7db-36cf-4d4f-aec3-d2e817f5ad8f", "value": "d020f949ba89411d7c49f3baa1ad9952", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997730, "uuid": "32202212-6fb0-4071-bdd2-24b214c53797", "value": "24576:E+x0KeaVl6fTAz/92jMRffknKdEfJ17E+/:E+9zIb1I+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697997730, "uuid": "b08197b8-1587-4376-897e-a7193dc9f88a", "value": 1178624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697997730, "uuid": "2eebc8f6-1d31-4afa-b826-e109b5ef2dea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997730, "uuid": "1c9db309-eaac-4d75-a554-07e18ed62601", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a14f423-7085-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697942719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697942719, "uuid": "995767e8-fb4b-4c0d-9b98-f256efe7a518", "comment": "Malware payload (LummaStealer)", "value": "500c430adad92d5574f41822f1836c4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697942719, "uuid": "33a2afad-7dc9-4175-a7bc-a88877451460", "comment": "Malware payload (LummaStealer)", "value": "5b5e2552d691212b83ad41eaa420583b68cf57e83362fbdb754ecc84f8dd3fa4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697942719, "uuid": "f90ce61b-0d54-4fc6-a648-1ef0ba67ac7e", "comment": "Malware payload (LummaStealer)", "value": "36b742b44cd59bff82e7518a1f066bc0c73e19df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697942719, "uuid": "d9e1ac55-0bd3-4063-9758-c8451166849e", "comment": "Malware payload (LummaStealer)", "value": "c7294a02f02be80817cbe5522be2f4788be1f1f2e6aa1c0def3bc5eaa0aeae798cb8b991541dfc9e44fd08527672fe3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697942719, "uuid": "c70e6f8b-b56d-48f9-87a3-bd061517e9b8", "value": "T14F158D2178C09132EEF320B787ECBA2642ADE0B0071915DF56D857EED760AD17F32696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697942719, "uuid": "217b5575-2d5c-4d2b-b60d-9d0ce5abb988", "value": "440e77e14aa712e0e687ae6e10b63f30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697942719, "uuid": "8c5c47d8-afb4-4c2c-a371-8aade71faa9f", "value": "24576:rOmtwAOC4b6HtHHHHHHHHHHHEsydhVrje0NC:1OC4b6NHHHHHHHHHHHah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697942719, "uuid": "d2ae6e44-3427-412f-ae14-1b293239cd70", "value": 938496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697942719, "uuid": "aec50f14-147b-4277-bba2-9e333ce53690", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697942719, "uuid": "f2f04c91-e112-4104-92f1-a59d14fb0d7c", "value": "500c430adad92d5574f41822f1836c4b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60228594-711d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698008147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698008147, "uuid": "3dda1b73-3c6a-41bb-a405-e80ff0617ab3", "comment": "Malware payload", "value": "9039a042ccd39871865f781632be8304", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698008147, "uuid": "80904dca-def2-4d0f-bb3c-ec6d4712224f", "comment": "Malware payload", "value": "5bff8bb85db7c5ea30cd9f8e71afa589fb4383aa831e9982321173938488fc1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698008147, "uuid": "b7d5640b-b3ab-4307-ac92-bc106e8a6247", "comment": "Malware payload", "value": "91bdbaee86a78faa0669310a0aae94eec44d0be8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698008147, "uuid": "0d9fef05-8235-42d7-a5d3-c2d86737c95b", "comment": "Malware payload", "value": "29bafac987512b82bba1a72858ca36f59da58fd3ee3e07420a5b691e6babad69c8d8fe712f11b278a21ab4c926bfcf9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698008147, "uuid": "ff2c8120-dd0c-45d0-8844-48f9df4b202d", "value": "T1BA04CF2176E0C032E4A759751970C2A22E3BBCA2AB3440CB77582B7E6E707D19BB5753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698008147, "uuid": "b22cd3ea-f951-4f2b-ac88-3c73e28e9020", "value": "6ae03e1897875cb6ffee8a530dc88389", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698008147, "uuid": "c3717c0b-ffc7-4b9f-b3d4-e3c6f3d0903d", "value": "3072:PyBN6fwr6Assyrnx21vidmjuyLcnLCnr3V0OfxX:eF+As/rnw1viQ0LeV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698008147, "uuid": "06ce53ff-6698-40ba-983a-4c4d8218c6e1", "value": 183296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698008147, "uuid": "bfcdd79d-9bf5-493d-b0bd-3312ef777035", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698008147, "uuid": "f226ce69-38e4-46f0-ace0-6f59211285e1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8669535d-70ab-11ee-8907-42010a9c0042", "comment": "Malware payload (404Keylogger)", "timestamp": 1697959249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959249, "uuid": "be2b25a6-4178-4a3c-baf6-5d19d12bfb47", "comment": "Malware payload (404Keylogger)", "value": "c9496f197fdcda56b79b08a2c1bef95a", "object_relation": "md5", "Tag": [ { "name": "404Keylogger", "colour": "#252FF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959249, "uuid": "809c4181-dd28-4f34-8a52-6bd439f0d9f0", "comment": "Malware payload (404Keylogger)", "value": "5c15c129aae1ece5c5fd7236da82fc24c42f5df156ef3463e07fe54aac814941", "object_relation": "sha256", "Tag": [ { "name": "404Keylogger", "colour": "#252FF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959249, "uuid": "01ac5b2f-8d98-4450-b46f-0ad82167e161", "comment": "Malware payload (404Keylogger)", "value": "54ef32be9d2edbfd3d47840203a1177b84dfe463", "object_relation": "sha1", "Tag": [ { "name": "404Keylogger", "colour": "#252FF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959249, "uuid": "4912f76e-b58d-44f1-bb82-d87d15f2b4fd", "comment": "Malware payload (404Keylogger)", "value": "68909d3e70849fc3426500962a6bf08670c8109b371df4d50a014e02e2aaac974b51aaa7453cdd282fdb47e1ff387c5b", "object_relation": "sha3-384", "Tag": [ { "name": "404Keylogger", "colour": "#252FF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959249, "uuid": "dace75aa-fac5-495e-b473-57d0360d48e6", "value": "T10ED4120526A85762CE3A03F718B29E661BF529BB5162F6512CDF12EE237BF04C751B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959249, "uuid": "c47affbc-7e5a-4735-b774-0192ef9073e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959249, "uuid": "65b65871-653a-48ad-8c18-edd050c53e51", "value": "12288:9A8zS55mFzhY1qA+S2ArkpTrzkV3r0vR7g3endlUkkuR0IrLL69DwbLEBBZpbZ:9Af55qi1p+S2TpTUVmaQdlkKdLW9Dwb2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697959249, "uuid": "64e8b514-48b1-4f63-819c-2f6404ee42d2", "value": 641536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697959249, "uuid": "49cd6987-9fbd-4790-a5b3-e7679425024f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959249, "uuid": "d84fd255-e52e-4611-9cdf-c7769630350b", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0344808c-70d6-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1697977497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977497, "uuid": "45620ab4-09e9-4caf-908d-0e0da2951503", "comment": "Malware payload (Gafgyt)", "value": "fae249063eb09a47842e2b092cdefd8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977497, "uuid": "e26adaed-00a1-4818-b03c-8e8f7eece39c", "comment": "Malware payload (Gafgyt)", "value": "5c4d6d886604cb6b2f08811d708f34553039c676236ecbfa38dc442a96bb8b0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977497, "uuid": "0701a615-5d4e-4f7e-9aba-dd7d0c8afb0c", "comment": "Malware payload (Gafgyt)", "value": "b8556b31b32a6d2c909e759513674ad1fbc6254a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977497, "uuid": "3fd6a234-628d-4f72-bbf4-2d1d84e62adc", "comment": "Malware payload (Gafgyt)", "value": "3956de1385124422ebf3aee04aae96719dee36e36dd42b45355fe419adbd6bc8a30adb387bdb1a27f5945eb6a05303bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697977497, "uuid": "297e99fb-a720-4a3d-8022-eadf873bb7c2", "value": "T17CC31977A4545EB2C142A9F125BB99310F16AC930B1F1A993238B6F44A3F4CE784FF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697977497, "uuid": "73cc9ba4-969d-499b-be85-a78a0e433214", "value": "3072:WZTxXfVI4RXFeCcsDIzeO5S2gZcEyy0yYXN/:WZTRfVIM5DISO5S2gZcEyy0yYXN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697977497, "uuid": "dd81c706-a4fe-449a-b4be-c93045cac7ec", "value": 122750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697977497, "uuid": "48b8ae50-5f1e-450d-b5d6-9fd4115f8ad4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697977497, "uuid": "737f6030-5c88-4940-8037-476744493199", "value": "fae249063eb09a47842e2b092cdefd8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cafdc40e-70df-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697981698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981698, "uuid": "2ba39026-b209-45aa-8636-fd5e1b22e44b", "comment": "Malware payload (RedLineStealer)", "value": "703d599ebb2702f5737053f3ff00424b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981698, "uuid": "09cbfb32-3657-4944-bad7-c534dd9c9e5b", "comment": "Malware payload (RedLineStealer)", "value": "5d50a1577ee0791e7aba6bf8e679b4795d533a3daa54177ce8a0ec25cc8d3df2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981698, "uuid": "a8570566-a3bf-4bf8-b0a9-6bd4ce70cd8e", "comment": "Malware payload (RedLineStealer)", "value": "9d01bc0be6bddcd6dd91e62ec3cbafcfef6ac387", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981698, "uuid": "96523f48-7bda-4fe3-9b58-384e7ab68ecd", "comment": "Malware payload (RedLineStealer)", "value": "226cffbec895efc704b03f6019765f91e89ab96bb1554afb127cdaad8960d50e78cf5d634fc55963c717b9044f8bfa8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697981698, "uuid": "39978c30-0b28-4920-941b-510c4eb47592", "value": "T174B45A51F0094F2AE3E2087CEACA5DAE4D507EED6F530B8F36C14B8167967D1A93910B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697981698, "uuid": "819e69a8-7015-48f2-a9f3-e46bcaabbafa", "value": "d350427820086a321ccf21b695161218", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697981698, "uuid": "985cecef-5f85-4027-b40a-4410433cbd26", "value": "12288:A8U8MziIQB2o97Hr62k3n/+pLsv9+eXUeF6e1L:dM+IQkAr62k3n/+pAv+enL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697981698, "uuid": "30c821f9-ddda-4111-9cdf-00ab3845ebb1", "value": 508488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697981698, "uuid": "4ea09a3c-e05b-48c1-ab2f-2a5363f0cc68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697981698, "uuid": "e79d09aa-dbbb-44f1-81f4-5eaffed9a6ec", "value": "SecuriteInfo.com.Trojan.PWS.RedLineNET.6.3839.2630", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ae17a4-7113-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698003814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698003814, "uuid": "ff6327b7-685b-418e-835b-7c48ad59f7e0", "comment": "Malware payload", "value": "4548f68b94a41b6c840cab5383076156", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698003814, "uuid": "3798d744-f878-4a13-87a2-d8cba9bf6c63", "comment": "Malware payload", "value": "5df3fe8e23a96dfe79cf8f69505849f1abf5a1f80b3804a1c84dacf40388623e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698003814, "uuid": "91091f13-7cac-4f13-b62f-2b0ebc5edc86", "comment": "Malware payload", "value": "ec170d0390a940d392498e68944b7df32e2ac533", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698003814, "uuid": "153e2e96-df51-4cda-a467-3e06d33e1114", "comment": "Malware payload", "value": "83cce4c9358f1f46f240e5e4a3e2e94f5d9066c41016da9eacd24e9f27e83439d6085d5575881ec45e95b6db5cedf558", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698003814, "uuid": "595ee0f1-93ce-4029-9d43-6c8352cab604", "value": "T1C073381371FBCCF3C05A41B90955D625B67DDB741BE08BA32FA62A4E4A34A803F75341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698003814, "uuid": "35714814-4165-441c-b4ee-e57812955fcd", "value": "3896ce7a240d56e3ddfa27db1052d041", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698003814, "uuid": "890bd423-b772-40e8-880b-b32a7bac524f", "value": "768:sUHlYZGoaE4AhRkcHSz9Eiu8X4kCM1vCJ4ZstVtnIwwww7m2ieIW:HH8oQyz2iu1kYmEtnMm2m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698003814, "uuid": "def5eb51-b05a-4f52-8735-b9866ec58b83", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698003814, "uuid": "7138a92c-4ca3-4845-85bc-d6a2006fb08e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698003814, "uuid": "c78b9316-0974-4f67-8ec0-7539bd67928f", "value": "SecuriteInfo.com.Variant.Graftor.701729.9173.13858", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c64eb3a0-70ab-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1697959356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959356, "uuid": "20bd09af-b548-430e-a00a-29939be0cd7c", "comment": "Malware payload (SnakeKeylogger)", "value": "d68996a2f45b0789f9459f2d5febb7d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959356, "uuid": "d6570b62-5adc-40f7-a846-e9bbdd90821c", "comment": "Malware payload (SnakeKeylogger)", "value": "5f8be56dea9bea8e39fe710325e59720a3168500a07cf780abbc0cbf0b3249ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959356, "uuid": "8a623636-4ea6-46db-b86a-ad1970baa8f8", "comment": "Malware payload (SnakeKeylogger)", "value": "76a9cccd1ff91fc37b784ce3ca9db0d3782abf6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959356, "uuid": "87005cb3-4d00-4431-bebc-fee928f91788", "comment": "Malware payload (SnakeKeylogger)", "value": "9366e591f72210cc2df0305f29c021746380598c932e15d0f2841a9c3c6dd939c225dba86410edf098f1196d017eec90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959356, "uuid": "d1ab6adc-9215-451c-9f2f-435eb5b842de", "value": "T1CFE43A63E7C48203E61F8E3DE4F6730092E9D84DD5C1E789EC91A8BDA9E6711F907612", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959356, "uuid": "b52b1edf-ae72-4d1a-8f18-ff6a5f86c66b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959356, "uuid": "8ed61a4b-9cbd-48db-be19-626182d0c93e", "value": "12288:hXtcgcGkQRq7jjYZcq7St7BlgK6dYINDBJ90upqtg7Y3H0kIdO:h6wkdYuISt7BSzdRNtEgqtlkk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697959356, "uuid": "ea70344f-64a9-4222-9e1e-582c4459039f", "value": 708096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697959356, "uuid": "36155487-835f-4767-8d20-8cad93f0ec15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959356, "uuid": "84286eeb-ecf8-444b-abc9-d06682ccccac", "value": "d68996a2f45b0789f9459f2d5febb7d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2df87c86-7105-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1697997755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997755, "uuid": "57cc5ae1-86f1-4749-a685-2bf1da13d528", "comment": "Malware payload (DBatLoader)", "value": "db2b08116745e71922a8017357a10aa5", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997755, "uuid": "9b4e3933-f790-4590-a974-7defdbfe4781", "comment": "Malware payload (DBatLoader)", "value": "5f90bddd59fd40b3ea452237ab912374f13893eae1f70fc923fa3feff7f4c850", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997755, "uuid": "1c97bd97-ec9c-4069-9599-6953d977c279", "comment": "Malware payload (DBatLoader)", "value": "9b8109d047d3aabb6b281bea8f7db556dbde1c43", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997755, "uuid": "dd6c9393-3ebd-4c38-959a-ae5f89a3be56", "comment": "Malware payload (DBatLoader)", "value": "6dc4458121dee701ea0d19cf4db6b3bc4d82c9759ced275ca186be2c588f7a4b2ee0964aabceed49c39e09b155a61c98", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997755, "uuid": "35ca3757-17ff-4c4b-97af-449ca124a04d", "value": "T138355B72F986DC72E066C5789CC5B94A161A76F06A4728EED69C7BD433703B03B9C483", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997755, "uuid": "f5007801-809c-4f31-8aeb-c9cbe8e857e0", "value": "cd0bc3eafbc3cc9f776d6c66674b72bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997755, "uuid": "78232b4f-4471-4a49-8a21-466a618b7ec0", "value": "24576:BnoM7x5Y77KKc2ON3txt+PAidyEyr1VW9:BtH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697997755, "uuid": "a764a171-358f-4156-b924-b2dd72c810dc", "value": 1128448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697997755, "uuid": "4e7ee0b4-b6ab-4fd4-93be-3c11e08f7135", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997755, "uuid": "a473c85a-1836-4952-a27c-4e4d3b59da87", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f9b92a-70f1-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697989100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697989100, "uuid": "60642269-9e4a-4e8d-979b-6c6baa5a6799", "comment": "Malware payload (RedLineStealer)", "value": "563296f99f48012095c055b9edd6180f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697989100, "uuid": "d0452abe-46d6-4ab5-aa77-b302c70c9623", "comment": "Malware payload (RedLineStealer)", "value": "5fd7d8a189dd4e5cb0005d48508b4e6f88fe07550c83d3ac110656a8b558d3f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697989100, "uuid": "943e2f48-ff34-4fad-8093-3ed0b633d391", "comment": "Malware payload (RedLineStealer)", "value": "fac31bc5af63c7f504f082a1e4be543fdba2345d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697989100, "uuid": "207311b7-ccb3-43a6-b4f3-94721f6486a2", "comment": "Malware payload (RedLineStealer)", "value": "037b4db19575b33240287a56bdf360ce55bf3c8b784550d808d0970a08406432d97dfc6bfbdac6f648a622fd789310e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697989100, "uuid": "f1e6b84a-4636-4521-a8f0-e511df06c6a1", "value": "T199865B87FC5051E8C1AED33186664262AA703C885F2127D72B50FFB82F76BD46E7A354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697989100, "uuid": "5a33df9c-bd99-4f00-ae6c-0f63e9f261f7", "value": "85cddd6092e65c1a58dd1e6e9ab9fc63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697989100, "uuid": "cffe1667-f6ec-4bb0-8062-b19a08fd514f", "value": "49152:59CGC88PPVhP+rb/TRvO90d7HjmAFd4A64nsfJW54rMIUI/co5lKMWczKx/DWck8:yP7q+MHqmycJCR3gFI7oEIbGwGtm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697989100, "uuid": "70532703-fa20-4eae-aaa6-3fb4ede2af38", "value": 8191488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697989100, "uuid": "bd8628e7-770c-46c1-818b-019d5f6acf0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697989100, "uuid": "d20a6b05-2e6c-42cb-8140-39bda2faa3e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e0eb2b-70d5-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1697977475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977475, "uuid": "7f0ad13b-c865-4313-9898-4dfdb117b3d2", "comment": "Malware payload (Gafgyt)", "value": "594269fb042508a6f16a5d890a6bfc00", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977475, "uuid": "854a2e55-68cb-487b-96a1-9255e06650f9", "comment": "Malware payload (Gafgyt)", "value": "620e4559527021bebe36eba3b68796e3a9a3115e7a17f30466dbf0cada532962", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977475, "uuid": "61f319b6-f20e-461b-8b62-8218e1f2195e", "comment": "Malware payload (Gafgyt)", "value": "89171f8001d9bac2bd06ebb0fc1d16d5d323110d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977475, "uuid": "f66a20fa-d121-4951-8f79-04a53f8611f7", "comment": "Malware payload (Gafgyt)", "value": "e8d0b7817e14d423f1275f947c62c2cd65a577d6190635623c35763ed4d4513cf13100a36d747ba45ca1cefaeaddc37f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697977475, "uuid": "511e48c9-7a76-477a-b3a5-dfdbcf8beb6f", "value": "T14DF3A53A7E21AF7EE168827107F69F70CF9529D326A19381E26CF6185E7118C0C9FB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697977475, "uuid": "da53bde7-a89a-4be8-9cac-1cb19b39370f", "value": "3072:Dk5EO/C4pv7EWfIMHaY8/uhxOeqvgDFQrT4tanOFrJqNb:I2OKq6hcceqvgJQrT4tanOFrJqNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697977475, "uuid": "bc7da226-a7f4-43de-8f42-0c2192176cff", "value": 171425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697977475, "uuid": "1184d290-a15e-46ad-9833-ca75a9229d57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697977475, "uuid": "8fd0f809-244e-40f5-bd5e-54e9439ec634", "value": "594269fb042508a6f16a5d890a6bfc00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42177736-70ae-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697960423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960423, "uuid": "90a7694c-e707-4e63-bf89-d903af04531d", "comment": "Malware payload (AgentTesla)", "value": "2558d292b0740c68f9659e27cd97d0e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960423, "uuid": "113f9aca-53d2-4f56-a2c0-14bf02cc3589", "comment": "Malware payload (AgentTesla)", "value": "6263789f50600a7d83b56afd240d9f11ae805e89746bc30dd34ed7df05a26b2e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960423, "uuid": "a1af1117-7d0c-4a7c-9945-b943d4294a2b", "comment": "Malware payload (AgentTesla)", "value": "3bac5f4f5da8722351c6778c9336beef179be9e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960423, "uuid": "18c0ef4f-9df4-41e3-98b2-ffc3e373abde", "comment": "Malware payload (AgentTesla)", "value": "4f31f72bf55314e53f2899721d2be7121cac820b4b188b14efda6e933f915bc5ff47fc76f03798e619e041d595596be1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960423, "uuid": "32599a1d-647d-4743-a919-30fc1f5cb42b", "value": "T1A9D422413278471BCA2812B34E72CA950B714EAA2D01F7DA6ED531EF1E7BF485711B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960423, "uuid": "e86c1af6-0d80-47b8-a3ff-bc4b407e4df7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960423, "uuid": "9154a12e-e430-4973-8e99-a017f48f07b7", "value": "12288:v8zS55mFzChrSLYv54DwGbOsb08rxV9dvYReB0/kvRyy13EdHNt2joak5r:vf55qwrSyubFd9dpwoOGjTmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697960423, "uuid": "f94e0afe-46d2-48c1-bdc1-d3c35089ef02", "value": 652288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697960423, "uuid": "adf7d9c7-2d91-4ff7-84f4-cf3421a43b22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960423, "uuid": "a8942e94-29ce-4015-8f47-e41fd6fb375a", "value": "XIANGBU GROUP- PI# 6647580 - INV, PL, CO, BL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "249b610f-70e6-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697984425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697984425, "uuid": "1d5c2cc4-6a7f-461a-8e65-b495bcfdbcbf", "comment": "Malware payload (Formbook)", "value": "4a35e37a64bbb0d53e962a5440c92d50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697984425, "uuid": "02a366db-7c50-4e3e-9445-ffd277d26607", "comment": "Malware payload (Formbook)", "value": "62ac6ce25d4892e38687fb0222374fbe8d4bbd422420ffa5f78925f54c22705c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697984425, "uuid": "db16ba7c-bb3f-47ad-bc8e-807d223cec62", "comment": "Malware payload (Formbook)", "value": "e136d2ebc95a0c7432c4ba38272e2703a56b9451", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697984425, "uuid": "7f2f48ef-90fb-4be5-a286-e187bb92635f", "comment": "Malware payload (Formbook)", "value": "14f70a25dd64ae6986dc4a8648eca67f5d3d0529ad99c5f8bf9359f0634d96a83323b9cad1c1ba52f6eba47a42083654", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697984425, "uuid": "12432cf3-ac1c-4e4c-bf6a-9cf63148c5b7", "value": "T1E0158D2138849172EEF320B747ECBA3682ADE4B0071916DF06D857EFD7506C27B36696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697984425, "uuid": "eee8fe59-afb5-401b-94a1-e4a0e07ef3b5", "value": "09b5d280d2d122a8b769c1e2cd1b4ca6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697984425, "uuid": "d8391817-e255-45ac-bd38-66084aa9591b", "value": "12288:qkirmNw63msf/l64QDQbEMsd1HBGO6Q6zg62AOBuvSDZEJgThF7y:6mNw63msf/lGUYbd1sxaTL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697984425, "uuid": "b3bb0a8f-7784-4ced-8222-d9c351f2b84b", "value": 934912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697984425, "uuid": "50bda15a-d6e5-4342-95bd-3b29b96e2be8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697984425, "uuid": "251d7beb-6d63-41d3-b7f8-37e8ac0d3ad7", "value": "62ac6ce25d4892e38687fb0222374fbe8d4bbd422420f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1f08d88-70ab-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697959322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959322, "uuid": "67474a5f-b5aa-4d68-b05f-d01e8d9740e1", "comment": "Malware payload (Formbook)", "value": "ec72a2d17e5aca17cd44370814199aad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959322, "uuid": "2b36c49d-6122-4656-8cbc-1dcaede96684", "comment": "Malware payload (Formbook)", "value": "62d4746fe8cb8c1fbcc99e50e969a066ad33cd2901c8a870c4607996b28f26f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959322, "uuid": "c4ec5603-fa62-40e5-b02b-53b66a9e6f5c", "comment": "Malware payload (Formbook)", "value": "896b8008166604a48c57bdaa6adfeea9afdd8197", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959322, "uuid": "8ed74911-aa9a-4d62-82fe-0d648f225f04", "comment": "Malware payload (Formbook)", "value": "92dcaa21c0e9a8ca14aee3bffbfe9a99982051796c795bfbe56cc9ef405c1efacaac9e7bd1870a148fb261b88eb9398d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959322, "uuid": "fe307e96-6563-45c3-9c85-f98ee046454f", "value": "T18AD4122837A0B6BEC137843AC9942CA4973075BB9727C24368A3159DED0D66BCF517B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959322, "uuid": "c92f14f4-1229-4aa7-bdb5-238e9676a94c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959322, "uuid": "a9f4f558-c5e4-4e16-b21a-961439776897", "value": "12288:uH/j+BAr5q/ZmKLFDcF4dNCF7YPRbrs//R0hdzB6Y72k9x11l9mteEw1dpe53W:YLgw2BLFDcGd2Ylw//udcw2kVRm8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697959322, "uuid": "20926346-ad0a-4ff4-adaf-23a068e36f0d", "value": 637440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697959322, "uuid": "f1c4408e-b22b-4709-8689-bee61aca6ecd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959322, "uuid": "a2d897e3-d939-4010-8d07-e21328986b34", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e15da0-70aa-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697958932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958932, "uuid": "652ce38e-6f3c-4748-a3df-09a991045682", "comment": "Malware payload (AgentTesla)", "value": "6a42440f36fdf0934f37935c942d7c8d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958932, "uuid": "11007dcb-b885-4c7e-b13a-9b61a043e273", "comment": "Malware payload (AgentTesla)", "value": "62ddf21940294964b888e9370713e136b014b8e850ce276d94e9b410a498e739", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958932, "uuid": "2835528f-493a-4139-817c-01e9ddbc9043", "comment": "Malware payload (AgentTesla)", "value": "c150a54221e533af2e0715204c1239c2737f1a38", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958932, "uuid": "499da200-b4cc-42e5-b6ce-6f48100d43d5", "comment": "Malware payload (AgentTesla)", "value": "d2d90c103e1d831a9c14f9311e4103adee92d3dd3d8bd858395acaa9c7c81a8832bf50c34b33548dc387d93aa091466a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958932, "uuid": "7302ce50-4890-4921-8674-bceee885263f", "value": "T114D4120632D88A73CF7B4F79AD5215056BF2AD665C22C28BDF9071CA129EF318520BD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958932, "uuid": "6cb68007-fa3e-43d1-9a26-bb3553518574", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958932, "uuid": "eea1f384-a545-40d0-b22a-2e6baa82a382", "value": "12288:Ks7s9Owm8gwhRK4FKEcgqq5WtxKZHP/V4MFo8:Ks7s9OmJRK8/cgqq5WTKF/968", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697958932, "uuid": "ec048ba7-291a-4300-8fb3-24e05b37442a", "value": 631808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697958932, "uuid": "7d07e64b-d109-4874-be40-b3dc9a89cc7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958932, "uuid": "27a8da91-2b1c-4d0d-8fad-b6c5459392d2", "value": "TEKL\u0130F TALEP Do\u011fan \u015eirketler Grubu Holding A\u015e_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae8fdee-7105-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1697997696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997696, "uuid": "45924e8d-6c82-4680-b3e1-62b10a6f6d79", "comment": "Malware payload (DBatLoader)", "value": "e3dd4038e1646e198ba063c9c12e17fc", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997696, "uuid": "2b17f684-b7c2-4885-880e-b8f47cbb7f50", "comment": "Malware payload (DBatLoader)", "value": "6315748f31eb1c22f2d5b4d8bf4309691c06986676db552a387c90a3c3f467b0", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997696, "uuid": "9245b430-44d2-4841-823a-6723b6d26125", "comment": "Malware payload (DBatLoader)", "value": "7c4ce056ee45badb782ea5f81abba3d738787243", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997696, "uuid": "c5f4e95a-6b0b-4caf-955d-53f8ccacdf9e", "comment": "Malware payload (DBatLoader)", "value": "4c233ea1ffffc79b03ad8b77c8521e6f918f17ad074b1dbd11369271ea8e0e123d7761aa305ee4680719e8b83904cdeb", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997696, "uuid": "372b4078-2ade-4665-bbc4-1015aea2f206", "value": "T180452A4A7BADDC60E0B127BD8F8D1BE2B82D79D136B5CC9122643D4B09112E57D980BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997696, "uuid": "6bb48463-f8e8-4fe5-8e32-f791b736c48f", "value": "d020f949ba89411d7c49f3baa1ad9952", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997696, "uuid": "183ef0b2-fdca-4cbd-84a3-a017ec463dec", "value": "24576:E+x0KeaVl6fTAz/92jMRffknKdEfl17E+/:E+9zI31I+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697997696, "uuid": "9f08beba-afc7-4a5e-a095-fd5dc7abd496", "value": 1178624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697997696, "uuid": "dc903aa2-6405-49e6-bf0a-78d873fd0357", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997696, "uuid": "d95b0c6d-52c5-4161-ba98-538ebbc82d96", "value": "ORDER DETAILS_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dc63189-7072-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697934619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697934619, "uuid": "197838bf-6458-4a9f-843a-0692da0093fe", "comment": "Malware payload (LummaStealer)", "value": "0ed6961ec15eca36bb9c0c9f9738e098", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697934619, "uuid": "f71b1db7-c5a4-4baa-952e-7df7e362f08f", "comment": "Malware payload (LummaStealer)", "value": "63e5be3d55ff226602f88192e80e49d566f82d275c647a63599546520a543877", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697934619, "uuid": "b0d3a369-2561-4fe6-b039-2247d035008f", "comment": "Malware payload (LummaStealer)", "value": "1610d502b96819fc4d2edd5f1bc0481fd6674465", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697934619, "uuid": "a3571bf0-632b-4f34-8a73-98ff3879f00c", "comment": "Malware payload (LummaStealer)", "value": "591f081c07c76d66e8b3f8cfa1a691a753a8b9f5372b7fce276e6e2e916aef013ffc030a4f07aa94495078aebeb74884", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697934619, "uuid": "539fe7c4-0bc1-446f-9204-fcc64ac45c07", "value": "T12E34BE0172D1C073D97215350AE0EBB59E3EB9700EA29EAF67E40F7E4F302C1D665A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697934619, "uuid": "ab87ca62-42c9-4136-927e-03b655697adc", "value": "4f0cdfd3e1be2bc790b5aa9061b7d52c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697934619, "uuid": "9535dfa0-a5fc-495e-861e-7d9ade1551ae", "value": "6144:Tm3X4FIRd5DzznuBosiDKl51eAOjZ8zsbjaTi:TkIKd5DPyehZufTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697934619, "uuid": "6296f2f9-d507-4bd5-9c64-2655b61c73b2", "value": 235520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697934619, "uuid": "df458415-efb4-4410-87de-1c14ff333194", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697934619, "uuid": "597578ed-715d-4cf7-86f7-730635090f27", "value": "0ed6961ec15eca36bb9c0c9f9738e098.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbbafb66-70a0-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697954641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697954641, "uuid": "7fc99780-c863-443d-a252-c6db9e6495bb", "comment": "Malware payload (Mirai)", "value": "2fe30d4421eb3c6e191515353e13b641", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697954641, "uuid": "484b3cbe-38d8-4d39-b850-de6da23234c2", "comment": "Malware payload (Mirai)", "value": "65caae6ae07d0bca3fb5989af318f1e378cd6f1e23495186a2383c13d9c25e81", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697954641, "uuid": "f96aaf6e-3f7c-4de5-826c-04e120e49070", "comment": "Malware payload (Mirai)", "value": "b07533feab0ddee900156b88a77747a83b2efc13", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697954641, "uuid": "cfae0a0a-75e8-4698-92d4-07217e10874e", "comment": "Malware payload (Mirai)", "value": "f4a4ef4e1860c034b39db71b304edb09b65fc90e24faad219820e8641f153309d039f62341546184b23c55a5ed52154c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697954641, "uuid": "731b66e1-11ba-4ad8-beaf-b834dd152472", "value": "T19FC2D044F041CA05DEFA28F12E50CADBBFE06F5F6A628E4166A053D26F4C2A74305ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697954641, "uuid": "a77185f5-f8b2-4cf5-813d-1434d983f8d0", "value": "768:CVdafO76jpmNJJKehmA7trpfIX9KeA7PkKxW4uVcqgw09I:mam+AnKehPRa9a8V4u+qgw09I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697954641, "uuid": "a2e97e1f-086b-407d-8e3b-83ea78327417", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697954641, "uuid": "1db2d03f-7e16-4dc8-8e0b-9728ac3e94b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697954641, "uuid": "a5f1faf9-b552-467a-9e8c-e123b0c94762", "value": "2fe30d4421eb3c6e191515353e13b641", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c77d201a-70a0-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697954633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697954633, "uuid": "00792d04-d4dd-413f-a7ee-4f23d459fa7f", "comment": "Malware payload (Mirai)", "value": "8a67f5aa42c31b7ca4eb56aca74bda90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697954633, "uuid": "2683a377-7e4b-4e1b-9982-2170ccdd07c8", "comment": "Malware payload (Mirai)", "value": "684ca32676b274cc4f13449cad37dbb1801190163aba801200c482cc1696fdaa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697954633, "uuid": "edddc243-87a4-45a2-be0a-364c9b220a19", "comment": "Malware payload (Mirai)", "value": "459e749d00eb49be489412ccc1755087ec13bde0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697954633, "uuid": "70befb31-16be-4614-a9c3-04144a837081", "comment": "Malware payload (Mirai)", "value": "9ea26a3712013391a8044913e1c5cacb84f9b018271b2d1f21f810d3f7e35251747c2be724e8248f97ddf7417c63941b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697954633, "uuid": "54238e1d-2146-4e39-a42c-13ee4f7f5322", "value": "T19AB2D0A4C7A16607C1B0B475967C8F926B3B55E4C6F23526371092BCD68289632FCACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697954633, "uuid": "287b8970-c339-4b2d-a9d7-41295bd559c6", "value": "384:4GaKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BmY99iohymdGUop5hu7j:4GaKQFH0rs3zWoDDRsjt7LB9U+B9Iosm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697954633, "uuid": "4b3d6721-c43d-48d4-8040-677df741855f", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697954633, "uuid": "e7957429-ab35-4365-902b-1cd8ffcbd97a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697954633, "uuid": "160d2794-54c6-4bb3-a753-bdfbdddb65e4", "value": "8a67f5aa42c31b7ca4eb56aca74bda90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007306ea-710b-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698000256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698000256, "uuid": "1a9a0a46-3b01-46fb-9916-2032576faa38", "comment": "Malware payload (Formbook)", "value": "6ebb994d00938e37d43b4cb66fd5356d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698000256, "uuid": "41f96a82-8d9c-44f3-aa1a-f4dfcd2f7669", "comment": "Malware payload (Formbook)", "value": "69585ae659cf7e13dd4c48f8d3109c5e219cb37f266a3aed6d0e0aac051e89b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698000256, "uuid": "7776ec4e-c030-4a10-8804-d729b0d549f8", "comment": "Malware payload (Formbook)", "value": "48a7117f5ed601381d744f949b66529e52251343", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698000256, "uuid": "c2568a0b-dd08-4bbb-bf75-207b20281a2c", "comment": "Malware payload (Formbook)", "value": "1450e025adbbcff4d0c7efa39871a784da35263b091f89441c29e93f00e24fbfd665e87aac9b991ab3e2b23ab8a8bc31", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698000256, "uuid": "1bf1902c-178d-46a2-ab1d-679f64e2d7e8", "value": "T103A4234177A1C837D4A542701E36FA4D8EF56C1B33A5B34B93A47E0B3D62A4796AF302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698000256, "uuid": "042fad87-c21e-43e8-ae35-2e60f8c18e84", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698000256, "uuid": "a167fd5b-8d4c-4225-9676-824204c9d67e", "value": "12288:KfLRrNGaW112bN1wW5I1UrqNnEKiIYZ6U0RsRJVlBMlh:KfL5NGa01WN5gEf6Wpoh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698000256, "uuid": "6b55ff0f-467e-40bd-8d3f-42677fcbf02a", "value": 467465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698000256, "uuid": "0f1a57aa-bc6f-4208-80ee-f46711707da4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698000256, "uuid": "4eb08764-c330-4975-9677-b0a8e44bc975", "value": "6ebb994d00938e37d43b4cb66fd5356d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db6408c0-70aa-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697958962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958962, "uuid": "274aaa80-4f4d-4f12-b280-9733831dc7b3", "comment": "Malware payload (AgentTesla)", "value": "1d9a34e2795fb7cc079acf3d6b5e5fda", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958962, "uuid": "b8816e4c-36c1-499c-841f-f0944f6e3ddf", "comment": "Malware payload (AgentTesla)", "value": "6af896efdf2c6070a453c6226930104816ef6bbb0a9a97580bb185907362547a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958962, "uuid": "bcfca53a-734e-4f70-930a-3c26af7b1009", "comment": "Malware payload (AgentTesla)", "value": "299a4b00b138eff02915acb33e9ad61ec4365824", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958962, "uuid": "d3f03f34-9ec8-4520-8fdf-d29a3ae07342", "comment": "Malware payload (AgentTesla)", "value": "85ab266d8fc623e7dffcaaac865691224fc111e5dc7eb67a7f7b7e4f9e447b62641679a3115be5dbe9f8c4561701446b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958962, "uuid": "6c8ce12a-a1a5-4578-a6aa-98c0fcf81731", "value": "T1C2E4120172D84967CBBA0F788D622102A6F5BD353D22D6CBCEC821CA159FF354625BE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958962, "uuid": "46f9c5c1-5825-4c34-b0e7-efb84314d4e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958962, "uuid": "e5e21b6f-599c-4370-be47-434a240ebb63", "value": "12288:luw7s9qwoFolrsLVGwscATt8sTOesOcuuYvhTmkclSc/p0UTq7H/:luw7s9qB8r8Ew4T9MuuYJakaSG3Tqr/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697958962, "uuid": "4812e275-9931-4f69-9f1a-058c422d5837", "value": 706048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697958962, "uuid": "f82ae19c-c77e-47b1-9038-97fcd93a4165", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958962, "uuid": "08e33f61-e3d5-40c6-a2ab-06b6d5e6779c", "value": "Bank Slip & Payment Voucher.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7466e98-7083-11ee-8907-42010a9c0042", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1697942124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697942124, "uuid": "51761c45-b229-40f9-8ca7-41073c586db4", "comment": "Malware payload (Gh0stRAT)", "value": "399b8daa68b385ed90eb917cc032c645", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697942124, "uuid": "77dbf23f-b7b6-4b3e-aa6d-73d6269ee0ab", "comment": "Malware payload (Gh0stRAT)", "value": "6b379fd7445d99d790b00fa433d6a71830fb60fadc524e7ce7b9b2bf8040428b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697942124, "uuid": "2bc838e3-a697-4737-8dd4-e5763810e152", "comment": "Malware payload (Gh0stRAT)", "value": "f25331eed0c47c04778d12b34016883d1e48683c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697942124, "uuid": "68f0483c-e049-47ff-991f-58574d4490f5", "comment": "Malware payload (Gh0stRAT)", "value": "ac1b9495dac6d622d352c1f51797a71ed4f3c9e442b1f59c6046fa1f01c1930922fb8f5cc1422df144ce69c31406733d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697942124, "uuid": "252aa697-3cae-4c39-a16e-76ca8670b4a0", "value": "T1E8C57D72B266C0B6C1D51E300966BB37A6375E093A11CAC7D3D8FD2A6D713917E3321A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697942124, "uuid": "f95b6c4e-d631-4886-b803-6de9f7b958d4", "value": "bb9d495821e6e730a7a07045d899c977", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697942124, "uuid": "e32ce500-5efe-4220-853f-3fcada6ae249", "value": "49152:8X4uXjo0ZxGjG83V1T8Zn1AZeDvqKFoxtyNa7:k4uTo0Zxc32r+xtma7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697942124, "uuid": "57d0d303-2185-44c7-95d5-b352646e18ab", "value": 2526282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697942124, "uuid": "35e24443-77b1-46c3-a087-789efba4d6a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697942124, "uuid": "8d795dcc-b333-41ad-af88-400178e84526", "value": "399B8DAA68B385ED90EB917CC032C645.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c30f50d-7113-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698003926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698003926, "uuid": "cc889372-8880-4a0c-a9ef-2fa19e90853c", "comment": "Malware payload (RedLineStealer)", "value": "e9c21e9e122f65d706f13bc5250332eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698003926, "uuid": "9666e46f-5ca6-4ce1-bf48-ce4cb763a375", "comment": "Malware payload (RedLineStealer)", "value": "6bb828d4ff1635fbb147f9a4accb3a083212ce9c730aec321a4038f0468d73ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698003926, "uuid": "d93846d9-8b47-451b-9bbc-5e73fe4309ad", "comment": "Malware payload (RedLineStealer)", "value": "93f75af74b85b3c8ac5072d709e02ef615b4e5de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698003926, "uuid": "e1392cd0-4827-436a-a1df-1b4fcfc0dab3", "comment": "Malware payload (RedLineStealer)", "value": "6e6f2390ac1c3afb8951aedc6f3d8b742f46c4f06bcf4447db612b8de1d48aff20433ef6c9e52514cd3b10e599e70744", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698003926, "uuid": "13a0eebd-49c8-4b19-905b-0f209dcfc499", "value": "T1638523C666D64433DE385BB045FD03D3073A7DA49834878626C6A44B4EE32C8E9B9B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698003926, "uuid": "e4a580ec-5ccd-436e-b22d-c8c0e7db127a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698003926, "uuid": "d0828a62-82d5-4ecf-bce5-2e3e58d3a424", "value": "49152:YLdTWsg3HLIz3faQBHc6880Kn9vXl7eP:udTAGaiwwn9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698003926, "uuid": "ccd046dc-94a7-450b-b93e-517f6f9bb1ba", "value": 1825280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698003926, "uuid": "6a0cafbe-2828-4e51-8801-2db5ab4419c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698003926, "uuid": "d74a91f4-ddfb-4073-8e9b-b3c0a8a3d44d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97a7824f-70fe-11ee-8907-42010a9c0042", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1697994926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697994926, "uuid": "6bc56fee-f356-436d-9091-32d35704f75a", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "41a7fe217d400d78ec38420cfb3875ee", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697994926, "uuid": "e4803d4d-2426-442a-afc3-5db0c231c6a7", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "6d82e3c5ac60406d1c6a513d7ba1080c77adb32ca3d6b2473e0b6ff76b4818bd", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697994926, "uuid": "c66648c5-d834-411d-acf8-0cf2a097e0c8", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "5cae6714e0cc19819e0c70459a3c25968ec554ff", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697994926, "uuid": "f7b7fa73-bf0e-4a2e-ac10-e88a8577b104", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "7b7cccf206584eebcf191c15ba5271a5b4a3198ff527fc310fcba886149c636764f9eef3245f073c0cc0c6e0bef8f4c3", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697994926, "uuid": "170bb69c-2914-4d8a-91d3-b2701e1a8627", "value": "T1A9852356A6D510B3D8B21330C5FF03D31731B8E15AA483AB2762FDAD1A739C8A47476B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697994926, "uuid": "b5b5ed19-b7ce-472c-a0c0-8ab7725d4158", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697994926, "uuid": "4d287e64-ae07-488b-9ceb-0dbc1e085e29", "value": "49152:K+0fsuP1/cLYWp/pS3A9YrkbhSsK2J//1:dHuq5/9Yr4hSBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697994926, "uuid": "406ec048-eb25-41e6-a080-87ecb37385ef", "value": 1839104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697994926, "uuid": "0b0ddaf5-6f09-4ff7-8679-4aa0388175b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697994926, "uuid": "43e48971-47b5-4248-9081-ba6cf6c6c36c", "value": "41a7fe217d400d78ec38420cfb3875ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1bff42d-70f9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697992795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992795, "uuid": "4a6d6360-62a0-42ca-8c7b-0c4e89cdd0f7", "comment": "Malware payload", "value": "01b3d7a48cecc3785474309a26c5159e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992795, "uuid": "d1dc70ef-5c86-4be2-98e0-eca92dee0cd4", "comment": "Malware payload", "value": "6d850091bb6346bae710a6a108042581af08846227cdeb60e2bba84e9a87cc90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992795, "uuid": "31eb8c77-248c-4439-a888-d43c1ef3ab64", "comment": "Malware payload", "value": "9ab1b62cbc5dbc90c36bc15ba55cd3e03226b6b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992795, "uuid": "217b7d52-56f4-4d66-8ce8-66be36e637c7", "comment": "Malware payload", "value": "f5fc8d4bde6d3f56531031fdc017b9d46a73a52f2afa973e5ce00182d58e4124fff61e6efd6558666029503bc29db129", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992795, "uuid": "97a5ecd9-d3e8-4ba4-acb5-3badc30350b3", "value": "T147D1A437B7E00E3BDB5A4FB65F9602D0E67B98A20359C11357C5A8D4E9B3870CE51325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992795, "uuid": "d4babf04-58ad-4a42-9f35-f44009c8deb7", "value": "188377d57cba9a2758b975ed26e9137f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992795, "uuid": "412b5821-a382-47bb-a547-af38684510a8", "value": "192:0GjTLcJu3DVxB/PQQjH7UIEx9lB3yPJkeeYs:0GjTLcJWXB/PQQjbUIEx9lB/XYs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697992795, "uuid": "56a431ba-1a5f-4d56-a5f9-00fa23c8c0fe", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697992795, "uuid": "20cad8c3-8272-41b0-9a24-1844b10ffa72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992795, "uuid": "166f87ab-c9c0-4838-8b7a-0a353e80dde7", "value": "SecuriteInfo.com.HEUR.Trojan.Win32.Generic.13336.29504", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed66f8dd-70af-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1697961139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961139, "uuid": "10c5b9d6-b9ee-48b2-89a6-1a0231471432", "comment": "Malware payload (DBatLoader)", "value": "5e162cc8a91fb0a69af9c98e3c41c299", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961139, "uuid": "bcbf1088-99ac-496b-a22f-aa553004f583", "comment": "Malware payload (DBatLoader)", "value": "6e0f52baee68103cd2b5eb52ab2d1dfd4dfca5d5c413ab755014dc9be9524c70", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961139, "uuid": "31ae03ae-d24d-48eb-931d-b895a5f11274", "comment": "Malware payload (DBatLoader)", "value": "b158d239599102e2195a582acdfc99cb25b40f96", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961139, "uuid": "737b5f08-e012-4cba-ba3f-1a1a4e58d8bf", "comment": "Malware payload (DBatLoader)", "value": "3f134cd1ad02ed815297ef14f6808988b0d3c8e55ee79a393fde2f1e00862c46f4f1527e6932c6731499c0c38771710b", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961139, "uuid": "5b37b9f5-2431-4a73-ad00-b0ca58cde9de", "value": "T15295F122B2B28437D6335734DDAB92A5893B7F203E28989677F81D4C6FB529434271C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961139, "uuid": "e22d067a-cfdc-4123-9d1f-5f33771870f5", "value": "4569aa626af1b80196dcb0b68adcc830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961139, "uuid": "5c9daa0c-6307-49b7-8e2c-b0f1ea0f2cdf", "value": "24576:3Te9LrsMoZkD/VOP/6juQp6DjasufyJIZlnLxGgVzwmDi1ETNay76nBWWnmQqKoU:3Te9NLVfn513Vzrun5xND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697961139, "uuid": "7b1e47ee-9f6e-4726-977b-ab9c4a00649c", "value": 2038784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697961139, "uuid": "83e17400-0284-4d45-ae52-07d79f4d63fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961139, "uuid": "7be94f7c-0c78-47e6-a9a1-86af36f34edd", "value": "PO-GMV_501710023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da52d0d1-709e-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697953806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697953806, "uuid": "5f34a122-fb58-40bb-a3fd-88c184cc1aae", "comment": "Malware payload (Mirai)", "value": "1d5728bd849f0c8d5d7990e4bf906c43", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697953806, "uuid": "bdb0958c-e131-44dd-bfb9-359bcd1f3bc1", "comment": "Malware payload (Mirai)", "value": "6f4d2de086c35ef3b601ab71d47c85b292663a8bceb72175474e7ccf8ab1effd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697953806, "uuid": "0ae32f70-235a-4266-a4ff-cc3060e8c797", "comment": "Malware payload (Mirai)", "value": "04c0fa5d387c07e054cbdcd0e51afe192fbc552f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697953806, "uuid": "53564feb-3a47-42cc-a4b1-43c21bf331c8", "comment": "Malware payload (Mirai)", "value": "5bac8bf276f8434f78e4d94bce737113d2f526333029e5cd0fd85b2015973f7075721ec95f8b771e66371a73dcb6d01b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697953806, "uuid": "f86b7fce-1a58-47a7-bad9-de813449e766", "value": "T102A2E019BF1C868BC836797555D9EAD21293FC61F29CDC0D2940D16FF0A33A95434F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697953806, "uuid": "490bf085-32bc-4199-9526-bcae3e80ce77", "value": "384:MgWLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTG:O98o08kxofBE+ZkXaITbp2F2TWul0c5a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697953806, "uuid": "4e5166de-24cc-44f5-a2ce-4d10804bc005", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697953806, "uuid": "902f6b20-61e8-4187-a9a6-0a7e9fc5d1d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697953806, "uuid": "fda59a80-db7f-421d-99ba-aea743dcc15d", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b78c8b73-70f2-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697989825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697989825, "uuid": "2bef8ada-8f0a-45cc-ad46-18e380abad7b", "comment": "Malware payload (LummaStealer)", "value": "b55be0195f50844ec6345f01489c9702", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697989825, "uuid": "f2c158d1-90e5-42f7-9f90-7ca04fbbcdee", "comment": "Malware payload (LummaStealer)", "value": "700b8d027fd50dff8961c7d6c57006f9d2b8c413d880a333bdc8d166b569bf20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697989825, "uuid": "997a56d9-48da-4ad8-8008-607d831dd92b", "comment": "Malware payload (LummaStealer)", "value": "d84d082c68bab51676eb6d7ace99299cbc554a2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697989825, "uuid": "a3a7ef9a-9cc9-4275-a6e8-0083ad64e6aa", "comment": "Malware payload (LummaStealer)", "value": "f07652ef92a9cea9c5aa619f85877cb30965b853a3fcf4986b97e038014597593e5997bf70f8d96c67d70185d3f90be9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697989825, "uuid": "66a1aaa8-af4a-448d-8828-893c402315ae", "value": "T14504BE15B4C0C872ED631D3235FCEBB18A7EE8300F506A9F27545BB56E202D1A63996B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697989825, "uuid": "a7b2a90c-9621-4155-8507-aa5dc5722bdc", "value": "e918dcf0d250c75ae82a52aae1d3b862", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697989825, "uuid": "b6897b7a-5fe0-403b-8c80-22a288b43449", "value": "3072:0DQqpXQ+Z1e+nLVhFt7WxBd1w9+tuwyH8KSI+fzO+WwVUL9Vrytbt/fW6:0jNZrUxBda9xwyHlCMv+t/fW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697989825, "uuid": "5e58578a-927d-49e8-ab48-becd3fbe7049", "value": 182272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697989825, "uuid": "861ad969-73bd-46e9-9cf7-dbecd52ee83d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697989825, "uuid": "8f724aae-0c7f-45cc-b62f-c68e0aeb819f", "value": "b55be0195f50844ec6345f01489c9702.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8647eeb5-712a-11ee-8907-42010a9c0042", "comment": "Malware payload (Healer)", "timestamp": 1698013795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698013795, "uuid": "621e978b-1f54-4de8-8675-cfed1a2759eb", "comment": "Malware payload (Healer)", "value": "9d179e0faf2f9debfd1a78b6df5e7589", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698013795, "uuid": "cfc1fd07-9758-4fdd-be79-a656cc755354", "comment": "Malware payload (Healer)", "value": "71c7c19982a6027ec52f68e4a800eaf31da738fead63e165dab1e39f0fa6196f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698013795, "uuid": "b41905cd-9f24-4477-9c55-97656e01c4a5", "comment": "Malware payload (Healer)", "value": "5602bf575f6d3131906fdab1809a9924ffb3ac3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698013795, "uuid": "f1301607-b456-4ede-b781-0580a2b99338", "comment": "Malware payload (Healer)", "value": "5edbae4ac2a4a76dc91be2e1e0b80eff49a8fd32fb198727197d71cc802d6160d6b7a34044902a5578d2047b2eed618a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Healer", "colour": "#A586FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698013795, "uuid": "16a1d8d9-81e5-4798-bd31-b7fa6480f5bb", "value": "T1738523C2B7E58436DA619B702DF343D30634BEF05478874B2AD8ED458DA2248B674B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698013795, "uuid": "e6fc0f02-7d10-41b3-ae18-8189ef1e71b9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698013795, "uuid": "ae64209a-f3da-41c7-8a5d-15098911436d", "value": "24576:cylBkN879xpBf/iqVSjM0NErHH+Obnz7qytAjxkZ84DhwQqvBcP+V25y8wU4w5Ml:LAyyoBre8Kne84DhMB0j5y8jFKx17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698013795, "uuid": "5e1ea832-7a10-4214-9624-9ccc6b127a2f", "value": 1827840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698013795, "uuid": "69e2c471-fe1d-44c6-9c30-a5437a6d98e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698013795, "uuid": "c55873db-daeb-4f09-a51c-a984b5dc7cf1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e01695b0-70e6-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697984739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697984739, "uuid": "d1f0ee82-a398-42cc-80d6-a8f933394847", "comment": "Malware payload (LummaStealer)", "value": "154fe21fd0fe2f46b25a9981f7403093", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697984739, "uuid": "b0e4122b-57f4-4b78-9b80-3edf39e44ee4", "comment": "Malware payload (LummaStealer)", "value": "7286694ea52e2befd331bd81fde184fc78ed7e88843830099be0d2da96a5e0d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697984739, "uuid": "412161f5-a022-4f24-b54a-fb68e62daf07", "comment": "Malware payload (LummaStealer)", "value": "b67860a54e566c67f743d60c597f99908caa3253", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697984739, "uuid": "01c00112-b8e0-49b4-950a-c5a83c57e36e", "comment": "Malware payload (LummaStealer)", "value": "d2d62bf68c57874d2555bd10d15dce11b47705d85373b4acd12c69630f0cf5aa93d7e449eac6b894710e4b046f0109a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697984739, "uuid": "e2973034-3ebe-4566-806a-d6027148dd9e", "value": "T1FF158D2178C49172EEF320B747ECBA3682ADE0B0071915DF06D857EED7606C27B36696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697984739, "uuid": "289341fe-89b1-4b83-8947-580c1603b1d5", "value": "09b5d280d2d122a8b769c1e2cd1b4ca6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697984739, "uuid": "fc4181bc-7b63-406c-8ef3-8752f77e9f66", "value": "12288:YbZB0GmGSgmNwejJKXQ/7N/rojK9XYWlv77Uviik75FZFSsuvSED/aS:yVmNwejJKXQ/7FrOMLlvEala", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697984739, "uuid": "4d35a21d-3b37-45a5-9ad4-402829c1ce4f", "value": 934400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697984739, "uuid": "4c796b99-39d2-460e-9b81-b6e14d119a9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697984739, "uuid": "2113758a-0372-4eaf-83e1-02bcf897ea87", "value": "154fe21fd0fe2f46b25a9981f7403093.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f50a57-70cf-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697974824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697974824, "uuid": "87c5b8d7-d83f-4a40-944e-20805439ce0b", "comment": "Malware payload (LummaStealer)", "value": "b05a3022d3ada63f5061ddabc5c1237f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697974824, "uuid": "b54de395-ce7d-4c44-997c-da783bde454a", "comment": "Malware payload (LummaStealer)", "value": "72e0bab7ba94a014cb27ecb80d5b51befb973f06ea457f125dba4e929700005a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697974824, "uuid": "24d00e1c-2124-4361-891d-420d8f83b178", "comment": "Malware payload (LummaStealer)", "value": "492ede8ca05cd918c32e24ec45f72efa84c946e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697974824, "uuid": "e15481d7-84f5-4c22-931c-520cf9590f31", "comment": "Malware payload (LummaStealer)", "value": "84949c2cb610e21e9b77d2779e353d2a5e09cd30ee0c4d4184f21249bb46e1c83e413ca34a9b605124163876d4c45729", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697974824, "uuid": "79b78677-3fb9-49cd-8cca-38ab20c2f91d", "value": "T19604AE15B4C0C8B2DF76293205B0EBB14A7EF83C0F546ABF67585B751E202C1D63A96B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697974824, "uuid": "3d4634a3-a3cd-48db-8598-38f800811a63", "value": "e918dcf0d250c75ae82a52aae1d3b862", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697974824, "uuid": "00d0a67d-da44-4db5-a728-c832d140c3df", "value": "3072:yDQEnQ+Z1e+nLVhFt7WxBd1w9+tuwyH8KSI+fzO+Ww/ULihyjY/V/BHoUhfW6:yFZrUxBda9xwyHlC+G/V/BHoUhfW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697974824, "uuid": "caf1cc8c-4531-437f-9bd1-aedf870e1095", "value": 182272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697974824, "uuid": "9e500357-dc78-4430-a050-332d447d3e0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697974824, "uuid": "fb21909c-5e6f-4db1-82bb-10c54e2c8f30", "value": "b05a3022d3ada63f5061ddabc5c1237f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d811a1f-711b-11ee-8907-42010a9c0042", "comment": "Malware payload (RecordBreaker)", "timestamp": 1698007230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698007230, "uuid": "4f4aa00f-bee4-49c3-90fb-14e3ba2097fc", "comment": "Malware payload (RecordBreaker)", "value": "16efcd928f1d86f63c9067cb82ddde3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698007230, "uuid": "f9cf6d8c-5954-42bd-9597-475479cf7924", "comment": "Malware payload (RecordBreaker)", "value": "73b919c5b9e7468686891d7b9bfeae940db8b81c4f11692d939f7402f69ba1e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698007230, "uuid": "0a859568-7729-4bb0-9200-33453fd52aea", "comment": "Malware payload (RecordBreaker)", "value": "025571ddba9ea092c5da4c9a211e9f013d71972d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698007230, "uuid": "4e958ba9-a9f9-4919-8af2-2ad16d996086", "comment": "Malware payload (RecordBreaker)", "value": "b214ebbd5935106d737208bb08f712b70315a37c51e1f7425de879568a458efb72d8b93d5787a4bd48706e72e035ca26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698007230, "uuid": "86323516-5932-41ba-95e2-d680002cbcf8", "value": "T165A3E5E342789302EB84287326D3EE737A59DC3E1D25BEE39E51C65381ED45009DA6E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698007230, "uuid": "89a2e599-fc5b-44d4-8770-4c0d73b226be", "value": "0fcb7632c48018563e5af2f63681ece5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698007230, "uuid": "488d0696-807d-4432-ab55-8626d785b434", "value": "3072:bANfQKMuflyKX9FBFya6mob2lu5L6RJ//5OX:80O9FBn6pb+XRJ/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698007230, "uuid": "389b9c18-20d1-4f95-9cf9-20bc6adf5276", "value": 104960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698007230, "uuid": "95192266-4d6d-49c4-b740-e7d707470db9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698007230, "uuid": "10006601-15c2-41d9-8988-143ef8d5939a", "value": "16EFCD928F1D86F63C9067CB82DDDE3C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d79ccb64-70ad-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697960244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960244, "uuid": "5ceb03d8-4fa5-4ced-87bc-84d9651ab0eb", "comment": "Malware payload (Formbook)", "value": "c93182a4cf39e6a36f143371cd3cdac1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960244, "uuid": "5828ca1d-4fba-470d-9048-8150bf512262", "comment": "Malware payload (Formbook)", "value": "760d1dd7bb42f4e5326377a4d8368703b5638f6a14988e1a8ead94524b3a0139", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960244, "uuid": "d0044a41-55c0-490f-baf2-1112ab5646f1", "comment": "Malware payload (Formbook)", "value": "9388f926f519112cad9bc5d58cb132a50acaf3ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960244, "uuid": "a82c5dbb-7854-4709-8a76-d7b1ec838164", "comment": "Malware payload (Formbook)", "value": "47cf130f37a7d2e47d823303a2ff2664338b135ffe68147d1ffbcf6ab0d263f8fd17d1637cd78423d88a0eb5f915e1ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960244, "uuid": "2b59d59c-32a5-42a1-9f69-2b425d566762", "value": "T154D41204722E4A1BC93997F74D35CED90B360D632862EB8D2EA5329F58FBF485211B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960244, "uuid": "810bf3c4-8c2b-4431-9485-1696591922f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960244, "uuid": "7dc4b06c-2d15-4315-9c5e-92abcb118f79", "value": "12288:L8zS55mFzaz4QP5y8YToG7a77FI0LcD8VrdYdQnoc2Z6uj0:Lf55qG4+5y8COm0LYW5YdQnWZ6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697960244, "uuid": "27ceb6db-3629-4ca8-be78-11f0bc738d91", "value": 603136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697960244, "uuid": "b047dc3e-1a12-4b8a-94be-2851ade38c23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960244, "uuid": "4754e508-4c81-40a7-b674-994eab7dfee7", "value": "Audit Confirmation_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9c5b0ec-709e-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697953805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697953805, "uuid": "8aa33fc4-f857-44b3-8c36-ac16c334d8ae", "comment": "Malware payload (Mirai)", "value": "eb4a0aacc31058e95357e38994ccce19", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697953805, "uuid": "5c1cca32-b019-43e3-a283-dd25ddc8af6c", "comment": "Malware payload (Mirai)", "value": "76755d0148d09fbf842298533cad5448364776a38b9b8fe47741dd030f0236a3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697953805, "uuid": "d8a7c314-69de-4ee1-ae4b-0d9389a8c507", "comment": "Malware payload (Mirai)", "value": "2b5a8ee97506edbfd254b964df67282874ae0951", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697953805, "uuid": "ce7ca5a7-b860-4ff5-9d2d-0a75ef11cee7", "comment": "Malware payload (Mirai)", "value": "aff47dde7d9f4a5d1e582a59149c12fbfe8b1aa6b69da06ff59b7ac38459ba1210760a4d92b0a9c5aefb465eaa9c76e9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697953805, "uuid": "4238023c-8c84-49f3-9e9b-317d25763d49", "value": "T186C2F0AF76996A67FA5C133DE435C11B0394F12CA7ED6B8757404032EA4E42D7932CC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697953805, "uuid": "d1f6a2c8-7a99-4277-bb34-553463aefd25", "value": "384:Mg1DMwk8JPyGnT8WyopNEutTneSe3oECHjYlQ2NnE4+0o8tm3HWBKENAZHTJPu9n:RMwxdyoEUnDz+Y8tqHWXm1Puowr0NM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697953805, "uuid": "a5b239eb-8044-4901-b60b-795614e22943", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697953805, "uuid": "d4624207-c957-436a-b3c6-b5138c841e49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697953805, "uuid": "dfbb3e79-3f16-483c-ba57-79a4955531e4", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b78994e2-70ab-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697959331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959331, "uuid": "b65af320-876a-4029-9c14-5bd191515725", "comment": "Malware payload (Formbook)", "value": "76578dfc588ec9fd06d38ec7e6ca27e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959331, "uuid": "d0703957-e64c-4a59-95b4-916d641869b8", "comment": "Malware payload (Formbook)", "value": "76b3eb6f0aa4eb682e066ecd41a558865b8c4289aaf8970955a1b40928495272", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959331, "uuid": "15078931-496e-4961-a896-db83ee6663ac", "comment": "Malware payload (Formbook)", "value": "047242ab726687321c19dcf0e91b3f6eef5de9e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959331, "uuid": "256c1d73-ea54-4dc5-9d27-9e52264386e2", "comment": "Malware payload (Formbook)", "value": "ed22752f8b64d2afa80019f2f226e8e2f719631660685837839da7a944727502488178ac2a3114c09de08e2f52c97b9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959331, "uuid": "92381bc8-644e-4f99-ba00-c5fe91dc0e0c", "value": "T1C2D413987394B2FFC4B3C6B584F07C54932169AB975BC242A82735AD994D24B8B01FF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959331, "uuid": "9e2acbef-3d6b-42bb-b128-85d2a0a7056f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959331, "uuid": "27a27ca3-0f3b-4f58-95c1-bfe40938981f", "value": "12288:oo/jojLrPvNxQCbL/bam3N7wxb4KveDY3uI+OJDuyTFyFsyMMZ86RW:VLor3zamd7Ib3L+cpTFyFSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697959331, "uuid": "84876a95-c190-4638-b3ba-00942f406684", "value": 638464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697959331, "uuid": "84d02225-cdca-4746-88fc-656882b1269a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959331, "uuid": "c99bfc47-2504-4e03-88e2-9c71063f90bd", "value": "SOA SETTLEMENT RECEIPT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5de8129e-70aa-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1697958751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958751, "uuid": "334d1a72-ec9f-4920-9afd-cb583e292c18", "comment": "Malware payload (SnakeKeylogger)", "value": "02282c7f2d2f5c2c225d059182cbb692", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958751, "uuid": "b24d5dba-865b-47eb-b5d4-44be3f240ce9", "comment": "Malware payload (SnakeKeylogger)", "value": "76f5c8b814b6bb08ab2763e5480a8c09f6a4aa6b1f023ba971fa21d0d737ca83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958751, "uuid": "69dff901-1bdd-4dad-80a2-678a6d9d0f85", "comment": "Malware payload (SnakeKeylogger)", "value": "e19f4018254e68c2ba9c746bf71d8118f8d76030", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958751, "uuid": "cdd2cd8a-58da-44d0-8b3f-bd86e19d1ddd", "comment": "Malware payload (SnakeKeylogger)", "value": "3df39b7b92731c3c6f46e2f799e57a5a96b62ce74337b0e740373aa3077cc4f0365f643c90e068d40c07d59f4079574c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958751, "uuid": "baf89bfc-46bc-4579-8e8b-8622e9449b12", "value": "T189E4024132A88A23DFBA4FB49D575405B7F1AC291C61E28BCEC421CA15DEF358631BDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958751, "uuid": "1d4526d8-56dd-44f3-9eab-598d913836f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958751, "uuid": "67d94a06-0b08-419f-bf5e-c0f0facdb850", "value": "12288:umb7s9GwLSP+78G/L7uHQ4Lm74BwnynMAv3FdQFFdGfkQEDN0ljyEjygqBn:umb7s9GWSP+9HLnyjQVIOp4jQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697958751, "uuid": "9a3240a5-a049-4ee7-a3cd-54198fd4e790", "value": 702976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697958751, "uuid": "b8bbf8d0-5716-4f4e-84a4-390e5ac7ead1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958751, "uuid": "36f06100-1374-4472-8e63-3edf9d7b6ae9", "value": "PO_#8282 554.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f6475ab-70ae-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697960445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960445, "uuid": "360574d0-60ee-474c-b0d5-22b5c8b489b6", "comment": "Malware payload (AgentTesla)", "value": "5fc39a4cb57ecfd936cf1c26dd55fb5e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960445, "uuid": "d76dec2f-da46-42c6-9da2-d0774668d42a", "comment": "Malware payload (AgentTesla)", "value": "76f7e2ea6dc4dccb78c4d28107d8b9c83ca352a4bb977fd7ed17341a7ca126ca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960445, "uuid": "28c0498e-4198-46d3-98b2-71aaee02bb40", "comment": "Malware payload (AgentTesla)", "value": "4aa3bb7fb374d1ccd199cdc2de4d187c5f1b21ba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960445, "uuid": "5e158726-3483-485f-b705-08c7c0c808c1", "comment": "Malware payload (AgentTesla)", "value": "b66a26e1697f7d84cbcbde627cc156542d77cc7a2a19ceca401493d840917c44ba788527d2c6afeebee3d156f9aa629d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960445, "uuid": "09e16203-da6e-4819-95fd-59f3448bf2ee", "value": "T1F5E4120933F40B28E9BA577D12B18B90A3BA257569B7FF1D9DAC48E93A73F440501B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960445, "uuid": "ef7d21d8-191d-4f17-afac-b71a24e81b4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960445, "uuid": "86e1b162-19ec-4678-b20c-d7f21475405a", "value": "12288:BGia1vjJGGna12VKrMHHKCCzSI7+MgF8Y20TR97Ft2+NsgLcx7jYFip1:Aia1LJ1na1fMnXsSI7gGyTzb2KsqcR02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697960445, "uuid": "8e516990-7628-4cb9-89ea-9213372525f8", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697960445, "uuid": "2f1a206a-a6fe-4ab9-9194-f4d8af586d4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960445, "uuid": "d17abc56-0ed6-41b6-b8ba-f9983595cf5f", "value": "Mt036790r6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21b11a14-70b1-11ee-8907-42010a9c0042", "comment": "Malware payload (Tofsee)", "timestamp": 1697961657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961657, "uuid": "7885ec1f-ea9e-423a-8df3-3d6f675503bb", "comment": "Malware payload (Tofsee)", "value": "db39b0491e4f55e650ac8c88ed26773a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961657, "uuid": "ccad8265-4546-4d21-9994-2bc8d48054ce", "comment": "Malware payload (Tofsee)", "value": "77703b9ceeaccea4f47d453b982be25bf3147f7a8ebfd6b79a4aa9f9ee23d585", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961657, "uuid": "8ce56229-bac4-450d-aecb-bd7950fe0f35", "comment": "Malware payload (Tofsee)", "value": "cf384a39d7722c12bd6fff97c0496f8ad286a633", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961657, "uuid": "c111f67a-3acb-4f50-a110-8f091cc4ed0b", "comment": "Malware payload (Tofsee)", "value": "74d2c17afa1748cc51e6b79797711dede8c338a1b2e6c82ef0586767adf4a8e681d9a4bad1866fa03ee9bb8637c00312", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961657, "uuid": "bacfab66-1369-47ac-a1a1-b7195ae03e08", "value": "T18644BF21BA90C836E46759311930DA662B37FCA2EA7441CB37A83E3D9D317D09A65F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961657, "uuid": "8362301d-7e6c-4aa5-9d41-1f3a456cce51", "value": "1a993c5a381c8e12968253c74a42dfae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961657, "uuid": "45e43c01-23c3-4909-a758-1a13a934401e", "value": "3072:HQ1BNQYJAtmEZ1hPaQarEP8gsAa8yb00amJJAX3iK9BmPEq:ueOAtNZ1hpV8gdq0ayxr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697961657, "uuid": "2485f3bc-d207-4bf9-897d-69ef2b414a9b", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697961657, "uuid": "ff059c0c-adf5-435a-a1c6-1345a79ff415", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961657, "uuid": "780c51e0-42a8-41b6-85de-42f435b977dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd608ab-70ad-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697960251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960251, "uuid": "640e495f-b90c-4647-8992-f7f0c2063769", "comment": "Malware payload (AgentTesla)", "value": "55cf0d8793b4ddf1eef8b96dd2681874", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960251, "uuid": "9e8d82d8-db77-4840-9b53-32c876f5c4b3", "comment": "Malware payload (AgentTesla)", "value": "7a1b0984486f6d008efbcaf5aa80d34db07f1a2f70dab9246999f9d5dffb9599", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960251, "uuid": "2cbbbe36-536c-40f6-a260-67fe03962314", "comment": "Malware payload (AgentTesla)", "value": "1ea4e3a6da443596294e5d1b23b788eda1b1c903", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960251, "uuid": "faea8a9f-9dc9-4027-8063-12cced48ecdb", "comment": "Malware payload (AgentTesla)", "value": "4a5e73714ca3f6d5367d3fe1640ed8ecb0eed7362a69f34f39b5d3f333ea229f1fdf97dd7a0f783e442d26c40bd59801", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960251, "uuid": "47397030-4901-4fd2-b31b-a0805d494398", "value": "T176E41201322D8E07EA6907B21D355EE05B751FB66916F68D3DD23ADF0CB6F84822178B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960251, "uuid": "f6292248-1dff-4fbf-b364-709449ad909d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960251, "uuid": "853c7e91-0bca-479d-bac1-10129df5f81a", "value": "12288:s8zS55mFzZIMasDJ+/6TQyoTl7cePgdLsV61epgbVEM99IctK1thAS3OX8:sf55qFIMJJJ+7ceasYcpCVGc01thAFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697960251, "uuid": "17b0b409-af5a-420a-bafd-f83402c9b4a6", "value": 659456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697960251, "uuid": "ea4f7322-d57a-4ec8-a9b7-d8b39c6c0c7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960251, "uuid": "5b3aca45-b014-4242-869b-fd6e65394acc", "value": "Payment Advice Swift_copy.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9389b7af-710b-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698000502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698000502, "uuid": "3fb6b6b6-d6bd-4e85-ab1b-5cc6ea0d7fd7", "comment": "Malware payload (RedLineStealer)", "value": "ecddd46e6263f71c7ad5526e67a6e014", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698000502, "uuid": "e8e820c0-92cb-498f-9536-968b9c3f762d", "comment": "Malware payload (RedLineStealer)", "value": "7ab74f07884f3083ebf82cb7c516f9f8a9ffb5e4b6d8b160f1be4722764bf8d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698000502, "uuid": "7039dfc6-d9cb-4068-af70-644ced36fec3", "comment": "Malware payload (RedLineStealer)", "value": "5bcb143ae8aed98749c96f43eb82384a8d01cd1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698000502, "uuid": "9559e699-18d9-4077-993f-b22d561b2f34", "comment": "Malware payload (RedLineStealer)", "value": "fcd3df2648b402af841babc5d1c89616cdcf111eeabce5659d53c991a5c84487c0b5289b6dd4b4dc6749afa2d2e27691", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698000502, "uuid": "772f1817-7572-461d-b2f8-eb3d532b8652", "value": "T156B45A51B0094F2AE3F2087CEACA5DAE4D507EED6F530B8F36C14B8167967D1A93910B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698000502, "uuid": "d3d5e916-dd49-47d8-912b-22a1045be2f2", "value": "d350427820086a321ccf21b695161218", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698000502, "uuid": "d419eb6f-904e-4f5c-a2d1-5cbf08f6f562", "value": "12288:f808MwoQB2o97Hr62k3n/+pLsv9+eXUeF6e1L:QMwoQkAr62k3n/+pAv+enL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698000502, "uuid": "665af714-2c8a-4810-a7d7-4290a5b0d468", "value": 508488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698000502, "uuid": "3b3ca303-97bf-434d-82f3-18aee051f7e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698000502, "uuid": "e4049f9b-ef0d-40ea-949b-581d8396706d", "value": "SecuriteInfo.com.Trojan.PWS.RedLineNET.6.18283.16958", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb3e382d-70aa-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1697958988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958988, "uuid": "d3fdd704-82fc-4dab-b779-31b16b531968", "comment": "Malware payload (SnakeKeylogger)", "value": "b57e5d0ab0f7156d0fd9d48197034778", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958988, "uuid": "66bf1836-55af-44fa-8c3d-65c0df91fccd", "comment": "Malware payload (SnakeKeylogger)", "value": "7baa6024895e6f85c658b4173a1731009f2ea0166870b422550df8e123216584", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958988, "uuid": "589175fc-83c9-4964-969f-16d6e4170f34", "comment": "Malware payload (SnakeKeylogger)", "value": "31cc03fef54efc0f7853fcb26d7356a8ad1d75cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958988, "uuid": "644084b5-b106-478b-95f8-f6ea066d495e", "comment": "Malware payload (SnakeKeylogger)", "value": "f6d918a45cf01f0f6f39987160f69ef04fe1226b7a5c4ae2b5f1f35733a361091d4d2a4b3dc76e3a23565c42f96a247f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958988, "uuid": "e843f27d-939b-4cd5-9a65-dad6bc19d5eb", "value": "T18305B403BA4787F2E2481736D29B1D248368D983732BD60B7B8E336579A336BDC65507", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958988, "uuid": "9963595d-5d0e-4ba8-8b5b-badb2d1e224d", "value": "12288:60qvQ/lORsbmYNfG+AFYb/oPK5XVBsVANhNxjkvb4OyI/IMp3SnoV/F:60qI9DqKG+L5laVANhNx4v8Oyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697958988, "uuid": "699e837e-2390-49d9-9c16-49d152322ade", "value": 800768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697958988, "uuid": "f4b38233-ddd3-4559-bb3f-395ddea60ba5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958988, "uuid": "b523aaf9-3052-4c8e-a22f-7bb40560f097", "value": "Rdnrk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec8c9eb4-7104-11ee-8907-42010a9c0042", "comment": "Malware payload (KrakenKeylogger)", "timestamp": 1697997645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997645, "uuid": "88c86b26-9746-4b51-bbfb-a381c6556be9", "comment": "Malware payload (KrakenKeylogger)", "value": "8a1d7ddb598654230e512fcb726b23f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "KrakenKeylogger", "colour": "#0DA6A2", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997645, "uuid": "fe0d3b9a-7cba-465a-8652-e20c6400d4af", "comment": "Malware payload (KrakenKeylogger)", "value": "7c8bcb859a02fac81ed21586dae558efbf40cdcd993599aa8e07197a32e3155c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "KrakenKeylogger", "colour": "#0DA6A2", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997645, "uuid": "f1369a90-66aa-4cf8-bacb-1bd18f47528e", "comment": "Malware payload (KrakenKeylogger)", "value": "ee500308f465b0203d0017bc0bb7f0978cafd2f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "KrakenKeylogger", "colour": "#0DA6A2", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997645, "uuid": "fc01540a-59ff-412e-acca-2d9c6ee745e8", "comment": "Malware payload (KrakenKeylogger)", "value": "5cfda2db32f96ae34f0ad69a3ae237910032e8fb3e59194b8c9e4cb4b49d1f13e6a6813da7ccb7855a897115491347e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "KrakenKeylogger", "colour": "#0DA6A2", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997645, "uuid": "1309f1c2-2a6b-4760-9f13-4ac1b01946dd", "value": "T1B8D4AD13BEC79EA9C1F7C2BE2C849D744D6EBDDB5830962D718DB29E58306024C2D91E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997645, "uuid": "330a06cd-0022-493b-a6d8-52afa1148474", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997645, "uuid": "d7505203-5ad3-483b-933c-a047441a7f39", "value": "12288:42WJp09SLtxWLuRFRVCy6HspkP934jLrGA:42F9qjWyRFvvNcQHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697997645, "uuid": "b58bf5fa-105b-468b-bbea-979bce9f9163", "value": 624128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697997645, "uuid": "7524c545-9829-47d3-ad57-e8de0eb59c9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997645, "uuid": "b66053af-9111-4782-81c9-4d37eae07b2d", "value": "Sipari\u015f_28.08.023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "009087f3-70d6-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1697977492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977492, "uuid": "a356b304-7106-475b-816f-ecb8c3e4abd9", "comment": "Malware payload (Gafgyt)", "value": "6d7610a8d16e241dddad322a998eaf7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977492, "uuid": "636e3cc0-ce9d-45bd-9fec-4885d9b93033", "comment": "Malware payload (Gafgyt)", "value": "81563e4d649e5df488620f4d3a21f1706beaf969dee3933c891a7af89192ecc9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977492, "uuid": "43360414-87e0-4567-942a-ce9e54d988ae", "comment": "Malware payload (Gafgyt)", "value": "92ac934f8c459ea585c25578b84671fc56e30c6e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977492, "uuid": "3aa91d96-47c9-404f-a5c6-94b82f1f2fff", "comment": "Malware payload (Gafgyt)", "value": "d0cb56e5e6041726d8583aa158f9c41e8538f34e6fe3bf35efd2d9c4071d4b63aa006ab1e41c3c06c6780bcc160bd7a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697977492, "uuid": "97c52846-151a-469d-8a80-89266ff4c7cc", "value": "T190E3F834F9144B1BC2D223F6E79A429D3F351EA7939733115A387DB02FE27992E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697977492, "uuid": "c6dae753-320b-456e-9a5c-ecd60cc4ef09", "value": "3072:tbF8A84EVBFt8T69yY6/MX+jB8aPJQaQi3fEaSxNb:x8ZBF6GsYsMX+iaPJQaQi3fEaSxNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697977492, "uuid": "cd60c029-59f6-41bb-baa8-cfebeb2144ac", "value": 143143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697977492, "uuid": "bc11c358-27d9-458a-b3b5-a7f123763e0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697977492, "uuid": "41d065a6-3786-4e33-bf4e-569602b152d8", "value": "6d7610a8d16e241dddad322a998eaf7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e99ddb-70ab-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697959295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959295, "uuid": "6820f73e-14a5-4448-b948-424a9844ec59", "comment": "Malware payload (AgentTesla)", "value": "1c1e810ada41dcab04ea53296e2efbaa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959295, "uuid": "08eb4ac4-4dee-41ac-9ce4-38033cdd6a8e", "comment": "Malware payload (AgentTesla)", "value": "839c5e0881168d0f8be0db1ed1d9970d3f2d6b60213ba4e5736c0d98e74775ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959295, "uuid": "87160031-d797-4c32-a2f9-9e85fb35af16", "comment": "Malware payload (AgentTesla)", "value": "05a9bc3134db1f1d29bd6257bc6797f420f121b2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959295, "uuid": "318125fb-8d0a-489f-838d-65a3b69a0469", "comment": "Malware payload (AgentTesla)", "value": "6cccd9630b1b44e4b12b1d492039a11465051ca178c6f9046b476a90409f8b64b41b1cc80cabc736ad4f9bf49561e161", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959295, "uuid": "1bda5d1c-b2db-4733-a27e-80179fa764f3", "value": "T142D412657364B1BFC536C57587A02C20A360A9AB672FC217B89710DDCE4E5AB8F406F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959295, "uuid": "93a47d96-e8d5-4739-a8d9-c111c7aeb2e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959295, "uuid": "51b6cc46-56e7-4c96-a990-353931f2b053", "value": "12288:s/jBuL7xzozYTFkveizCfcV3MfPrpHiVhKoqDBl57vjsJ7ltF:sLcv2zYavelcl0DEOBvjsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697959295, "uuid": "f7281758-e8c9-443f-947a-f86ece192e44", "value": 638464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697959295, "uuid": "24bc5400-3728-4e7c-a01f-5faca8eba03c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959295, "uuid": "30dfeb30-3ada-4ad2-9f42-26529111ed7d", "value": "ONEYSPBB02925301.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1fe4e66-712c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698014754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698014754, "uuid": "dda54adc-d9d7-40be-8bb2-8ea6adb7469f", "comment": "Malware payload", "value": "439052da4b839d22baf5a3d412889fbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698014754, "uuid": "9200fe35-463d-4df4-add0-a80461abf1af", "comment": "Malware payload", "value": "843388f1a2c20bcaf031d0e6017df0f1d4c52892525a68772379fe65b6259002", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698014754, "uuid": "1aadf116-9549-4508-a10c-f14d9ef181f6", "comment": "Malware payload", "value": "daed4bc6888b4ffc9095173a59e075f875ed4dbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698014754, "uuid": "3211c439-93b3-4539-b591-36c2b902cdcc", "comment": "Malware payload", "value": "fc0cedf37d338b1547d58e8e3481d72ab9725267b3326dcadccfb3da69574d1cdab9a5d67e996ea572399c01b9a47e7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698014754, "uuid": "78c3bafd-0b60-4964-828b-ad49f921996b", "value": "T1A685234293E548B3EAB6633120FA03D70B357D728839D71637E1E81A5CB36DC6869B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698014754, "uuid": "b1f1db7f-1cf3-414e-a4fc-ef0ada7a3c33", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698014754, "uuid": "12f231e5-bdca-44f1-b3ad-0b4f95feab34", "value": "24576:+ywoSUhrZkWETJgWeptTiEZSmF877WFOFxVcsaUxZk5CaND2xUMb+IWhXHaO5nTm:NPSspEdgT71MmlQxq5EZ95UExOXTBz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698014754, "uuid": "2ba40d2b-3035-4291-a13a-479544c3510f", "value": 1826816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698014754, "uuid": "a6cd8ab2-e0ed-4c32-8998-24c3ee18cf18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698014754, "uuid": "1a0be1dd-b952-4deb-8fab-723176424271", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3d64b97-70b4-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697963190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697963190, "uuid": "2608cf3a-182d-4926-8425-d870b1938534", "comment": "Malware payload (RedLineStealer)", "value": "ceac37a2e5adc388941f60c927b8e84a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697963190, "uuid": "c20db469-d23c-4864-8c74-1f8c2337175b", "comment": "Malware payload (RedLineStealer)", "value": "84468bfdcb264e3eca47a0c5a803fbd5156a75166b40bba97e55c9282f42988e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697963190, "uuid": "f16a2a81-da8b-41b7-8033-b27dd2a76474", "comment": "Malware payload (RedLineStealer)", "value": "e545de7fadab4c718b37fa235b23e84ebc5119a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697963190, "uuid": "dd40e335-f171-497e-9365-f25d4162c765", "comment": "Malware payload (RedLineStealer)", "value": "345a066bd64194bbf55147a1252cf83cb06e0b0cf69503fe432c2868f295240109361f99d5926bfb35148ee99c8f0656", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697963190, "uuid": "313334ce-8199-42fa-9b20-ade82610add2", "value": "T144B46A51B0094F2AE3F2087CEACA5CAE4D507EED6F530B8F36C54B8167967D1A93910B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697963190, "uuid": "d66e6109-3627-4447-a4da-7afbf08a1988", "value": "d350427820086a321ccf21b695161218", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697963190, "uuid": "3a1d8945-dc50-4001-ab7c-0d3921a1ec86", "value": "12288:z8U8MJ4QB2o97Hr62k3n/+pLsv9+eXUeF6e1L:8MJ4QkAr62k3n/+pAv+enL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697963190, "uuid": "27c70513-799e-4dff-b09c-d2e922c626e4", "value": 508488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697963190, "uuid": "a026624c-503d-4d1d-8a11-76dd21c760ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697963190, "uuid": "589764ff-b4d8-4335-8950-98d3e3941237", "value": "ceac37a2e5adc388941f60c927b8e84a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "869ae460-70aa-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1697958820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958820, "uuid": "e76a428e-4654-4f2f-bce6-df36f1554103", "comment": "Malware payload (SnakeKeylogger)", "value": "a782796049ff3683e94312df0753955a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958820, "uuid": "4ce4b646-118b-4d58-99f7-7fc1b11bd380", "comment": "Malware payload (SnakeKeylogger)", "value": "84f66ad651ac88f1e8298c6e149ed749c967b854068de0848a7e49f5f257fc80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958820, "uuid": "79895866-224c-4f42-b9a4-13b23800d94d", "comment": "Malware payload (SnakeKeylogger)", "value": "626d410a5d07412dd1c86ac7698ab86e84dcf3a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958820, "uuid": "84a5b082-f9df-4d09-9730-ba13a3ea37fb", "comment": "Malware payload (SnakeKeylogger)", "value": "5afd93d5cab01ac03d0103c8c73b6679c79b5f6667c5b41081c66e179eb3a11d5a965d76f3034b56881f76726c9f8de3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958820, "uuid": "b2a36934-7357-4b1c-895e-822138d0d44c", "value": "T1DB05125133949F22D67803FC6E71104603B0AD2A6A35E24BECDA71CE099EB750957FEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958820, "uuid": "096aa9af-22d6-4514-a6b3-ab37ddd17847", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958820, "uuid": "decd64fd-02ba-4bdf-8526-6f697cae0c02", "value": "24576:pFLUsWBPV4L8myg8538Imw91NRiVWr4Ig:HLUsWB94L8myPqtC1NOWr4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697958820, "uuid": "de3d2479-b817-4225-935d-18995e7e9108", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697958820, "uuid": "34b5723f-1f54-4e78-a84d-f43a2717e96d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958820, "uuid": "761cd071-9ce5-4b6d-88b5-1efe33cb5932", "value": "PO_#8282 554.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0853a00a-7105-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1697997692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997692, "uuid": "c8b3dd4a-654f-49c8-be16-40c582d0f5fd", "comment": "Malware payload (DBatLoader)", "value": "505cf6ad878f1b15b3b7ffcb499d24da", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997692, "uuid": "8ec80579-6b93-4d7c-807a-b4509d319803", "comment": "Malware payload (DBatLoader)", "value": "856f022b0eec4d9db9d5f0eafab09ca82c12644d849984696eca9dd9259fb0b3", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997692, "uuid": "8bd69a62-688a-490f-a8f9-39a49b80a8a6", "comment": "Malware payload (DBatLoader)", "value": "16c63bf0400ff0ef7fdc352208222ae06cfd4b25", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997692, "uuid": "d17ce176-a410-4e3b-b6b0-47f51b328c68", "comment": "Malware payload (DBatLoader)", "value": "b23d522a699b5a8da1def354148151798c44f3c3fa845472ce966646c68966ec45a121a2f574d6ac719ffd8788fa63e4", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997692, "uuid": "3a0015aa-521a-4248-bf7c-aa2ca6da39dd", "value": "T168452A4A7BADDC60E0B127BD8F8D1BE2B82D79D136B5CC9122643D4B09112E57D980BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997692, "uuid": "c3e4eefb-0460-4237-9e24-31e754ddf7bd", "value": "d020f949ba89411d7c49f3baa1ad9952", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997692, "uuid": "6d72470a-615c-44d0-b40b-7212b385ec19", "value": "24576:E+x0KeaVl6fTAz/92jMRffknKdEf/17E+/:E+9zIx1I+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697997692, "uuid": "54d3452f-a200-4d5a-a4f3-d3831be22658", "value": 1178624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697997692, "uuid": "3af6ec9a-8772-4158-acab-33c9adaf7e44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997692, "uuid": "d061eb9e-6cfe-451e-9127-943dc3976827", "value": "order acknowledgement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e6271bd-70f9-11ee-8907-42010a9c0042", "comment": "Malware payload (NanoCore)", "timestamp": 1697992790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992790, "uuid": "9a1d169a-9371-4bf5-b8e5-abd77cf8aace", "comment": "Malware payload (NanoCore)", "value": "5577c8755bee3b80e17e42e80eadde86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992790, "uuid": "e6676567-785d-4b2f-a3b4-e5619f61137c", "comment": "Malware payload (NanoCore)", "value": "85ba99319f22cde0abd25e839a7a230a730f1d52e546754873e479be88e65da1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992790, "uuid": "73755dea-504d-44da-a499-22419dc2fc14", "comment": "Malware payload (NanoCore)", "value": "79ebbc3f9d175669ee090f53b93a925b42281b73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992790, "uuid": "40418168-aa00-4014-beca-e625cd38815d", "comment": "Malware payload (NanoCore)", "value": "a0f30f949bce06a6c424f736375dc1c91e18281a1ebb8e65a9a755cf1fc15ff38bcbc5463960ec70f2f0cc84e197af68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992790, "uuid": "4ee5ce56-f714-44b2-a41c-6df398520ba3", "value": "T136163375DD3766E0FB68087A7728F2800B5911AF69D0CA278CE91DF5D19B32D8CD1BA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992790, "uuid": "a2fa5e4f-60b9-4b9d-b5db-72208d761d27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992790, "uuid": "c7e8268d-f41f-47ca-8183-7d4fc38a453b", "value": "98304:oPk7tEUpppPxYyTUsAoQ9/hZjipqYW+YHeFJeAuw8agFo2Gm:GdUfAaBE+OzYIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697992790, "uuid": "ccdace05-6f91-4a48-bb3c-90f893576918", "value": 4227072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697992790, "uuid": "96c016bf-0797-40b0-9de0-07c8d10c0feb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992790, "uuid": "d20fdca3-3280-4d69-8e99-d6b96d744a76", "value": "SecuriteInfo.com.Trojan.KillProc2.6649.17545.4126", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2bfaa76-70af-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1697961148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961148, "uuid": "fe6d804d-1144-4852-bef9-d00507b8b657", "comment": "Malware payload (DBatLoader)", "value": "3170d5ae1447ddc489e0e05c67c57b8e", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961148, "uuid": "369474a8-7faa-4a1c-b3db-e9014adfd6cd", "comment": "Malware payload (DBatLoader)", "value": "8665ae68b1463975d0b1927f02317538afbd08eeeab0907094fee1fe6bfd5e4f", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961148, "uuid": "b5518209-36f2-4a7e-a2e1-c0bcb0a42f5e", "comment": "Malware payload (DBatLoader)", "value": "849cd619b3399bcd79746219224392ad0aa6940b", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961148, "uuid": "b3538983-f013-42cc-ba23-20d6ab682240", "comment": "Malware payload (DBatLoader)", "value": "c80a6e76ba78e734b81f0d6854379076c5afc7d835021d982c8827d3cddd3396a36abd8dca7ef95d0cdaee99cbefbebb", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961148, "uuid": "b536f05a-e76a-408d-aea7-81e80cf2fbea", "value": "T16E25A062B6930636C03325365F3BD3F4482D7E243A25A85A6BF46C785F796853C3B293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961148, "uuid": "ae02697b-b053-41c2-9144-e5531069031d", "value": "003d3d12d28525a81de6bbbfc27b008c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961148, "uuid": "fa2672f5-a55e-49e9-b0e8-c87957b41147", "value": "24576:CKEvMifRT1Vkp6P11Vce8RQS7IKO05G4l5p4:XE0idkW1AUS0C5p4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697961148, "uuid": "7e812d0b-ea54-4afe-85a3-9c28462e531a", "value": 1043456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697961148, "uuid": "3066b704-4911-4e9d-a1ec-f3100d8ffa3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961148, "uuid": "844a5e8d-280c-48d7-a7e2-515f125769e5", "value": "3170d5ae1447ddc489e0e05c67c57b8e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0cc17ba-70ab-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697959293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959293, "uuid": "1d622b30-003a-4a56-99ce-a8692b2e5a75", "comment": "Malware payload (AgentTesla)", "value": "3b7cc860616fc7a2c84b353437e3a9b2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959293, "uuid": "ce83d42c-c4fb-47b5-9442-ad90c12cd792", "comment": "Malware payload (AgentTesla)", "value": "8694e70e25489684dd115cacc569dcec2d1aacf86d97c395b7475db75f7c711f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959293, "uuid": "17c7a3cb-fa4c-44a9-a799-427186b32535", "comment": "Malware payload (AgentTesla)", "value": "44eac439e38196ee27c65a5eee6ae1102fc5e1ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959293, "uuid": "a8246d8f-3338-4f93-808a-dd767252c140", "comment": "Malware payload (AgentTesla)", "value": "908407b1852fabbdc5f7a52fb14d87ecd905f7ee88f9948c4ebe96cfbb6d067e23a1ea604adae37f753ae412c243b47f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959293, "uuid": "78c929ca-1587-4dee-b87c-e768f096d6ea", "value": "T1D1E4E0AC3250B6EFC867C472CA942C64EA20357B571BC213A45326EDDA4D89BCF156F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959293, "uuid": "4f659982-887b-4e0b-993a-d41a7c9186e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959293, "uuid": "0fc4a724-7f29-4fa8-a216-ba11fe0bc839", "value": "12288:NIv/jiTYEXpnKlznSvWhrDMCvV1tkO1rLJnEUYd0gw7irt1Mwp:NOLgYenMnSCrDME1rLJEUYd0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697959293, "uuid": "b6c57557-72df-47bc-9f25-f5758f0e9ce4", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697959293, "uuid": "238bd939-432b-4e4c-9e65-99d1b639090e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959293, "uuid": "331994b2-3213-4c2e-8ca9-07c8da80351c", "value": "RFQ (MONDIAL FORKLIFT 0410023).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2616b620-70b1-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697961664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961664, "uuid": "adde5fd7-30a5-4a77-97a2-06ae686320f5", "comment": "Malware payload (AgentTesla)", "value": "a8c14d7641da454d81bd8d03e157778b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961664, "uuid": "1ee3e23e-52f2-4957-a25a-dc417d384392", "comment": "Malware payload (AgentTesla)", "value": "86f2001b53456ca09967483c59b6ff571e1c352a7779a529d9ccefbf10d9f596", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961664, "uuid": "90cb43f6-eccd-44cb-8e3a-5aec442b8b77", "comment": "Malware payload (AgentTesla)", "value": "fc51161061a1b8e422acb25efe04cb6333b9cc77", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961664, "uuid": "acb88620-4805-428c-8d6a-caca3f8c8079", "comment": "Malware payload (AgentTesla)", "value": "0afc00f870d7767706f09c8c5afaf749f88183e4fb224a69b89f803d76830de98fb5ca16dab09a2e2c0347c35e403d69", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961664, "uuid": "bc86fc54-422f-4be1-80de-7be3ba683a70", "value": "T11C156BD2D2568E99E87453FA8132DD7E52675E69A430962A41FDB873FEF32830C25C03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961664, "uuid": "1a32ed30-559a-4c6f-9a3c-e0505580b859", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961664, "uuid": "8de8bd04-99ed-40b4-a55d-9348ea0b9ac5", "value": "12288:OMb5yzvbYmBHgAMQiPNTAcrL2XWFNRB93mV6RSb9LISUhqY4Hydej:VebY0ZMBPNJbq6RQcSUhqY4HPj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697961664, "uuid": "01c9004f-bd64-4981-b328-97f53d22fe63", "value": 916480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697961664, "uuid": "b72d0234-4ed1-4744-b919-4aaeba106396", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961664, "uuid": "460ce05c-7072-430c-8277-773a5f1d40fc", "value": "a8c14d7641da454d81bd8d03e157778b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05e934f2-70d6-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1697977501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977501, "uuid": "5e27fcf6-185f-46ef-9730-9ff693d1226e", "comment": "Malware payload (Gafgyt)", "value": "74b50d11600b19394e09cab13af0fa5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977501, "uuid": "6cf664c1-4278-4fa3-8ac8-a5c73e646f17", "comment": "Malware payload (Gafgyt)", "value": "879c73516df6d169ed7d66ba8af916f8eadbf0b60a8e38385475325c577a778e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977501, "uuid": "7dc69d83-cec7-4302-b600-6bf20269ad13", "comment": "Malware payload (Gafgyt)", "value": "b2b1a2c04004650e357f185685339192baaaab0b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977501, "uuid": "c382bfcd-2409-4bcd-baa7-e9a97d30066f", "comment": "Malware payload (Gafgyt)", "value": "9dd01aca9b836e9019d1ada5bdcb9d543916e2101fe6655d1633031e677bf12bdfef2c9c43cc1cf5eece9393c93a6bff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697977501, "uuid": "08c8f881-8bf6-4c3e-8c19-616796dde92c", "value": "T14ED3F830F9144B1BC2D223F6E79A429E3F351E9797A733115A387DB02FE27992E25520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697977501, "uuid": "28658443-0bbd-42a9-a047-0ffbbb5c4395", "value": "3072:fbo828bDmt2Mg4nUniU/kKXPeToKJa74H7QWh4PaWnNb:G8+t27ie7/kKXmToKJa74H7QWh4PaWnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697977501, "uuid": "adfa3abf-7ad4-4f48-9619-262898a5c816", "value": 136749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697977501, "uuid": "25b62818-289f-450b-94b8-dc738a6aab34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697977501, "uuid": "e381e9e5-1e5b-4f91-9f08-edf2f3b0393b", "value": "74b50d11600b19394e09cab13af0fa5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bab25b3a-7105-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697997991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997991, "uuid": "18db4a46-a694-464f-9156-53eb145e27e4", "comment": "Malware payload", "value": "d6a42f3b198cf6b4d64f069824757525", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997991, "uuid": "195dd6cb-8e76-49d1-9e8f-acefde3d57b3", "comment": "Malware payload", "value": "87a65de8e1c60af99a6a50698e90f405601f25b678362965ce184d6f3615546a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997991, "uuid": "5cd2f4bb-c655-44b5-9b0d-f9861587852a", "comment": "Malware payload", "value": "03b9d43f5edc5016372bdd6f2c55f4596edb7a2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997991, "uuid": "d9581883-642f-4275-90ff-2891cddcfc80", "comment": "Malware payload", "value": "54d78e954bea08ea3dbd9234a02e1facda820f0797d304f80bc968f8a350d35292e479ee0a231fb25d0ce1437004a447", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997991, "uuid": "3009a57d-a582-4b8b-9cd4-767f95d55adb", "value": "T16B952351B9E1C8BFD68120792F6C3FF190FBD30686159BA353518A095ABC9D8C368E4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997991, "uuid": "793999b2-b70e-4b88-ac08-8fafc1c8123c", "value": "4ba3ea0d6362a841ec66a1fc0a1b874f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997991, "uuid": "e3bfb061-49be-44ac-b2f3-27a38592f4b2", "value": "49152:ufocj/lQRgvpu1OJN3dHTdbqlZ3Yd/IqRuOzj0z+4WK:/cjNQRgB6sN3v8ZoaqRuOkKVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697997991, "uuid": "caaeb0e2-9869-4809-8056-730f60a51eed", "value": 1972218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697997991, "uuid": "2b91985e-fd79-4a99-b857-da7781b81169", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997991, "uuid": "c6ccac39-8b4a-4867-8e21-d231bd43d5fa", "value": "d6a42f3b198cf6b4d64f069824757525.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f93860d-7132-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698017273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698017273, "uuid": "ebe7f9e4-416b-43c6-94e2-cfe620c3ca09", "comment": "Malware payload", "value": "0959d526ad0d8dd8b104a6602b40fcf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698017273, "uuid": "15476b74-f0e0-410c-9132-d9281cf1e68e", "comment": "Malware payload", "value": "8801b0a405cd306183ba2c212c0409e8496c535f7a361f3a5d76dec6f3914586", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698017273, "uuid": "ca108adf-d8d8-4d55-8a22-c6e3f2e83987", "comment": "Malware payload", "value": "a2dd19ffd028ff5a81997c013ecf47e723862dee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698017273, "uuid": "0fa704bb-4c4c-4772-9d22-86c2031ffeb8", "comment": "Malware payload", "value": "b0e53c61d09b104fcc788c2ecb0bca6c2cf0010a60de55ef75d32f44b38c08502888227c322c50c936d9ac702898cd99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698017273, "uuid": "df146fab-6da7-47f7-ac0c-c160b7fc4102", "value": "T1F18533D2D7D80937E4A59BF158F702832A793E91CD34570A3B81EC950A63290B9BDB1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698017273, "uuid": "94a86028-87dd-497d-918e-f8dc28deea92", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698017273, "uuid": "df9f9b04-6cd2-48bf-9d61-6a06c9c75989", "value": "49152:yhqlsWuD1fm5nrfkzY4hamApIJRjuol6fAZzXzUN:9lhutmVrfkxhqIJtrl6qTo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698017273, "uuid": "fb7277e4-5641-4c9d-83b6-b9bab49eeec5", "value": 1826816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698017273, "uuid": "34d438da-c1b1-4e24-99de-e53029660ef7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698017273, "uuid": "a9168e2c-5d47-4e68-bab6-3ac774bd66b8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f86b42f8-70d5-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1697977479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977479, "uuid": "b15b8229-f9d5-41db-a59f-a675a5ffd38d", "comment": "Malware payload (Gafgyt)", "value": "43f3ffa195bf0ea8688a30c3732aee50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977479, "uuid": "3f9d649c-4822-4639-a136-bbcbca08a517", "comment": "Malware payload (Gafgyt)", "value": "88c611c52a2e2c62eb4bf3bbcbca827ed34583e17f8e7a12404fff4f8ad7348b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977479, "uuid": "13f74bba-b439-419d-bfa0-3bff3614cae9", "comment": "Malware payload (Gafgyt)", "value": "e1c89dee5593135e34e701aa34bd2bc002f08b65", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977479, "uuid": "3b441762-195a-45cc-b2e1-709358b77370", "comment": "Malware payload (Gafgyt)", "value": "15f1e14404bf7795c53ecd0a873ea060505c1deef7cc39adf0effcd7b55a52ebe79ea4ce021d001479e570d3e6427e4b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697977479, "uuid": "6fe23581-eff1-4fdb-b9de-b8a494c67596", "value": "T1C6E32B30F4504B17C2D213FAF69A825E3F221FA7939733154B38BAB41FE279A1D65924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697977479, "uuid": "f48ed72d-f812-418a-b011-8ddebf1bf3c9", "value": "3072:tHjWvvLQ9TtaFa2tfpBfxPvN9XsxHxiUyHOComweQSSycZNu:sUjaQ2tdNFOHsRpomweQSSycZNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697977479, "uuid": "8c17e276-6262-4c84-8dd5-e1d719552f38", "value": 154180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697977479, "uuid": "d3f21d13-8caa-484b-8aca-b451a4edbc19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697977479, "uuid": "f0e96415-fd2e-4cbd-af1e-348a9c7bd135", "value": "43f3ffa195bf0ea8688a30c3732aee50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b97c16b2-7105-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697997989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997989, "uuid": "967cae07-d31a-4d25-a356-e2bf3cecd1e5", "comment": "Malware payload", "value": "b920ce15b5ac499a724bd4961db5dcb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997989, "uuid": "a2edc59a-75fe-43be-bfcf-06e0a17e4b6b", "comment": "Malware payload", "value": "88d3dfe83d2a220f6659ab34a6a59bd862fd290ae2f9047e69d0e87493df3788", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997989, "uuid": "92513a55-157e-48aa-b37c-c5c55594dacd", "comment": "Malware payload", "value": "c989d74a8316cd312f602a461393cd0e5a666825", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997989, "uuid": "5b36d1bf-1820-426f-9929-a2d526775cf2", "comment": "Malware payload", "value": "3e836b608a0abecccd245a317ef87b5780786b4bfde16418ec914c59f07f4da6f9c0674a22949059d697e6c82f1833f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997989, "uuid": "f8731d9a-3707-4e3e-bb52-314a7181988a", "value": "T14216187F72A49279C11EC23FC0934F40D533B9762B33C6E7129112A95A669C89F7FA24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997989, "uuid": "f2a69b9e-2e80-41f2-ba01-f2e7487f46be", "value": "7495bfccd8e07c22237460b8d82e6387", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997989, "uuid": "833439b4-f172-429a-a7b4-65a32ff5e24e", "value": "49152:wgh98D4xlsAOPmUIkUI8RUyvhoDCfVC0fLqaNl1XvGTx/S5rcWLjXNO:+a71fPO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697997989, "uuid": "15f771d1-d59c-4404-9fac-3aed1681dc23", "value": 4068568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697997989, "uuid": "99e2bf72-bb16-4a0a-a539-315da0641f2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997989, "uuid": "a71d6345-2872-4290-8e13-b1bf8ed95e7e", "value": "b920ce15b5ac499a724bd4961db5dcb8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b610a31-70b8-11ee-8907-42010a9c0042", "comment": "Malware payload (MarsStealer)", "timestamp": 1697964706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697964706, "uuid": "90416f5d-9080-4254-9863-a8f415d3608f", "comment": "Malware payload (MarsStealer)", "value": "936a0bb4a2295eccbae6a6962422a24f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697964706, "uuid": "05a531c9-ea86-4fb7-bb21-be9e2f8c84d9", "comment": "Malware payload (MarsStealer)", "value": "8946c26215bd770f81a80c11ddaf9149f0e7e1055e41ef92df542f08fb5f1676", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697964706, "uuid": "b3b67cfd-7336-4b66-9a69-03c7db125bd2", "comment": "Malware payload (MarsStealer)", "value": "b00bcccc24367fd0cacc1af08a6373b8070407c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697964706, "uuid": "1548407c-f488-49d3-8446-91d3484e0f3d", "comment": "Malware payload (MarsStealer)", "value": "d94a114f832bda935d89cffa357af91e6f70f72816e2475765387c914f9904869165d48a0eaaca61d6d444745ee81cd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697964706, "uuid": "27a41024-e953-4ad4-854b-1bf0cbbad38f", "value": "T1A344E021B6A0D832E0635A350931C29A1F7BBCB1AA7580CB37543A3EAE316D15F75B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697964706, "uuid": "8f93ae6c-2bed-4783-9599-c275eb731b5d", "value": "fc20e897770322541e2213674466dedd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697964706, "uuid": "091dc25d-b0a2-4f9f-8d6f-ee2085c82b59", "value": "3072:Hex1BNZeJAlmqCNPOTrVueYwgte+ei1qJoa5H0VLZlMPF:8noAlNCNmTxlPig5aLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697964706, "uuid": "0dba53d8-beb1-4bf8-a4da-835b6a40b82c", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697964706, "uuid": "18ef1c3a-aa80-4c6a-8f5e-0b0a4f0eaccd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697964706, "uuid": "72d26efd-7338-4969-b90c-b14e8b2b6156", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b0a960c-70b1-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697961672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961672, "uuid": "71a2a8cd-80bd-4b7a-8511-d67f8410382f", "comment": "Malware payload (AgentTesla)", "value": "ac8952532cfda8ea6ebcf7fb920e7f71", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961672, "uuid": "95d818dd-81e6-459c-9cee-d3202b11ab41", "comment": "Malware payload (AgentTesla)", "value": "898861ae38cb41105bffa6e540d86dbaffe999a23ff879bc3aa8df7c18d6e56c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961672, "uuid": "76453d85-ad8c-456e-b3fe-12ee1f216d1c", "comment": "Malware payload (AgentTesla)", "value": "6e5c0293cb016fb74c1a28f48471da0d94eb2e1e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961672, "uuid": "f68f4d40-55ff-49b2-a5cf-2934da3ede74", "comment": "Malware payload (AgentTesla)", "value": "165e7423c762618016c9a288ed84b8ada8994accd143e2e222bbc4d68722b61b8a358c4fffb467a6fc2fe4ddb9d1654f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961672, "uuid": "460cd026-003b-4e01-9c3c-dfef53efa86a", "value": "T136E42362375883B7C14C8BFA886493848FF62E253109EBFA4EC175DE79627411EB4A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961672, "uuid": "b07a9f65-b82e-4f51-9051-600f0be53b4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961672, "uuid": "ef499d05-a0a8-47a6-a274-61dcd1d1c729", "value": "12288:0Nb5yzvbYmBHEe//W/hy7uvDPgLx1vYJKiHqwavHgNgS2dHXTu1XSJZNUyFSpasq:iebY0t/W21iKSmHgNgh3i1iJ/UyEpasj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697961672, "uuid": "97153f0c-4446-4c1d-9a40-88fb1642816b", "value": 716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697961672, "uuid": "d4028ba7-f369-4ec8-a186-bf77c2cf6647", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961672, "uuid": "ae6d1e0f-12b0-458d-ab43-8a8290342b8c", "value": "ac8952532cfda8ea6ebcf7fb920e7f71.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3f280cd-7098-11ee-8907-42010a9c0042", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1697951138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697951138, "uuid": "57b8e8f3-a8f8-44a8-8a67-4fb1ee00a837", "comment": "Malware payload (AveMariaRAT)", "value": "818f32d7b8abb99fdfb0c28e2e971064", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697951138, "uuid": "6cb43a90-ad3c-49bd-a84a-21ee1652cdbf", "comment": "Malware payload (AveMariaRAT)", "value": "8babd1b12db5aa7c49b748e6cd0a558e8eba4c694f439e9258ac50d7fccf559c", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697951138, "uuid": "89706892-6a6a-4b81-8214-0ea47d8b98b5", "comment": "Malware payload (AveMariaRAT)", "value": "09f06d3690420c524366c241f0fc04ddf101c948", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697951138, "uuid": "2d5f1c7b-b5e4-4533-b087-26eca335c9ec", "comment": "Malware payload (AveMariaRAT)", "value": "a2650821e179c557dab2849481795c0d23a1f846f5b0042305d196ce8a37f6597a8c67b42f0ea7fdecb111bc52ba152e", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697951138, "uuid": "7be7d7a7-c513-4499-99c3-acef5c0ba88e", "value": "T17B258A2A19BD91E7F06DEEB48AD18713B0209C6B3031E966D48B7BD5C273947E4831ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697951138, "uuid": "6ee99a16-3b5e-4546-a8cd-d58238dde6b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697951138, "uuid": "4e96d851-a64b-4cf2-8986-4e93c8233c7b", "value": "12288:GBvSZbk0WXlBx4+K5jFY4IGW5SDTrWRJmSqKp9TV1gSx1yN5K7q:DPj0GNTyRJ0jKG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697951138, "uuid": "e523d5ab-9729-4e81-9f59-c2f9058a239b", "value": 1027584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697951138, "uuid": "0694fad5-02bb-4829-814c-bf662157365d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697951138, "uuid": "1e6864cd-51e1-49c7-ab54-0f10786f5e9e", "value": "818F32D7B8ABB99FDFB0C28E2E971064.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37906b07-7100-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697995624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697995624, "uuid": "89655dfa-dc11-4199-888a-f54457e830e6", "comment": "Malware payload", "value": "cddc6e9339050146fb532f76c6364ff9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697995624, "uuid": "e7abfd11-846e-4015-89d6-caa9f8af7354", "comment": "Malware payload", "value": "8bb2289a9b517feaada0d786135691be17f8bad0be5adee6ba0d9fae39b760d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697995624, "uuid": "7b72d487-8342-4db0-b5a1-65bf43a8e30f", "comment": "Malware payload", "value": "e014f6777e202a6b25df3e10de0fbd4c3ae579e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697995624, "uuid": "4f5bbb28-95a7-4ecd-aace-17cc5e667e9e", "comment": "Malware payload", "value": "6eef8182ca50c79d81ab24a70f0b1707ece40e056417474ae4fb4337840318e5ad3a0c17b610c535b41ad528caa34d0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697995624, "uuid": "32537252-4133-4e5a-bc77-845808e6c74e", "value": "T1C9847D816071E485D3F284719283D247E360EF2C32DDDE869E6972A5132F7C27BAD993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697995624, "uuid": "fe0b36f8-1e49-4ec1-ad51-14be470f08d4", "value": "7182b1ea6f92adbf459a2c65d8d4dd9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697995624, "uuid": "bb4001fe-dc00-45ba-bcd2-efab8ebeb4b2", "value": "6144:dt5hBPi0BW69hd1MMdxPe9N9uA069TBSS5:dtzww69TMS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697995624, "uuid": "849df914-d387-4765-8507-41ae57308fd9", "value": 393728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697995624, "uuid": "7ef1d183-e888-4e31-96fc-d7c05bb142fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697995624, "uuid": "dccda3e8-9d83-47ab-ae95-173810508b6c", "value": "EuropaPPT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8552a1f-7101-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697996350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697996350, "uuid": "6c67ab6c-41c5-48f5-97c1-f9226b0c57b2", "comment": "Malware payload (RedLineStealer)", "value": "104ba7bd0d8f34f79246744520b16ab5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697996350, "uuid": "1c02f293-4433-455e-9d7e-ee126d9fc622", "comment": "Malware payload (RedLineStealer)", "value": "8bf4003e54f6b55b62e429cf90e78491c109497a50c5d4e6a8afd07f0600ba43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697996350, "uuid": "e69db886-ec5b-4f86-ae5e-dafe1d565507", "comment": "Malware payload (RedLineStealer)", "value": "5760d02c7867c4993dbaed2c8b4d65e9ffd02b7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697996350, "uuid": "ca761fec-c040-4877-9b61-aa057cb2ff85", "comment": "Malware payload (RedLineStealer)", "value": "6f08b21716f792f0055e94309e3891b1f5b093c53ab01f642afb8c8d34f26ae2a6c5a3bc30720748b5c819dbb0ad51a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697996350, "uuid": "7107d4d2-c794-4817-bd6b-c32cf99dc028", "value": "T182B45A51B0094F2AE3F2087CEACA5DAE4D507EED6F530B8F36C14B8167967D1A93910B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697996350, "uuid": "8a7e94da-fb3f-46bf-852a-4d7cfe87afa5", "value": "d350427820086a321ccf21b695161218", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697996350, "uuid": "e9a3208f-44fd-4215-addd-206fb0fcc0a9", "value": "12288:e8k8Mw4QB2o97Hr62k3n/+pLsv9+eXUeF6e1L:zMw4QkAr62k3n/+pAv+enL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697996350, "uuid": "9b46c468-f88d-4916-b249-800a7628d6d0", "value": 508488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697996350, "uuid": "890eb4b0-4e65-4a48-9486-c8eba25df81b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697996350, "uuid": "5f59a880-64ad-4839-beec-822881d06395", "value": "SecuriteInfo.com.Trojan.PWS.RedLineNET.6.26406.16064", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d4f2e4-70db-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1697979726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697979726, "uuid": "99714650-fd7e-4617-b8ee-f878119b6d7f", "comment": "Malware payload (Stealc)", "value": "bf05fe8ac71c94c2574fb4679685dd2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697979726, "uuid": "081c4289-28be-4bfb-a735-8003576249bb", "comment": "Malware payload (Stealc)", "value": "8bf68cdfa47374adccbcbace4f04d3007ebf6e5890625ccbd73e3aa328469e40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697979726, "uuid": "af84c18a-a87b-4fe3-af52-454dc9bc9789", "comment": "Malware payload (Stealc)", "value": "3bb6cc9afec6d085daf440821b869fa5339aa703", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697979726, "uuid": "c6c41106-2fe3-4cb2-99ef-ea9e8dd9596c", "comment": "Malware payload (Stealc)", "value": "fdeaf01bf2f23acc2a15a22e40ba15763c5464ae31b35272a305ed18b6b796398e34f4ee489fab2e8e860405503882c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697979726, "uuid": "7fcc90b1-3304-4134-9b07-45abde18a896", "value": "T14144CF11BBA0D831E4A255344930C7962A3BFCB19A7580CB3BA43E3E9F316D15B79B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697979726, "uuid": "2c146320-a027-4f49-9abc-93cfeebb65dc", "value": "d2a54e4207f7fb1f334f58a667aa3417", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697979726, "uuid": "6312c807-e55e-4dd8-83f7-4caffd30c453", "value": "3072:W1yBN7CcxAeG1Nw324jllvuRyV3IBaIe4uDI+MN4R+h8BmDPNeQ4Q8zb:xdC6AeCNwG4Z93XDY4R+hHeQKX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697979726, "uuid": "de316a1a-30e9-46b0-908f-83e51fe103b1", "value": 260608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697979726, "uuid": "cfa1e84b-640b-4310-830d-a1b75a77e9c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697979726, "uuid": "6d2c72a5-dca8-458e-8863-de18444e8768", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "575751c7-709a-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1697951868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697951868, "uuid": "6e56a612-5d86-4a20-b0cd-77edd494ae69", "comment": "Malware payload (Stealc)", "value": "d4418cc42f089b882285739487187662", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697951868, "uuid": "08a17dbe-4eab-4c43-b85a-ea1d41dda3c3", "comment": "Malware payload (Stealc)", "value": "8c10f794a46fb4dcb0a0a2b4ef9c8980f332e9487dd3200cfb3da2e0d2c2df38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697951868, "uuid": "a6ae43cb-8ea6-4618-a10d-5f31673d799e", "comment": "Malware payload (Stealc)", "value": "ddff037606b62cf91eaca0ab595b83b04677cabe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697951868, "uuid": "2045fadc-33cc-4691-abc3-bb05cdd956e3", "comment": "Malware payload (Stealc)", "value": "81a383521783964827a02defe8dbdd678f916e34b68cbe68fc81a7a77a3ecb807e3b579c9e80fc6114189fdff81e3867", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697951868, "uuid": "2c626e66-bd94-4b06-a69a-19a7815fdb9b", "value": "T14644BF117A90C476E5A269351830C6961A3BFCE2AA7481CF37983E3EED317D19B75B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697951868, "uuid": "168817b6-c14a-4bb2-bf3b-7d94d2582364", "value": "1a993c5a381c8e12968253c74a42dfae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697951868, "uuid": "0197383b-ebf1-43c2-9f5d-1c52a7151c0a", "value": "3072:Hr1BNjYJA9mK1BP8QEutOuOFf8eti5tAijaJBG7Bprib4KEmpJEq:X1OA9d1BbE1LFfcnW4uPb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697951868, "uuid": "38247e35-f820-4660-a9bb-50457eadab34", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697951868, "uuid": "c66d7374-4d33-437f-b07b-bde297700762", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697951868, "uuid": "a6a09464-d997-40d1-898b-5d5b50766cd1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa19ea7e-711c-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1698007842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698007842, "uuid": "dd9524c4-e568-47cb-9ddc-04709d0670e3", "comment": "Malware payload (Stealc)", "value": "dba8ff9b955c112757fd54c12a6c9573", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698007842, "uuid": "323e0809-4cff-4be7-b47f-b8e3b8a89433", "comment": "Malware payload (Stealc)", "value": "8dffad5a01366b7e754c4a2be80dae6b3610b41364ebf7d6586c0236abbe5897", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698007842, "uuid": "d7a4482d-5231-4d46-a0da-dfe6a0814dcf", "comment": "Malware payload (Stealc)", "value": "6054f2f6153320f50be31eb3c9b70fb371e48dc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698007842, "uuid": "86813628-252b-4f41-baaf-57931e02e3d8", "comment": "Malware payload (Stealc)", "value": "636aa52b4873212180d3d14c453eb380bad7dc50962b41a845b49a41377a80724927c53315d26d2585072c743dfb237d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698007842, "uuid": "5856045b-08b4-4ab6-946b-dc1ab9447c63", "value": "T1D104D02072909032E0A758311970C2A61E77FCB26B7941CB37983E7E9E716D05FB6B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698007842, "uuid": "cee2954e-ff7e-4e9e-a7b5-7d4006749a88", "value": "6ae03e1897875cb6ffee8a530dc88389", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698007842, "uuid": "34f6dffe-da9f-490d-9d72-df096aa33f56", "value": "3072:ayBN6fir6AXssrDxak5DPC1ynUSQcbevOvopqOSbZ7NxX:x3+AX5rDUk5TYyecMOvIe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698007842, "uuid": "937c527a-8311-4ef9-9840-eb357a323a58", "value": 182272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698007842, "uuid": "1e0434e7-7151-4e66-9b16-b7d42df7275f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698007842, "uuid": "44ab1dad-5736-4863-8e8d-113725c8e71a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8813775c-7073-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697935200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697935200, "uuid": "e7b96dd8-835c-4e86-96dc-398295199f99", "comment": "Malware payload (Formbook)", "value": "73f66d36496402eb8eaea0fa4f974d37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697935200, "uuid": "3ca509fb-e58d-4b1e-aeca-74c248dddc23", "comment": "Malware payload (Formbook)", "value": "8ead6882b8f8b2b3f82a963041f44cab27d6b80ae6dbfd7863bee5a7bf9505f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697935200, "uuid": "5b10ca87-d464-469f-b516-cfff0fc5c075", "comment": "Malware payload (Formbook)", "value": "a97358cf91dc3be04f13f015201f076ae25752e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697935200, "uuid": "ce864030-806c-4f3e-a3bc-cdb9647a3aa6", "comment": "Malware payload (Formbook)", "value": "cb52e3e3117e19d2c9b4cb61116ef3df7272ef62ed1a1b0e1c74eb1b6525684d786763377b7e00121f3c09f02206a700", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697935200, "uuid": "79b2508c-3380-4ba9-b68b-28495e5bc387", "value": "T17B652353B5D490A2DDF507B068FA03AB18727DA18E7152033F13E92E5CB2E896C7535B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697935200, "uuid": "49523f85-80ed-4a17-babb-c342425be05a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697935200, "uuid": "8d59db04-1787-431b-b538-0e88fea90473", "value": "24576:myZjts0Ch5ryNqVaL6Vb6AV9Yr34ydOWoS5VF7NvWuKf3x4E1cmWmz:1js0ChpVaL896LpJWL/2E+mWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697935200, "uuid": "ddf9fa8a-73d4-46b7-a973-e9e2ed867bcb", "value": 1492480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697935200, "uuid": "246dcdfa-d076-4eda-8826-df70885d1c73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697935200, "uuid": "b12bee3f-b792-470c-8c2b-bdf32e020135", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "347c2637-70e0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697981875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981875, "uuid": "4eaccf0b-83e7-40b8-99a3-2fa60e9b2aab", "comment": "Malware payload", "value": "8e8d93a471dc7568191a381a763dd330", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981875, "uuid": "e84e7700-9a1d-4517-8583-e144ceae92b2", "comment": "Malware payload", "value": "8f217db6ae8a0f1f6affbbab9dcc70401f500848d96806c96acefaefa638e6f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981875, "uuid": "77c7dd63-0fe0-4152-9e42-3823ae97a694", "comment": "Malware payload", "value": "35d46804b7efa9b9f345517eab57956f5c1934ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981875, "uuid": "f9d54a90-74a8-44e4-a401-b6f2cce36d4d", "comment": "Malware payload", "value": "5a7465cd5ad4e652b20d11a3bdb1676b2d930e0e0ef77edbc3392064e2053a644bd35dbc0868d2ae1b9b7fffd9915fcf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697981875, "uuid": "9ecb3e7b-a148-4572-8fdb-0baffa174781", "value": "T1C3440C103AFF501D71B3BE921FE9B5D94E6BF6B1263950BA205807078B63E40CE91B76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697981875, "uuid": "4922d4d2-a853-4773-a973-4a7997d5f64b", "value": "3072:FZMVnW+WDZ6RahgggggJgggggdgggggBgggggGgggggsgggggWgggggVggggIm8J:FZMVnW+WDZ6ssNj5f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697981875, "uuid": "db83a0f7-92e1-4a41-8fdc-e9a1ce1425a6", "value": 272036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697981875, "uuid": "fcf52074-fb2c-480f-9c20-80e8a56cfc57", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697981875, "uuid": "62cca6b2-65f5-4780-9724-cebe5e22d04e", "value": "d291b9baa2b4e67c53681e58e189b63253c9bbbbe709ae6ed62f1ca8.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "848b52aa-70d7-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697978143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697978143, "uuid": "bf36dc38-c5ed-40bf-aa2b-5a64c7be0f32", "comment": "Malware payload (RedLineStealer)", "value": "b448fb94da39c54b905a496c80d96fa4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697978143, "uuid": "16a41fb3-6ad7-499d-a711-05373f08f78a", "comment": "Malware payload (RedLineStealer)", "value": "90522e6a880f6a97719035e3945da1c0c0384f154cf631732ea16a3a9f827b7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697978143, "uuid": "35a86569-c4a3-49f2-9d1e-f943fe9214f4", "comment": "Malware payload (RedLineStealer)", "value": "026c5d806f763ae795c5b2e7fc53d9bafa0d74e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697978143, "uuid": "b9cd340b-c796-4985-9e62-837c7be71f32", "comment": "Malware payload (RedLineStealer)", "value": "a37f86d8f7d85a1866fbc7023f98394f22b327d7ad91c4c95bcfb2c31858755158f3e86c03072ac5d1d30f334c68e464", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697978143, "uuid": "bbbe5b58-6cae-4901-ba8d-87b97f463cad", "value": "T166B45A51F0094F2AE3E2087CEACA5CAE4D507EED6F530B8F36C54B8167967D1A93910B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697978143, "uuid": "ffc47c5b-ec3f-4de2-ba76-33aeebddc3e3", "value": "d350427820086a321ccf21b695161218", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697978143, "uuid": "54d08398-95c3-49da-888e-3848cacb9e6b", "value": "12288:l18lL1srftQB2o97Hr62k3n/+pLsv9+eXUeF6O1L:l61srftQkAr62k3n/+pAv+e3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697978143, "uuid": "be318ec3-9aa0-4659-a0c7-40ed609aca37", "value": 508488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697978143, "uuid": "d99dd9e5-04c8-4f50-ab8a-454bae38e451", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697978143, "uuid": "e3f2d246-21bf-4173-ba17-4d117acf6eb2", "value": "SecuriteInfo.com.Trojan.PWS.RedLineNET.6.20352.25081", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3bc6b29-70ed-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1697987752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697987752, "uuid": "44e090af-b8d4-4942-8f78-5a2adcfc635a", "comment": "Malware payload (Stealc)", "value": "1bd49730d508a4d1dcb28794e6c3ff14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697987752, "uuid": "b5025814-ef8c-450b-992f-e5d7e6754506", "comment": "Malware payload (Stealc)", "value": "908548cb94a13710b0668aca7ef2045da8ba4443e9edcae7a46e93900856d1a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697987752, "uuid": "887dca85-3989-4b95-a65f-fe3b76acf439", "comment": "Malware payload (Stealc)", "value": "87cfc4933d5b838beb7e1be6f6d6d8eac7631937", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697987752, "uuid": "6d606329-c7f6-4db1-a691-2c79e7ac2197", "comment": "Malware payload (Stealc)", "value": "c14448ebdb4a1dd16058e49be2251f13a87c8b30d7aa823a6837a6a0f492c3cf261c2b597760487eacd15458196ab77b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697987752, "uuid": "640a370e-cfca-4e23-94de-8cb5f42782d0", "value": "T1D344D0127B908832E5A359344970C6652A3BFCB2EA7585CB3B983A7D5E702C05F76B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697987752, "uuid": "adeced24-452a-4d0d-b924-32ca486ff458", "value": "d2a54e4207f7fb1f334f58a667aa3417", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697987752, "uuid": "e4535f8d-7069-4873-be2f-8af3750f8fb4", "value": "3072:fyBN7ycxAPGCNw30qsdRCiLsHeP+fnQQ4P9ms3DtswsyOY27:Ody6APZNwEpZs+P+PQQKJ36w0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697987752, "uuid": "0c681e97-12fe-4a12-971b-88a5e9a2eee7", "value": 260096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697987752, "uuid": "0004e6ac-97a3-45e5-9717-0e1130ac5830", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697987752, "uuid": "35c11919-9f87-4904-ab82-e7eea76bde39", "value": "1bd49730d508a4d1dcb28794e6c3ff14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22716bd4-70e0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697981844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981844, "uuid": "ad8956e0-3330-4041-89f7-c7ea4ca93cc9", "comment": "Malware payload", "value": "f5301f0dc50ccbdc50639c5ba33b3ee1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981844, "uuid": "301b57e7-5a7e-455d-a4c8-558be50904c9", "comment": "Malware payload", "value": "9131e484cb8d792035c178f593e768297b85f19445ff4406d39826340f6d5a8c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981844, "uuid": "3528ccc0-10b5-46e8-8311-2e8ade842058", "comment": "Malware payload", "value": "e45c2a545a641943258ca423394c87e51be297ae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981844, "uuid": "343fd7d2-59ab-46dc-b02a-5d94e0e29220", "comment": "Malware payload", "value": "d2b01fc079e101fe6032991055ac9736c675d2ce2bb3b526cf39cec5b703b31eb52bb3cb8c98220ff7c0cb0234a7c9b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697981844, "uuid": "1be5e2af-dc33-4306-9095-fd11d9f1fe49", "value": "T10464747A6077EE8A96370A40D1043F479C299EDF6A784BF8778801D1C1AC78C9AD75F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697981844, "uuid": "3334e824-5382-428e-bf6c-2d70c39b7a1e", "value": "3072:FZZ3Hq4qfrqVJD9Dg8XAptiFmwewQeA8vSBshO2bo7xIcFwiMQvFbQ9UGphxDuH1:RXQWZtpXCIjhWDwOTxFQzKs4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697981844, "uuid": "74c655f4-4f31-4818-aa53-d90a859414b7", "value": 324952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697981844, "uuid": "b18dc8a6-36b9-4413-b788-13e292a73088", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697981844, "uuid": "267c74b8-2657-436c-9bb9-19d8a72c22da", "value": "fe43bd2a854b203f31f0ae0723c0a8ab2db46e3c96cd3fa28d47c585.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c1e912-70cf-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697974894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697974894, "uuid": "6deb15a0-e999-4f1a-beb2-841e2437255a", "comment": "Malware payload (LummaStealer)", "value": "7962e9c20825e1ba91bafb7f18f529d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697974894, "uuid": "78b2d9c1-2ada-4495-8887-0109d8ea08b1", "comment": "Malware payload (LummaStealer)", "value": "9254fdd849c2461cd245c2835d89e11439f03e8043162a40f0885ff4daa3837f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697974894, "uuid": "ca574d98-3d7e-4cac-be90-23115a76a4b9", "comment": "Malware payload (LummaStealer)", "value": "9b1d4702738d978579360a746f284b96e3a059f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697974894, "uuid": "87a5794e-4121-4bfb-ae23-f3cd7b98796e", "comment": "Malware payload (LummaStealer)", "value": "38920da41bcf8fd7aa045eea53d9dab1e121ade9a0047a9645ed3015a60fd1e9828adb9a5d976c0fc833a1fe6500e0d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697974894, "uuid": "77a5e0c5-8b4b-4236-ad3b-7b0603d19e3a", "value": "T16144D011B691C832E4A799391830C6A51A77FCB2EA3584CB37A83E3D9E306D05F75B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697974894, "uuid": "b06eac32-6e69-447f-9b92-0aceb7ea5a88", "value": "fc20e897770322541e2213674466dedd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697974894, "uuid": "e5921ccb-89f6-4060-ab25-582bb7366a1d", "value": "3072:Hv1BNdeJA6mSC5P4rb0DGicNBS619PKJGeUq618lb:zPoA6BC5Qrb0DGrBS61NuUqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697974894, "uuid": "69a86ded-8829-4de1-8b4c-b96dcc99ab02", "value": 261120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697974894, "uuid": "9bdfc533-d9e7-4aaa-b8fc-dc3494fcd158", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697974894, "uuid": "ffc370ef-0f74-4d1b-9430-79f7a130e75a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "714c188a-7118-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1698006028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698006028, "uuid": "f869e682-661f-4374-b851-6d21f3fa3e1d", "comment": "Malware payload (LummaStealer)", "value": "4adae2dcffeafc9faa8bd1fa66d17d6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698006028, "uuid": "d0b1f0cc-8056-46b2-a26f-61283adf8524", "comment": "Malware payload (LummaStealer)", "value": "92ec90b07b5568d1f3effbb964848ee21f5257843ab5a7fb97135e6b476221b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698006028, "uuid": "15bd18e4-a36d-4ce6-9119-fd913d1a78ab", "comment": "Malware payload (LummaStealer)", "value": "455d837d897c49ac5bcc627108c8b11edbbd8c2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698006028, "uuid": "00b07aec-20e9-4bee-a70e-e28f7757c9c1", "comment": "Malware payload (LummaStealer)", "value": "f086aa303b61c96c746cfcf153b4d84f4051daafed457e26c3dd842f2481902f8ca2e591bc011d381d08c527cdd02b59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698006028, "uuid": "88c77d07-3c4c-4ca0-a154-96bf89ae10f1", "value": "T1528523427BFC0412E7A81BB09EFA439747B5BC96CC74026F1352591A0DB395C693AF2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698006028, "uuid": "439a61c3-16ac-4b6b-ab94-eafd0f8237cf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698006028, "uuid": "a7b334a0-b490-4bb9-b431-b65de28f3460", "value": "49152:18Crq3Fdyrija/ztX6rPP3jlwHaIN4VM5XGML3:lrq3FhjOtwzlwHa+QM1Rj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698006028, "uuid": "a3008e5d-f042-4464-8c0e-da8aabdc6cb7", "value": 1827328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698006028, "uuid": "8eaadcbc-a717-4171-9298-39dd45918e77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698006028, "uuid": "718b7f5b-0a8a-4add-93ae-c17ad74314b6", "value": "4adae2dcffeafc9faa8bd1fa66d17d6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a9691c5-70f8-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697992246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992246, "uuid": "ee4bfb8a-717b-45e3-8aaa-ad2e0d7b4e77", "comment": "Malware payload (RedLineStealer)", "value": "5b7e00c30e11b21002631ab91c7c0bd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992246, "uuid": "aa33eeb3-0094-4a9c-9b54-4eebf7a2613b", "comment": "Malware payload (RedLineStealer)", "value": "92fd5c61bd97a904f17dc67c0b6c6fb696a027a5f91261e72b77d1c1850afabd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992246, "uuid": "09c9cd90-6912-4d75-8df4-73f6e30d42e7", "comment": "Malware payload (RedLineStealer)", "value": "619cf5371e96c46822e72d5a789a887c44d478ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992246, "uuid": "87c08803-ae8d-4652-9e86-7559c49063dc", "comment": "Malware payload (RedLineStealer)", "value": "5410883e3ec6750cf03d3d46be2eaa9b4395236ee57fea7d205b88ec1df11d6b0fad113b13ac66be87221e6dd7e63b67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992246, "uuid": "433741b1-fb0a-41bd-97aa-5213be9adcaf", "value": "T198865BC7FC9151E4C0AED37485668262BA713C885B2027D36B50FFB82E76BD46E7A314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992246, "uuid": "791cbc05-c8ca-4fbb-becd-ad771ce2779a", "value": "85cddd6092e65c1a58dd1e6e9ab9fc63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992246, "uuid": "8ba902bb-a876-40d6-8ba0-c6f0b0bb0c02", "value": "98304:wEFGdONRTObgHN/+HSZ1arEBga7+4+42:whb4Gya4Bgw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697992246, "uuid": "02891dda-4685-4b8a-b9de-72cb8d8318b8", "value": 8107520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697992246, "uuid": "429f9852-82fb-4786-9b9b-96f53399f33a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992246, "uuid": "0a90cdf7-3a1b-4293-bc1f-af16a15c1bfb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a6c0c1b-70ae-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697960437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960437, "uuid": "599f0322-6007-47c1-ad46-ce453b1e1feb", "comment": "Malware payload (Formbook)", "value": "2157203a20adcc37c0989dbec2d904d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960437, "uuid": "a99eae45-b68a-4218-bd48-a6e0a0b36700", "comment": "Malware payload (Formbook)", "value": "93f2598fd6e895e67afdd3393a472581f565c8bf43e4c00f883e51fcbc8df315", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960437, "uuid": "6e094dea-8160-4262-a4e0-f7a38781ec97", "comment": "Malware payload (Formbook)", "value": "8100db1c4bd334bc6ecc7213a93afcdc52209ea2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960437, "uuid": "37b69ef8-e8a2-4b8f-a040-65c281929de4", "comment": "Malware payload (Formbook)", "value": "de6de387297f59955b4923feaab657d312ad8c1121dc9a86c9a2f1edc33714741f8a8cc6de18721802bf77312ea880f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960437, "uuid": "2b6c3f48-b727-43ae-b4ad-cee558ccf2bc", "value": "T169D4120933E00BE2D075563A29B4927103BA26685972FB2A2E5E60ED7A77FCC0741F47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960437, "uuid": "01787104-d593-4c26-a590-7c0caec2aa05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960437, "uuid": "45566de3-b5dc-4134-b10e-814a3a9b6360", "value": "12288:x9W1vjJGGna1GitvH9GU712pXTECC/AOwM4ASIHXEjDmQBP0Z7WK/1:x9W1LJ1na1GitvH9f718TEx/ABM4kHik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697960437, "uuid": "0b7c8791-2662-4104-9b75-264ae49b736a", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697960437, "uuid": "3de3de95-488c-4fdd-a9ef-a3b99a07d29e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960437, "uuid": "fae72fe6-3a3e-45f8-a448-a78981fa4259", "value": "Pending Foreign Advance Payment Report.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd31bfa-7099-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697951721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697951721, "uuid": "1e1aa0a1-2d82-4bba-8eaa-0b30b2d1d11b", "comment": "Malware payload (LummaStealer)", "value": "80a0bba7b792fbc7c7cf87ac783aa2f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697951721, "uuid": "4ca4a673-5a35-4a38-a5d2-3a0030efb062", "comment": "Malware payload (LummaStealer)", "value": "94c44d916b27f693a843dc746fad3f2fa3c7b2d85e8a5c6b35b163e7cf6f5237", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697951721, "uuid": "cb068c2b-51af-48b8-9107-6a4d5d452b18", "comment": "Malware payload (LummaStealer)", "value": "da8cd451ed909d3845a59533b96a5490d1217214", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697951721, "uuid": "a53257cb-0911-450d-b169-fc3e061a306f", "comment": "Malware payload (LummaStealer)", "value": "f1e73e2e2dca5bd7642472b8487816392bc2972f1d886c5b6e8cd9db79e88ea1201831842a866bf20f63c27f7fdb248a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697951721, "uuid": "f4e0bf15-308a-46be-b98b-e1b72e31edf0", "value": "T10F158D2138C09132EEF320B787ECBA2642ADE0B0072955DF56D857EED7606D17F32696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697951721, "uuid": "13fb23af-a2e7-495f-a3b9-90546ec33945", "value": "440e77e14aa712e0e687ae6e10b63f30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697951721, "uuid": "87c68f1f-4005-4889-baf1-41cce799578d", "value": "24576:VmtwIVsHk1r1HHHHHHHHHHHJHzlagz3lt:MVsHk1hHHHHHHHHHHHJog", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697951721, "uuid": "d7bf4279-9e4b-4317-97e4-3d6eed8c9472", "value": 938496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697951721, "uuid": "e4873d0b-70a9-4ff8-89dc-dd2177638fd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697951721, "uuid": "0b425ef9-f794-47be-b053-114b27159c0b", "value": "80a0bba7b792fbc7c7cf87ac783aa2f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b75c54-708d-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697946275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697946275, "uuid": "7af34d92-029c-48c1-8ef8-56c85db58205", "comment": "Malware payload (RedLineStealer)", "value": "4fb10ddacb9412896c214f5817bef7c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697946275, "uuid": "53dc907a-dd00-46f5-90c9-b617653ba8ab", "comment": "Malware payload (RedLineStealer)", "value": "95e6d176f7a846342e18be08b1550e83d3e7d91d754c28f21ffdebf3ebb783f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697946275, "uuid": "0391ada8-b8d2-4df0-953b-b6b47873798b", "comment": "Malware payload (RedLineStealer)", "value": "8a04241edb0ba3a8a7fe59db3b9ac5bd7f731f04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697946275, "uuid": "a5119c6a-d1b1-47cb-9c61-4d1fda480e89", "comment": "Malware payload (RedLineStealer)", "value": "351c36e4502becfa1b5057fa0ad08b600f15383895e89b438989168d701a70a0adbfa7940fd6c83ba195f62e41eb80e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697946275, "uuid": "171f013e-e666-489f-b123-b1283cfa4d8e", "value": "T1B2652301D6E45171DDB99BB465F60B831A327C228B3903622BB1E8CD1C736E9A5B137F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697946275, "uuid": "c1364cfc-03eb-4383-b125-5f5c6df00186", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697946275, "uuid": "fe87ea07-af37-4f6a-b20d-b89c78836478", "value": "24576:YylzLOskXBbNXPYCwoMAX17F42LMwjWZVSlOxkWOZDEec0yP:ftrqDPYCwnm1ixbDSEkJDE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697946275, "uuid": "21b188df-c57a-45d4-9e50-4ea13a356c9f", "value": 1496064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697946275, "uuid": "b84249c0-970c-4e5b-910a-35bd8dcea620", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697946275, "uuid": "8b0d43f1-ac2d-491a-bb81-6c21cb98c816", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2fd4873-70ab-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697959297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959297, "uuid": "67245dd0-50c0-4f5c-926f-4dac96a6cb8d", "comment": "Malware payload (Formbook)", "value": "fe70407ea465935cbb99f6d306849e4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959297, "uuid": "6a29561e-7566-4f70-bebc-8cc65557ead2", "comment": "Malware payload (Formbook)", "value": "96916bc609b651d59f05cd9118dcb70f208f6d133d86c1a3ae9736cd5dd88862", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959297, "uuid": "1a37a6ef-ae40-4b5d-9d98-f60521607787", "comment": "Malware payload (Formbook)", "value": "dddd5afc7e8979400944722317a95762deebb758", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959297, "uuid": "49d7495f-866f-40e8-aced-8c6427cdddcf", "comment": "Malware payload (Formbook)", "value": "d4fd4fd24fe1fdce6ba8b10c9b972207647c2c024f55e8ee66a47657cc8581848798daced05910c26c0926423b9fd311", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959297, "uuid": "1f2142b2-2bbe-4118-b134-43252622cc40", "value": "T149D412293394B2BFC997D5358AA01D90E73170BEA75BC207646361DD9E4D68BCF00BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959297, "uuid": "020fb651-d832-4752-b4bd-3290264d0590", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959297, "uuid": "373860fd-09a2-4725-8fea-234083b21937", "value": "12288:p/jYEKKICL7LRQOQg2n4OiMmOFReT+j0rDlk1DaetfSrxIOPY9X0:pLYOIS+g0riMmDqwNmDa86x/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697959297, "uuid": "ea8f3613-ce25-4f90-8569-0c0b3c9a72b7", "value": 640000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697959297, "uuid": "66768ccb-45d5-4378-a926-8ed18ecf841f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959297, "uuid": "819bcf71-7bfe-411d-bb2b-e6b75ce12647", "value": "Order (MTC32qbPCC5Cfzf).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a44fbb8-70b0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697961322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961322, "uuid": "8f8817d5-4b5d-47ac-845c-9868a5361fad", "comment": "Malware payload (AgentTesla)", "value": "8056f83586f30385d8f6be0722cc24ba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961322, "uuid": "a68ec0ab-ff86-4f15-a109-cd6539572a62", "comment": "Malware payload (AgentTesla)", "value": "973c4e8724075fc2789f8aaf717ed09a69ede94f0bda1eae5ec70978134c9e78", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961322, "uuid": "a0fba85b-ec05-4a02-8b42-58da62f6be46", "comment": "Malware payload (AgentTesla)", "value": "77a3cd8f6d100c47ec60ddfd1748ed0785fa9a6d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961322, "uuid": "2385bbe9-b81d-447d-a5fb-f307fc77cb04", "comment": "Malware payload (AgentTesla)", "value": "114a8b6054a06bf4fd5037b0fcae20dd223cc8581766f5f382c2b695b72a06b99447eba1956ba7403710eb98d483126e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961322, "uuid": "d9c927cf-000b-45ab-8820-bffeebf35b3f", "value": "T1ADD4230DC8F1486BD6DB943F341ADB42217869B20A82CF6FABB155D41B5CAC73F9D091", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961322, "uuid": "53b5285b-f427-4888-be19-80f479fc1b15", "value": "12288:XjPEKuklr9n27gIDIj0lW3MLPCcxAbGcBZF77z2dVZ9o9wkaxzYMc:zPBlrY7Vtl/PCsAbG27z2zTo9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697961322, "uuid": "afd6f0a5-7c52-41c3-a9ab-05ba3272927f", "value": 655361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697961322, "uuid": "798492f5-3e15-4b63-b884-2d29c9fbc193", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961322, "uuid": "31e60b23-ea8a-450c-a707-500c051dfb62", "value": "REQUEST FOR QUOTATION.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba4e67db-70ab-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697959336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959336, "uuid": "6d17dd02-4ee8-417a-987d-de47238de0a6", "comment": "Malware payload (AgentTesla)", "value": "3e9f65687989d261641aaa480825a65e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959336, "uuid": "954e33fd-5eb0-4581-944d-bd60b3efcf41", "comment": "Malware payload (AgentTesla)", "value": "97a6f1686f456a126c4fd823b01df49814c71dbf4e2f3458ce9c62f89de17719", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959336, "uuid": "c895c900-5971-4144-9c55-1ea606b9a462", "comment": "Malware payload (AgentTesla)", "value": "33f7768cc266d66a3711da018120e8e609d72e07", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959336, "uuid": "36467937-b219-4a2b-900f-b6c1870d5eb5", "comment": "Malware payload (AgentTesla)", "value": "a29dee3181341242988664642a12f92df404db534559f794e8a1c8e47fd21e997b76c9effad2579a2adc9d0151c91b16", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959336, "uuid": "3f17745c-6cca-4120-98b8-721d0887e75c", "value": "T1B8D4126A7750727FC466893A89A02C68D722746B5327C303581764EDDA8E6CF8F50BF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959336, "uuid": "1f514efa-8fc8-460d-8503-276d3f4d5cb1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959336, "uuid": "6aedae01-31d4-4244-99df-8413fc7a5490", "value": "12288:4C/j23Q1cvCZv/2X1Fwp7G54mqW7m2vK63TsiSsgn7IR4UmE35Z2m:hL2kYC0bwFG57qKm363QiSsg7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697959336, "uuid": "d3455dbe-8960-4d84-8eae-7e2e02c1d6b0", "value": 647168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697959336, "uuid": "1fac1790-8884-4d0a-9c5a-78b0c972c661", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959336, "uuid": "fe193c8a-80c9-4fc3-bd7f-b1ea8af9f454", "value": "0004222284557-045845-0004-8743.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c8d4a4-70f8-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697992267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992267, "uuid": "2edf50c7-6365-4099-b766-825bd5bfaa87", "comment": "Malware payload (Amadey)", "value": "b6444d38209f6d34d287efd8866a89aa", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992267, "uuid": "e89275b6-9642-48d5-a231-19bbf59aed7f", "comment": "Malware payload (Amadey)", "value": "9851b53dfc46a8a6027df56d3438f4018387a7bc422293b58d9ed5c9f3e3d80a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992267, "uuid": "7e481c37-cdd2-4442-aa36-79cf7d3f8fd6", "comment": "Malware payload (Amadey)", "value": "7be961d24642e7ae98854752d9347e45069026d8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992267, "uuid": "06a92345-2a3f-472e-8796-22b20c627b10", "comment": "Malware payload (Amadey)", "value": "c875136ec8517a5415d028efb9d9ea5b462d816e529173f9f8a7744a300556052944b52639705d5a730dc7b9d336482f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992267, "uuid": "cdd0dc1c-eb9a-45e3-b189-6cd7ace34901", "value": "T1EF152212BAD48173D9B61B7099F903830D397EE58D3893573781AE6B0D326C4E6B2367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992267, "uuid": "6ee332e3-6819-4941-b59f-f79878bb0487", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992267, "uuid": "c8b87612-f1f9-409c-b398-42c627c10e6e", "value": "24576:4ywujjjv4By1vTycsph9NhkWFTb0B7GT7L1erq:/3L4ByepbNhk88EL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697992267, "uuid": "b6e161ae-12cc-404b-af6e-491792f9ae16", "value": 918016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697992267, "uuid": "dc01ef2b-8219-49b1-824b-09f50111505d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992267, "uuid": "ae256d56-a2bb-4fe2-ad4c-5911485dd52f", "value": "b6444d38209f6d34d287efd8866a89aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc97505-70af-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1697961164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961164, "uuid": "a5988416-6b76-47ea-85c2-adfc9309e9a1", "comment": "Malware payload (GuLoader)", "value": "7d3d363bd09bb19a991ef13cc44025a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961164, "uuid": "9e855a45-e594-43c2-a737-a98e171df369", "comment": "Malware payload (GuLoader)", "value": "993e1b4f6bc315d886eac30210d65a5463cf703178c8146225686d2784d85c83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961164, "uuid": "c33e1052-67a2-4698-99af-5e15daabb44e", "comment": "Malware payload (GuLoader)", "value": "52e86ff0705c9a4e53f8dee7d9d7ac6efe47e284", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961164, "uuid": "0b379aa2-346d-4b99-a69a-724f7ae01f32", "comment": "Malware payload (GuLoader)", "value": "0f4b807f346a0fe75ffe5928ed7e51d8edfd8134b6f407b1dd729cda38d8b513a4d45b60afa8575ab6d5ac4937fdab20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961164, "uuid": "6b0896a8-e7e1-4a4e-be98-0985811ab234", "value": "T1CEC533973889408BFAC2BB705ABFBA93053ECE57355092C77240A61537727C2DF9B642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961164, "uuid": "86439d44-dbd8-49e0-912d-a2427b499d5d", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961164, "uuid": "f4d64aa1-3b8f-4c0a-9ce7-543050a536d0", "value": "49152:/Bz1NUlQgPw1GVW2Uj0SY4a2O88TvVlcXzQgBh9PyfsZmnWelW:/BzDSR41GbUQoa2QTvV9gtPksZ42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697961164, "uuid": "0ecfc1e1-41d2-4b4e-aa2d-d6860303eb01", "value": 2550992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697961164, "uuid": "ae590564-539d-4572-b1a5-6798847156bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961164, "uuid": "59aeb8a6-4513-4252-b7e4-f2ee7babdd0d", "value": "7d3d363bd09bb19a991ef13cc44025a2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b2358e1-70d9-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697979040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697979040, "uuid": "c8e41776-8384-43d3-8550-7d09f6226606", "comment": "Malware payload (LummaStealer)", "value": "b1f7d94305e0f729964239a69bffe320", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697979040, "uuid": "f76f0d7f-61dc-4483-9290-d88f27bc4d03", "comment": "Malware payload (LummaStealer)", "value": "99bba4b98096259772dc0c12f0ebb3b3ff275f4babf75caa380e94e3dbed90c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697979040, "uuid": "98079a03-b8cf-4048-836b-be697239a7d5", "comment": "Malware payload (LummaStealer)", "value": "2fb02ffda0ce1fc5d719b9b79f2cdc2a0ead863a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697979040, "uuid": "5b5588e4-c553-4a42-a595-35fa4367cc90", "comment": "Malware payload (LummaStealer)", "value": "9fb118421a35a371a95f6a72e5263e2aeeb019f4cd50c370bcde55e89ebbaddbf2a1b28cad2f63b096c6d75d1b1d9b00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697979040, "uuid": "697e0643-46f8-49d2-852f-248136dea8b5", "value": "T17EB4AE15B9C280F1D823283105B9E7765E78B931C9768DCFF7D42C38EA35680962A77E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697979040, "uuid": "ff71c459-5d7e-4112-82d5-a8e7217dcb15", "value": "a3147c283328ddee0b7c7c6e4695dd00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697979040, "uuid": "d2d72d32-cd13-4391-8407-837f9fdcac6d", "value": "12288:VFTTWyVmRw8r6+y3QqBZAnYanJ252Wjx1ZP2BJ4iP:VFxVn8m+y3QqBZ6RK11Zw4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697979040, "uuid": "972c8e02-f042-400f-8c36-490458404efe", "value": 513024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697979040, "uuid": "10741d78-d9a4-4816-93fa-8b068a1320a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697979040, "uuid": "c9f3d98a-1c7c-4d70-8356-a8dbcdee1e6f", "value": "b1f7d94305e0f729964239a69bffe320.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcdfab31-7093-11ee-8907-42010a9c0042", "comment": "Malware payload (Tofsee)", "timestamp": 1697949140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697949140, "uuid": "fc4161f1-1948-4f75-97cf-deddc04b4a93", "comment": "Malware payload (Tofsee)", "value": "7698756a580ce0b3b9613c335e27cada", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697949140, "uuid": "6e3bda26-e4a6-47e0-8f90-6fbf15bb42fc", "comment": "Malware payload (Tofsee)", "value": "9bad9302b0cc691705349e6b282c5243eb80e7fb6daa766ccc9bbc2a47f764c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697949140, "uuid": "fb5c5f29-4c39-4ab4-b57e-480c6c639e08", "comment": "Malware payload (Tofsee)", "value": "b0dc89681b45f14c4ac53b78fde4b2cde884b44e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697949140, "uuid": "9f7e94ca-57d0-4c92-ad12-b8bb50c58989", "comment": "Malware payload (Tofsee)", "value": "2f5a795d33263ef38afeff53c4598b05f71f06ccd40c2ff568fff3a97235562c730b726b3881511daf34549bd61fda30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697949140, "uuid": "699f168a-c307-4a75-ade8-a36e431e7e32", "value": "T16D44BE21B7A0C836E46359350870CA651A37FCE2AA6541CB37983F7EAE712D19B71F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697949140, "uuid": "51a66afd-0134-4adf-8b00-ac5686a6cdb3", "value": "1a993c5a381c8e12968253c74a42dfae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697949140, "uuid": "d1a9d2fc-67aa-437f-8380-0c328947d3c4", "value": "3072:Hwn1BNbYJA8mq1BPcQPr0P0WV2kx/3T7pFNj/EV0u88Oct3aATTK7ROSJEq:Qb1OA891BbPY8WckxrFFJeOC3Je7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697949140, "uuid": "0f1207ed-d07a-4708-acd0-14caeb0058f2", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697949140, "uuid": "c322fd07-5733-41ce-b08d-628fe33a0e5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697949140, "uuid": "fbc2f128-3a6d-4c82-8141-0d6fa4d098f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23e3a506-712f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698015777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698015777, "uuid": "c4f07c00-77f9-406e-aa17-1f5af4854958", "comment": "Malware payload", "value": "d860115954d36fe32bdf282f58920d4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698015777, "uuid": "f5e7d051-7999-49ef-8b0d-1d563cc5c852", "comment": "Malware payload", "value": "9bb4d5e852f4f0e8dafc9fa5d996814b72fbf55fbc4c073b180256b253dd28fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698015777, "uuid": "f456e700-298d-4375-a046-acf9c359d1a9", "comment": "Malware payload", "value": "9debe32061f407ed9763fdde46baeef949cdbd6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698015777, "uuid": "b1b18832-8bd9-459f-9dfa-f4e477fa5cc8", "comment": "Malware payload", "value": "ec9280e1b5522ab16ee05fcafde53ed0fa0d7207ab78b9babddb5a74736e50ec3a54660758f02867e1bb0f5507153226", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698015777, "uuid": "f2432d2e-58ca-41b0-9eff-6c6fc73fbe75", "value": "T171853380BBE45073D96833B49DF302D316393E11963C521D13D7A5198E92AC8BABEF5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698015777, "uuid": "d9adbe05-44c7-44a8-b0db-6c58cfa29366", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698015777, "uuid": "e1264390-239c-4c70-bb08-f0d45e640a6b", "value": "24576:+yCl6y+0QBGvV1IzDRUCW7oSVbedySGCsSr00DyvAnwMy7FTfnPve7c+BYhzuu8W:NClZHQB2VWn6esayStzmsyh7PGmEhD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698015777, "uuid": "6dd5c067-2af2-4363-8659-fc99eedc01b2", "value": 1827328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698015777, "uuid": "cc7d1128-9a37-4c05-8a21-4bcdfbe058ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698015777, "uuid": "7e43e414-57cc-433b-8622-ed6944dfe112", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "094df462-70e0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697981802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981802, "uuid": "6d86f22f-3a87-410c-a514-b8eb09f88484", "comment": "Malware payload", "value": "b29acb5d430c1be85fd18e815bbd696e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981802, "uuid": "6fde6e47-bc91-47bc-a969-78e58340cabb", "comment": "Malware payload", "value": "9bf192b16e9394bbe64867e02a5c843e39fe82128769e03fad1a18ec742346f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981802, "uuid": "16f04de3-16fe-4584-841d-ff71e6159a51", "comment": "Malware payload", "value": "9aa3f461b40f23f0f48739f7729ebc7311b0e60b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981802, "uuid": "4fe47293-32da-4488-a9c5-71727535eafd", "comment": "Malware payload", "value": "5a738d4c9ccd25cbd823d6e8281ecf4f45cc1f6ad6b1e6c8d6dbe39797252d682c99f1db1829f154237478c9d1158978", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697981802, "uuid": "e9c0b030-57ca-40e1-a742-e10b05670dc5", "value": "T1F4C2C799578E89B4CB98B2738124088D65FCF33E735621F578AC627037BDA0D0EB52B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697981802, "uuid": "fc332096-6220-42e5-8c5a-11901733a9d7", "value": "384:BTn50Inuk0zwq9baZdJTxNpW11AdJUZramSwkK06B4lDeey+6h:d50IL5gOZdTNOAnUdaCkK06B4IcM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697981802, "uuid": "b1758a76-4ae3-400b-b3bc-0655534985d5", "value": 27298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697981802, "uuid": "7861073b-5474-4576-b79b-49748c79323c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697981802, "uuid": "d0007772-998e-44c4-b399-b0361ac784a8", "value": "d4ba8b7cb03a2cb7275ff5b562b9c865aa06e1599dae8f493ae5ed2b.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4775a9d0-70aa-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697958714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958714, "uuid": "02b95083-b479-4ad1-be6f-476fc0fe5b23", "comment": "Malware payload (RedLineStealer)", "value": "bffa5e718cb7d6b3fc76eb63b4300917", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958714, "uuid": "1e0760fd-3321-4faa-88f2-d35a743711f4", "comment": "Malware payload (RedLineStealer)", "value": "9bf6e006434c6458cfa518e356f3055ba7c8d79a6d77a7f9f93d003675917d75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958714, "uuid": "7893b6fb-2c9e-4a30-906e-ad828baadfd2", "comment": "Malware payload (RedLineStealer)", "value": "4e368f02f92b66938c078a962b32684059ae0d4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958714, "uuid": "3c2385a2-3a9e-4430-b217-3350c49f7f16", "comment": "Malware payload (RedLineStealer)", "value": "51e3772f17485c94c13e349315fdad16e82bce5ff9d01dae5945e5f6c07c82f425b52a985822a4ca0f82bdd369baa4a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958714, "uuid": "fd6d652d-0c32-43b3-8b41-431bdbb9267e", "value": "T13D752367D6EC5433D8F1637419F107A30B3E7CE59A3883272A49B1C219B2665B87236F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958714, "uuid": "249cadbd-c738-4761-a237-0eefc6849f1a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958714, "uuid": "b5ee1d6c-1175-410d-ab24-a48d03697842", "value": "24576:TyjrJLxNYMyy+T3zQQBTSJGj6+s/mkXy0k9RkVuuDl40sPQHBq6y:mjHaMaVTS4j6i+HVuA7sPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697958714, "uuid": "37e3a9bd-05aa-48eb-9c2b-40ac130aceff", "value": 1555456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697958714, "uuid": "c37f589d-1744-469f-8fed-107228a424c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958714, "uuid": "895a200a-e0ea-4251-9df3-01a0a8ea1b4c", "value": "bffa5e718cb7d6b3fc76eb63b4300917.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08aab30d-70d6-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1697977506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977506, "uuid": "4acf105b-8b81-49e1-924d-6335c3ac3176", "comment": "Malware payload (Gafgyt)", "value": "de3bdf7e4bbf2f55263bb6976b20b5be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977506, "uuid": "8f136f41-df7f-4b31-8cf3-6c9e6056f87e", "comment": "Malware payload (Gafgyt)", "value": "9c08487094c02b70fdca7e13542490d8f26c0aa95a26fe05dfff27cc25da7d12", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977506, "uuid": "60e9dc5d-1f8a-4880-8552-d748e1aa034c", "comment": "Malware payload (Gafgyt)", "value": "73c715f02e6bf1b0f26e32a1376b722d84c38eeb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977506, "uuid": "0d4329e9-f55a-4078-aa1a-aae0dedb0a29", "comment": "Malware payload (Gafgyt)", "value": "d3d122b88f800348a15d67f2053077aeb3e1736e78f21531f7021294a9bd4e8c03a0edfd7c53b77bfdae4a38bff3d101", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697977506, "uuid": "d529362a-c599-4cd8-b1f0-39f57005ef08", "value": "T101B308F1E602CAB3C44306F202A7DA7B5D21BEB70A2A5A85E31C3DB49F338C57551B59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697977506, "uuid": "084a94a9-1d97-4c20-8b82-7d4674d114fa", "value": "3072:0Gtk0JeaJyG3AF0nbgChZes7q7oCkmOXBmIpcks6JyfMT:NkyeO0C8Ch84BmIpcks6JyfMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697977506, "uuid": "9ffaa367-c223-41c9-89d9-cd17f3f26768", "value": 112051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697977506, "uuid": "b60391d9-9853-443d-abc5-1d49f2bc31b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697977506, "uuid": "c5b4b942-50a6-4645-9ace-860a633cab79", "value": "de3bdf7e4bbf2f55263bb6976b20b5be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3bf7c89-70b6-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697964022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697964022, "uuid": "5b12877d-5927-4be1-b81a-af88f3841a7d", "comment": "Malware payload (Formbook)", "value": "a94053ce5a28e7a0af4b19a7d86d3bdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697964022, "uuid": "c6ea7737-55bd-4ed3-abbf-f5bce60a724d", "comment": "Malware payload (Formbook)", "value": "9c7fd9118c667663ed8834d11c9a3f840602c9ce5f30f904b9cdd7b8cfa1bbb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697964022, "uuid": "79384eef-2dba-44e0-bd2e-62b5c39645ca", "comment": "Malware payload (Formbook)", "value": "9606b92b3d1eb8068566fb311875aa3c621dbaa1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697964022, "uuid": "c75b52b5-a87e-4de0-aea7-3946f56b6bc5", "comment": "Malware payload (Formbook)", "value": "1a01d06f475f5a984d5131b8c16d1386a5d150492cab138d18ea6719ba31b3e7083d556ca307c5793cb3b15339e88371", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697964022, "uuid": "07ea8aef-92a8-470d-94b2-ea0f1868c398", "value": "T1ADB41251DBE98073EDB41BF018FA52D30A36FC619A7982BB338269591C336A4D931737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697964022, "uuid": "138077c8-42cb-493c-b9bf-fcf2cc4eb96e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697964022, "uuid": "8787764f-a754-4ba4-9934-de9524557fda", "value": "12288:5Mr1y90RpSAqeofcSHpBg0PzkQfhm8ZStnQKWceSUfd:gy+p1ofcYpiQkQfpZStnQKWcbUfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697964022, "uuid": "b1bdb0b0-5263-4656-a8f6-c83187ac3725", "value": 521728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697964022, "uuid": "f8a507bb-8d10-4d99-8ec2-33b4d2196c1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697964022, "uuid": "f647dfbd-af8b-46d3-9e4b-82f0948d873c", "value": "A94053CE5A28E7A0AF4B19A7D86D3BDC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91285dcf-70a9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697958408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958408, "uuid": "7fa8eae7-5ad7-4daf-bd4a-3508acb5b4de", "comment": "Malware payload", "value": "2cae8d4f94a171cc33f8d76fa4132a6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958408, "uuid": "2d378bcb-7e02-4262-8cf0-4b7de812c1e6", "comment": "Malware payload", "value": "9ce2bd4155131a6576c844b3cb7867ada4a78feaaa3dca598116d563bd727be7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958408, "uuid": "3e2eed55-6de6-4b13-a241-c3b917bb5981", "comment": "Malware payload", "value": "3a218db844f25eae0898e2cc283a50f5f2b7121c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958408, "uuid": "7b45dbcd-c02a-4325-b396-cd7b0e250701", "comment": "Malware payload", "value": "f15362734d0baa2efb3132682f87fa11e55ae30798acc9dff862ace5d74760b3b7d9bfefd62b4796794513146581d37e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958408, "uuid": "ac425f60-1bd2-4689-9edf-f8a8d7b269ab", "value": "T160252343E4A0615DF0F602FADCB78B682675AE252F4445CB63F2689BE24C5C6BD70633", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958408, "uuid": "93dddb76-7cb5-49ec-aa65-e1b7397c23ed", "value": "f22da609299ca6c90da88f21224847f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958408, "uuid": "94db300e-fe59-405b-9e77-9d000f0d4903", "value": "24576:e7q5r+SvOmM8vfiBTILREPK8KT6MRpYNYqD:Rr+ShNimMmT6gYq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697958408, "uuid": "2900f6cb-aefc-400a-a3a2-953cd7af8429", "value": 965120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697958408, "uuid": "3cf93185-9e54-40e4-9a0b-f5e44fd37099", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958408, "uuid": "c4cfb98f-f795-4797-8c6e-4e898e58b2d2", "value": "2cae8d4f94a171cc33f8d76fa4132a6b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa5c4d4b-7104-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697997668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997668, "uuid": "521da459-5e88-4a90-87fe-e925f63e4bd6", "comment": "Malware payload (AgentTesla)", "value": "159222a58708ddfeca4e00c5cd18f16e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997668, "uuid": "8689f126-b0ce-4196-bb35-6d94f5fea73b", "comment": "Malware payload (AgentTesla)", "value": "9cfd44aa5c831620e82f8545aeb3d0e1ec0e7b6d1027617561d5d25d35634fc8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997668, "uuid": "e66e17e3-6779-4e35-9078-21d3559d0151", "comment": "Malware payload (AgentTesla)", "value": "6cb1ae0a46c77e55379a673e856e52ef6e2ad87a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997668, "uuid": "2fa6e8a9-f414-4654-852e-2749a1a9f1be", "comment": "Malware payload (AgentTesla)", "value": "9db9c2c5dd1a55e78b227721781b14eba7117e7d2c13897e63f36468377ecd1ee875aa20573e9e0fbadf9106b3a9ddec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997668, "uuid": "22f02ef8-0db8-4e00-97e6-8cd9fb3cb55b", "value": "T19205DF117EE60F84E1F7C7F80C958D384B6D74EB1431E62D3E8AA1DE1965B408E09A6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997668, "uuid": "36940108-cbc8-4d22-a01f-7a455e8cb190", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997668, "uuid": "b189016a-15fd-4636-8b8f-079d878a95f3", "value": "12288:5KEyiRJU/Wck63ZmYGYW1jbHJbFuAb3O9/YyUWYzx8vjwPA6/ppkT6:gzFeKJmYGYW1jB4Ab+hUHcjj6/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697997668, "uuid": "16996ed1-1af8-4eed-83f2-5ed51fe4d8e0", "value": 800768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697997668, "uuid": "20d139b8-4c7a-447e-a6a1-a1e270988f4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997668, "uuid": "7dbead13-b5a7-4a6c-809e-960e1f5dc287", "value": "41570002689_20220814_05352297_HesapOzeti.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b32f38c1-70ab-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697959324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959324, "uuid": "cb0930a6-c269-425a-83f2-4394cec85582", "comment": "Malware payload (Formbook)", "value": "c1feb44ae338eb00dbe923fd56d5a18a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959324, "uuid": "434d009f-c42d-4614-bb6f-8e4ca2200550", "comment": "Malware payload (Formbook)", "value": "9d507d3f7b58d898ff10eb7443b6feb32ea2ea6972d3ceafa67e2e0a1d0504fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959324, "uuid": "5d270b98-8f0f-4c8e-81e7-efab3005cb1f", "comment": "Malware payload (Formbook)", "value": "26e1bc57820890dff65966d74f66019403fadcdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959324, "uuid": "64815d8f-e33b-42bc-9b61-3d64c4ced0e5", "comment": "Malware payload (Formbook)", "value": "ddc543c8e2df59aed908d4ea90e59855518853de2acfa4e9929cf9c746af014bff5080f85753d0c0fc9a58b4846a348b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959324, "uuid": "6d2a03e2-637e-4b30-88a7-df5433f7957d", "value": "T167C412A43790B5BEC87B8576C9F46C109721787BA32BC207A467255DCA4E69BCF006F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959324, "uuid": "7e481693-0eb7-40c5-a487-66572aedb94a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959324, "uuid": "5f100a86-6b85-4650-b00b-5ee9e33c9640", "value": "12288:E/jNu5VoGUpQCYaSm2KuJPkoF+KUr94xsJwQZG588YrX10/4:ELNu5Vo2CYaRBuJPkoUpp4s85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697959324, "uuid": "91f92fb4-93ed-4037-9b43-b87cab4a98ce", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697959324, "uuid": "3ab7c2cf-6963-45d2-881a-ec0f6073d390", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959324, "uuid": "f96d1984-02e0-41f1-ba6a-38abb89c8f42", "value": "Overdue payment settled.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9be51343-70f9-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697992785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992785, "uuid": "8b90ff43-a446-4ccb-9666-7e072649fa83", "comment": "Malware payload (AgentTesla)", "value": "f4a3d9404ad522ec1b9bd8feb8dca3b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992785, "uuid": "fc214d8c-1ad3-45ca-b729-008e8c713203", "comment": "Malware payload (AgentTesla)", "value": "9d737c768d419aed55de299a114fb8b4928d263320caa4b35c08f4c0bb3fcb88", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992785, "uuid": "09ce999c-47d3-4966-94d8-df795faeb381", "comment": "Malware payload (AgentTesla)", "value": "33201170d62419689b5685b22325512c27ca16ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992785, "uuid": "9315eaa8-63b2-457a-b4e3-4dd13cb00167", "comment": "Malware payload (AgentTesla)", "value": "83b8eeaecc46b70ee9c831210c891fd929b03e18ceafe3e4a1e98780bf4f40967fa193ea247c5d49006e06cc1ad7a214", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992785, "uuid": "dde3facd-4ca1-44e9-8f3b-5f665e91fd47", "value": "T1ECB40143772FAB25C4AD04B101EF619463B196CB2137C5C76ECE26EC1951BA37E8278E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992785, "uuid": "30825a49-16f4-40d3-b646-dff16687a093", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992785, "uuid": "84c8f3fd-ddef-4914-b5fd-dea37cdf814a", "value": "6144:8zAOLe5C9/l3Iv3hlwJYrCp5+kP/af/9jwlYj4ixSP7PtcaZuSrg6n2i3UMyoQTk:8zxICbojRxEceusRn1EvQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697992785, "uuid": "6a2301d0-fc5d-4fff-b8d7-6b5ea9988a61", "value": 514560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697992785, "uuid": "ebf1c5a3-f23b-4cbc-b76c-1e76404e1a26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992785, "uuid": "c9a3da95-d802-4336-ac9d-bbb985f66129", "value": "SecuriteInfo.com.BackDoor.Quasar.1.1234.11747", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e82e4b04-7104-11ee-8907-42010a9c0042", "comment": "Malware payload (DarkCloud)", "timestamp": 1697997638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997638, "uuid": "fa722029-9904-4977-9408-3b7521c53f64", "comment": "Malware payload (DarkCloud)", "value": "10033202b9c1b77bf86ff13f1570674c", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997638, "uuid": "d6848739-e358-40f4-bf98-3d76c7f8da4f", "comment": "Malware payload (DarkCloud)", "value": "9d763631621a69ef9d4ff7372b23fc85b8616ed4937f0f14aa302e8e7156c96e", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997638, "uuid": "684211fe-cab9-41fa-b84a-93c178a6134f", "comment": "Malware payload (DarkCloud)", "value": "ea45e6f94857282574db0e51421e63d5a88bebc5", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997638, "uuid": "de310e2b-fe81-492e-9281-c22ec1d44265", "comment": "Malware payload (DarkCloud)", "value": "f0b390ace21d4ae740638624be6cdb4ae8c5f7df520602cff207b4fb26eed7cb12f8bc20fb6e8eae7a997463d5e579c1", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997638, "uuid": "32e1fd80-4a86-4041-a8f7-ccebddf5bf96", "value": "T1003512027AC198B3D473193369746B20AA7CBC204BA9CEDF57D14A2DDA715D0DB31BB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997638, "uuid": "fbe521e9-93d2-4dc3-b578-547904ffb7cf", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997638, "uuid": "e5557110-95ac-4ade-9da9-6ed2f930f2b9", "value": "24576:NTbBv5rUanI1NM1C9AoNbg0hBGa6mXcqIAXiAQFSDxjD:HBjIM1CdbxOLAXiAVh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697997638, "uuid": "9ed33ed7-32cf-47a0-9c91-e1fdb148c52e", "value": 1162039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697997638, "uuid": "6c21fff7-e245-4708-af31-692dd0248bca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997638, "uuid": "05c30a1c-0933-4bf7-ad23-0e168a177e21", "value": "new order inquire #2308.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69713416-70b0-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697961348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961348, "uuid": "8d123fae-2f4e-4251-90b7-9a0b12d9bcd0", "comment": "Malware payload (AgentTesla)", "value": "d73ba5b5cebaa9ac231e860174583591", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961348, "uuid": "4f53c0b3-f2d3-4bc5-876c-23d722a9c400", "comment": "Malware payload (AgentTesla)", "value": "9d8327b7bf8c96003f662f3ed5f94b52ae680ef06d7e24085177086d984fdd9b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961348, "uuid": "4f37095e-e696-4093-ac6c-974c08b9091a", "comment": "Malware payload (AgentTesla)", "value": "6115ca2a9c9ed84a29fdf6552d3027dbe68f1ecc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961348, "uuid": "b3047dc0-2ced-4686-958c-264bdcafb203", "comment": "Malware payload (AgentTesla)", "value": "961eb957012409f8709144861ef1f0f8391d203be5296d4d8b434ff0147f63b93a49ab0d81c3361ca324d1beec4ddcd7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961348, "uuid": "00157642-34cd-407a-a853-42f6d6fbeccd", "value": "T158740B1079FF9508B1B37F531FD9B5F68E6FF7A2162A606E2048430A8762E84CD91772", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961348, "uuid": "9afd4e52-8fb2-479b-a762-27e7e8e2e47f", "value": "6144:3DO4DlDzDGDFDSDU1WagD0D0DEpDxDvUDQD0viDBD9DbVD4iD6sa/D0DEpDxDvUB:TOMBXih2U1WaEQQ+Vo00vGlpbx4G6sa8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697961348, "uuid": "44067a78-6265-483f-ab18-5c756db4810f", "value": 347206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697961348, "uuid": "9aa93f9d-5d52-4a8d-9337-404bf27a69fa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961348, "uuid": "5922aff5-77ed-4bf1-8ada-049228a6082c", "value": "ORIGINAL SHIPPING DOCUMENTS 102020230 PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da3e1ef-70b1-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697961704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961704, "uuid": "ed190f67-df9e-4abf-b9db-08c023ffffb7", "comment": "Malware payload (AgentTesla)", "value": "56506eca94fc2265ed1e1cac574a3396", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961704, "uuid": "82b0356c-1f86-41f4-9f49-91c993e4186a", "comment": "Malware payload (AgentTesla)", "value": "9dc3ae76e486e42a37e14a3097fa056b5b85d037bf0d00c400330b514059ed84", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961704, "uuid": "53a4ebe0-c745-4245-9e21-61ad79fc0c5b", "comment": "Malware payload (AgentTesla)", "value": "b6c54d272ad01cf43752d54a55798353f9172f54", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961704, "uuid": "7cc2874d-2564-4511-b9d9-45916b8db119", "comment": "Malware payload (AgentTesla)", "value": "fe04ece3a19eb422ee84b8caf0293723475324c35c84dda140f1d67a109849793ad994ef63a942d844b081540f33fdac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961704, "uuid": "44283223-b5f2-4982-bf82-18291a8623d7", "value": "T10EF4E09D3250B6DFC41BC9768A646CA0E6617977870BD253A41322ECEE5EA87CF140F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961704, "uuid": "341b57e1-3412-4902-ac56-d868f8f08946", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961704, "uuid": "c07842c1-7841-49d4-b89c-98e542a10c08", "value": "12288:4K40b5yzvbYmBHQeb8P2+g1Xwd/70oJUUWwMxxmoOBij33g71l9CLXLJaOJITKo5:BebY0RbsAo/70HU2bWBijn21l9CLbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697961704, "uuid": "1c3d8a18-c234-45d1-be04-8e60d645203e", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697961704, "uuid": "40197360-6904-4ca2-9c85-33e10d780e03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961704, "uuid": "8fcf515a-ded5-4575-b979-59de8e5274c2", "value": "INQ2981PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0941161-709e-11ee-8907-42010a9c0042", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1697953843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697953843, "uuid": "b41b149a-4792-4c49-8445-6c8ea7b4f901", "comment": "Malware payload (AveMariaRAT)", "value": "8432425978e727c66f9b64aeccb91813", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697953843, "uuid": "8729ac9f-4b03-4b32-acdf-8be4afaa4e4d", "comment": "Malware payload (AveMariaRAT)", "value": "9fdbb6b777179115ce7a04af0ee68cc60dc5ed033279698043fc8519aef7fee6", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697953843, "uuid": "e6db1588-f4f4-46cd-b35a-87b2573c89cf", "comment": "Malware payload (AveMariaRAT)", "value": "b671daf56dcd589dfb15c548178d0ff8dba9e974", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697953843, "uuid": "239b1ef0-f772-4127-9b68-b68c1e6d402e", "comment": "Malware payload (AveMariaRAT)", "value": "a5b5d5e51ec26053c9a3c05139952811cb9b7338d811d1598d1c9b58af6bd0d7b7c01926c854f851d79147f975a49803", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697953843, "uuid": "b581082d-2ec5-43a6-8f00-86be5d845a94", "value": "T158153C3D29BD2237C1A9C6B9CFE5C827F000D86F3461AD6598D797A64347A8635C323E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697953843, "uuid": "890ef737-b8f4-422f-8efd-f264ca8bf75b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697953843, "uuid": "78354415-b220-4780-b0fe-30284e12425e", "value": "12288:xSnyZBD5qwkxA+2YDkOijckB4vJTMmigv4jjEQ73:4yzlkxA+24kBok8JTf83", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697953843, "uuid": "9daa01b3-a45d-4a00-87df-c7bfef2ab077", "value": 890880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697953843, "uuid": "59e61b06-4545-4737-af1c-8a0de47ae5aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697953843, "uuid": "aa88f37e-ccd1-41eb-a2e0-39a62f451c31", "value": "8432425978E727C66F9B64AECCB91813.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf120d3-70aa-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697958964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958964, "uuid": "30a0a66e-c771-4b39-8962-ac0ef3fc75a8", "comment": "Malware payload (Formbook)", "value": "00fd4d2c65c750f7b8c1d3c01ca1971d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958964, "uuid": "6bd0d74a-d7b9-40f0-b75d-80fac11ca8bd", "comment": "Malware payload (Formbook)", "value": "a00ea565f9db4d7b4eeef36c77c6635a84ef610ad73890a2b0bd9852ff6d73f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958964, "uuid": "b2fc9c6c-36af-497b-88c6-ab7659de796c", "comment": "Malware payload (Formbook)", "value": "9948ab44fcf59db07b020c54af3f957c9d4a4cd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958964, "uuid": "6052cbdc-e462-4f71-a0f0-65eb50f757b7", "comment": "Malware payload (Formbook)", "value": "796f7417c00f7e942fe85b60dc7e44a01a92302fcc85b8e401cc3c36b5e10c02d9915df4987c2ef797f524cef0b01744", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958964, "uuid": "f8c2de4f-a75e-4b4d-ba36-6dc33265e37e", "value": "T101D4025672E48533CB7E5FB8DD611212A6B16D3A5E22D28FDEC830DA049EF344621BD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958964, "uuid": "886498fd-b0d5-4cde-903c-ad23c09222b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958964, "uuid": "37f363fb-cf15-4ffd-95c4-c58d44463c56", "value": "12288:IjTB7s9DwY5hq+BqBkUkdVz4BygljeHaDKvjx/TzwXGKimdXv:KB7s9DdhvqRkXENNDKvjx/TzwXfii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697958964, "uuid": "f4ffa2b3-3d06-435f-ae81-4a714eb6b649", "value": 651264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697958964, "uuid": "c507174b-db9b-4906-bd27-5ba70545569e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958964, "uuid": "f60b78ad-cdfd-487c-a904-7075a9f8d981", "value": "Hgh7WMRLzKPX09P.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c3c96db-70b1-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697961701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961701, "uuid": "89d1318a-b8af-4c6f-a851-5a9a54bc3bf1", "comment": "Malware payload (AgentTesla)", "value": "af04a2a91884bea8d5f665b3fe72100e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961701, "uuid": "5fadabff-aa6a-47cb-90c0-41494f8afaf4", "comment": "Malware payload (AgentTesla)", "value": "a280b75f6227e4f3268eaddf806649b9a34fcb0055e8986123560484a315bdc1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961701, "uuid": "cbb557b8-6373-41bc-943e-09cf46737d59", "comment": "Malware payload (AgentTesla)", "value": "50fb466cf3485ad02d0f4a81eddfa7e4c01c699f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961701, "uuid": "505e6f74-8d7b-426d-877e-fdc2ba8625c5", "comment": "Malware payload (AgentTesla)", "value": "4751125654b34fd3ef846ceb6fd38a1c5875c4c707f10e2b224f82ce42382b05f5acd37df129c7f66cccbff8d334fb17", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961701, "uuid": "57093750-6572-4104-bbb5-37a5f02f5623", "value": "T17BE4234776A48773C24D4BBA4121D5C457B22F362308DBDBDD8071EE63B6741AE28A2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961701, "uuid": "c31dd61f-305f-4003-9e05-d94246610cc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961701, "uuid": "eaca3f4e-25bc-427d-b940-7ccf7440c86f", "value": "12288:Kcb5yzvbYmBHHR/Axy1IZhXFG2RuUAr2WDzAOqxn+WkYs3gvQFfDd0bX0kNhkjRw:BebY0nuxZhXzRuUAPzANn+WkYTYFZgkL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697961701, "uuid": "802d87f0-1224-45ae-80ac-d987ddd58db7", "value": 706560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697961701, "uuid": "868f8075-3420-4495-9578-509771c50ceb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961701, "uuid": "86cf4a51-4b9d-48f9-9f2a-31b7d449248b", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84b58c5d-7080-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697940777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697940777, "uuid": "7d4450f7-4bcf-4792-968d-5a9f04cc18d5", "comment": "Malware payload (RedLineStealer)", "value": "f64ea3d22ca11be47b4ca74afddc5aff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697940777, "uuid": "07416191-e0c9-4a44-8d85-d74bd47afd59", "comment": "Malware payload (RedLineStealer)", "value": "a282279cae8bbab206e846873d7340eca18d48f21dee5aecf21cf7df15261235", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697940777, "uuid": "f5290f93-a5d0-403f-a314-31aba3ce589f", "comment": "Malware payload (RedLineStealer)", "value": "21f3bf5b070398a6045cf3da2092c412fa0158ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697940777, "uuid": "77264811-8494-496d-aa4e-9a758b219b48", "comment": "Malware payload (RedLineStealer)", "value": "5bfc9015801f2b6385ddf62ec040c3f45ff4dfb4a3addd23dd4c75a33860a91ef6f2b2ebf66b7218db0d888b7c2eac3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697940777, "uuid": "15e671d8-a5b6-4892-9e49-31c835caa916", "value": "T19265235676D44033E6F167B465FA028706353EA49B78271B2F9BEC4A1CB38C861B3727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697940777, "uuid": "ac6ea089-9d8e-4b00-a24b-161d9f0f335d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697940777, "uuid": "a17277d0-51d0-414e-a667-802b298162c4", "value": "24576:EyONgjWMZhAd1HKhdhV41/uWGFZOVqAB4jE7YPY3PNDgblmpV902yAELYSLcDb:TOiWb7HK1V/jOkQ4juYPsaMELY4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697940777, "uuid": "9db0912a-d496-4c1c-9be9-f05272c78174", "value": 1495552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697940777, "uuid": "b9a1feea-f613-43c6-94e4-9e26131ae6da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697940777, "uuid": "68c49fd4-dbf9-4c58-9597-9722deef3afb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f65fa338-7104-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697997662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997662, "uuid": "bcdce2fc-b112-411d-9633-f196793d77fc", "comment": "Malware payload (AgentTesla)", "value": "feee693a591038becbebc69769a568ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997662, "uuid": "1918c24e-d830-4b03-b7a3-1e647430afa2", "comment": "Malware payload (AgentTesla)", "value": "a2bbf96b978ab51b3ae03e3b3ce769d559727331a2654ba3dfa91bc992c05094", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997662, "uuid": "12d5781f-97e4-495d-9eba-7917932cf3ca", "comment": "Malware payload (AgentTesla)", "value": "de120b8cb7fea9457e8d6ae72647e44c80ddf49f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997662, "uuid": "15058f17-6c8a-42d6-8f3c-b8c938e40ec4", "comment": "Malware payload (AgentTesla)", "value": "61baac7fdaaec1fe1b6569bd392243be49a4d1b6423e26095e2e28393e363034170a385a697c533080dd3760ddb6f83d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997662, "uuid": "d1a78c06-d9d2-4ea7-8662-e379c14a51ec", "value": "T11905E0527EEA8D55C0FBC17D4DD89C780E2A39DB1430C67E358DE1AE1BA27410E0AB5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997662, "uuid": "ffebe7fd-5686-49c5-923c-97ddb332607b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997662, "uuid": "a56842ad-2dc9-4d51-ba3f-c6cd03ce5b8e", "value": "12288:nh0WWObWwpW28JeoGNsB3o1ON8Q7XnziL1e40LbI7AdZQZlltfJoreRU5vUubl:u4RA2M3GKBxm0EsQZErmU5Fbl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697997662, "uuid": "87babcdd-24af-4b79-8940-a9bfa681c595", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697997662, "uuid": "ecb8f3ba-e60d-4bae-bcd9-a6799d0348e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997662, "uuid": "8add24d0-63f1-44c0-b513-49cce2fb2431", "value": "UPS2022000212223 Nolu Fatura Bilgisi ve Detay.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c477fe1b-70bc-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697966654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697966654, "uuid": "01b20918-80fc-46df-8133-3e150f1b2b1e", "comment": "Malware payload (Amadey)", "value": "325538859e5bd0b0501643712a2b1a57", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697966654, "uuid": "d36d3d11-32c9-4030-8a88-bd2e64edee51", "comment": "Malware payload (Amadey)", "value": "a3d7658ee9f6acec397b715055713947eb750bd2c8ad87c2041bb2cf57a4d6a4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697966654, "uuid": "9408f287-a22e-46b8-b850-16ed9083d97d", "comment": "Malware payload (Amadey)", "value": "9e40708994db0b3c875646698b8e060014e30e4e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697966654, "uuid": "ee059b37-a026-467f-951a-7fd2729a3d98", "comment": "Malware payload (Amadey)", "value": "4689550e68ef997c73cb46262c511da917253d90f62ae2b89cbfab64f6ffe86dfd116dddb11956c9cb940fe2a983719d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697966654, "uuid": "38904354-8398-4f80-8055-f859fd3073db", "value": "T121652343B6D45576EAB317B481F903832138BCD6DA31135A3BD2998D2DB2AC1797833B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697966654, "uuid": "1e6ebcc3-9546-40c8-849f-6d8f14857294", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697966654, "uuid": "98edcbcf-af27-4b26-824a-f05210043700", "value": "24576:KyK2UuYQ3SkdhgYe3SfBuYtpOt+AEYvcUHC9Qf/0XVSl4ANa1H2:RK22bmuQBuYjOU3YESf/0geAE1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697966654, "uuid": "ffde4278-9646-4a3b-96f6-6527a70881c1", "value": 1486848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697966654, "uuid": "128f244d-5176-42c3-b88a-bf56dd76f574", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697966654, "uuid": "0993e948-1845-4249-9fa9-ea4478955d1a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daebfc58-70ad-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697960249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960249, "uuid": "4e9afcda-2d58-4e9e-8e7f-4f4c9ec51845", "comment": "Malware payload (Formbook)", "value": "03ba07ae9665412a170bbe06dd55d724", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960249, "uuid": "13f3b5cb-041b-4911-b4a5-b88a968be1c7", "comment": "Malware payload (Formbook)", "value": "a40c92a00ca0f04cd04883d555859cf2c8e884a01329defd3631c7cc61204ff8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960249, "uuid": "d024a507-83c8-4987-a7aa-1bc51cd4e71a", "comment": "Malware payload (Formbook)", "value": "060461b26a84d0db8609404c5f1c7977b3b5a7d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960249, "uuid": "17de27db-6cc5-425b-96ec-7b51af61022d", "comment": "Malware payload (Formbook)", "value": "44826d3443fce3cd2a700063beee3023d21cecc7066fc311907c71f5170b636ac9c8724ca2b1c83d01a0e9fc26eaccf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960249, "uuid": "816407fd-fbb2-4b70-a9d6-3e0df6b61573", "value": "T115D4121872B8490BD7A88AB0283583954B7A0E572623F75C7DD6B5DF1DF7F884211B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960249, "uuid": "89df6e83-f23b-4282-9a0f-2b105d96ffa5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960249, "uuid": "4f337c45-9e23-4232-809f-6581833921cc", "value": "12288:L8zS55mFzy6+NeUKIDG96nhL2Gq89z/s9lVgkVsWjb/5lojH:Lf55qCNeQa0u89TKlVgcjb8jH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697960249, "uuid": "a07203a8-b697-493c-9e66-0f45af7ea534", "value": 605696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697960249, "uuid": "825b8fee-1914-440a-910f-e41f9304b7b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960249, "uuid": "1678d994-9de0-4fad-b4e1-503af736f4c4", "value": "BOQ- AE200073490.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd7cceeb-70aa-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697958938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958938, "uuid": "2fa03597-1863-4f1c-8ba5-4bd67b8bcd61", "comment": "Malware payload (AgentTesla)", "value": "c44ae249835144e1c6dd5cb25e22fb77", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958938, "uuid": "abf6c15f-dfa3-4a7d-819b-ffe4b023413e", "comment": "Malware payload (AgentTesla)", "value": "a4fb4655a4df0927d8def8fa7e8a0f498fffbdb61858057619482bbbb4f5de8d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958938, "uuid": "fc90c064-75e6-4f3f-af2a-f3f374ca09cc", "comment": "Malware payload (AgentTesla)", "value": "d3f43ebda8942e34877b8b0ec7abc57929e9279b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958938, "uuid": "c4bdfe3e-4465-480c-b13a-56d5cc471345", "comment": "Malware payload (AgentTesla)", "value": "d7ada1712802554f4293f5953c8fd3513b2289decb85178407a83eb552686f1eb438fdad2d14d6973d9519112a8e2ec7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958938, "uuid": "1383ac4d-ba48-4d59-8ace-1e6f8c4d8997", "value": "T188E4120572AC4D23DBB60F789E633421A7F46E6A2925C28BDEC421C946DFF345124BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958938, "uuid": "e3256255-04bd-4675-abda-91f6f275e394", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958938, "uuid": "62bfd916-56cb-4768-b950-e1ce0a6264c0", "value": "12288:52/Z7s9OCfOG14GpxrK7e9fMR95igfW58/omcg2TGlUvGR+H3bVevwS:s/Z7s9OsOjAxDxMRviGe8/8Kl9sXmD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697958938, "uuid": "9d70d9a8-4808-49d6-bb1e-bab64ca6dc4d", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697958938, "uuid": "b672d2fb-a9cd-4bf9-bd9a-9c220de59ea5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958938, "uuid": "4f3957b8-d1c0-4522-9744-9109d7eac8d5", "value": "SfQmc0MeZqpKXDN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d94f9543-70ad-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697960247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960247, "uuid": "e3fb8e53-3a5b-40c1-b944-93bac4d429fe", "comment": "Malware payload (AgentTesla)", "value": "68132c7c9a0e58608a8bca51be1fc423", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960247, "uuid": "4cd7679c-c33f-4512-a97e-a04669eaad83", "comment": "Malware payload (AgentTesla)", "value": "a5ef38807f1c5e0beef4bc17d53fb6533366eb693dff45a3f1d4e08020babc67", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960247, "uuid": "1fa56c40-3445-4a58-b16e-ff0644e34c59", "comment": "Malware payload (AgentTesla)", "value": "b79113cdd394bee991f5b6548c77d340a61f44c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960247, "uuid": "c93a785f-f71f-4afc-9fd3-526c7285165c", "comment": "Malware payload (AgentTesla)", "value": "0eb26fa4df73b30a3fe23a74a37a55403727bdb5a6ae358d79b9a803797d03861dbe9ec808d5df7c5b646261de244eb7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960247, "uuid": "6c93ef50-0e56-4b6e-a630-46a4ec6b75f8", "value": "T1FAE4232033295257DA2C16F24C7289466BB55CE7A662FBCD3CA6338D1EB7F84D111B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960247, "uuid": "906fce5c-4379-4df8-9e72-eea82e861978", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960247, "uuid": "0f0877b9-070b-44c7-8056-7487302963fd", "value": "12288:i8zS55mFz4CUEgLmqSt4q3eopGbPxo2xrA22uenNpkakhPOTXDIepx:if55q0Z1qOopGbZouUDnPkBOXpx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697960247, "uuid": "85edbbf5-ec16-4498-8baf-50539f5a2ee6", "value": 663040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697960247, "uuid": "7aaa3ecb-855b-4f20-9701-79e541eb11b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960247, "uuid": "ae7f44d5-fb30-488d-9f27-10749f5955c3", "value": "222284557-045845-0004-8743.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36cdb243-7124-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698011084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698011084, "uuid": "538d58f7-91b5-472b-8d74-a541eee732d7", "comment": "Malware payload (RedLineStealer)", "value": "0eea5112679f8faa43e5bdf8f01e0bfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698011084, "uuid": "a6887b88-38c6-4350-9deb-f6762d392dc9", "comment": "Malware payload (RedLineStealer)", "value": "a644828e65e177886a9afc6e25e697b972a2dc92ec53762467a0628c214e6d54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698011084, "uuid": "182d4236-5bc0-40b2-8bf9-9e7dd85bbe4d", "comment": "Malware payload (RedLineStealer)", "value": "f693f49ea5c41e286b7e2c148e1a44e0addda3ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698011084, "uuid": "d9c21b28-6a69-4fa1-a739-3b7c9f334eba", "comment": "Malware payload (RedLineStealer)", "value": "d836cdcca04df03c834d0839e0ccf61420d60347164cb30a4a28f467b4a2e0430673ca21288cfa171c5f1c6f4928f8c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698011084, "uuid": "d699c1ea-7040-425f-9af9-24db58891d60", "value": "T16AB46A51B0094F2AE3F2087CE6CA5DAE4D507EED6F530B8F36C14B8267967D1A93910B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698011084, "uuid": "1f0be2fc-044a-4c14-afad-5aad3cbde207", "value": "d350427820086a321ccf21b695161218", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698011084, "uuid": "29ea0a33-c42c-4e3c-9fcc-c2c93e1841eb", "value": "12288:B8/rVNx9QB2o97Hr62k3n/+pLsv9+eXUeF6u1L:oVD9QkAr62k3n/+pAv+eXL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698011084, "uuid": "fd4d0f16-0c17-4f8b-b558-87aa8d024c2a", "value": 507976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698011084, "uuid": "3acc3ef6-a703-4206-ab2f-526d8b988b02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698011084, "uuid": "d699d9aa-3904-4296-acc7-6c003974e92f", "value": "SecuriteInfo.com.BackDoor.Andromeda.1869.742.28793", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3f34914-70eb-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697986867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697986867, "uuid": "653083ab-bffe-4de4-aada-9df0bfeb0270", "comment": "Malware payload (Amadey)", "value": "009b852cc5b8c18ab550438793f9a9d0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697986867, "uuid": "a8ef7924-a00d-4bf7-b04e-1fcc70e8a516", "comment": "Malware payload (Amadey)", "value": "a9bac69d4a1aa3a14034d7367b20311a959caeb5d82d192562798da4ff8ae85e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697986867, "uuid": "f37cc594-990c-4459-a01c-4a37fbc2a286", "comment": "Malware payload (Amadey)", "value": "65b8dfe20407f4baff4d294c3cd26ec0e037029f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697986867, "uuid": "acc16566-fa3d-49ca-bbf4-a1cc56b2d0ca", "comment": "Malware payload (Amadey)", "value": "c4c392eec5396dc776400459f4ce0cca5e080452dbfac3e0393f00d0044c5d6628df6d831cb1bbcfcec513e033983609", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697986867, "uuid": "91d4f244-cd6b-4c03-8967-9364e3a2b5ae", "value": "T1E9652323A9C88162CE71737118F1039B1E297DB29C78157B63D7B95E4EA26D0F13272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697986867, "uuid": "94a08a27-e3ea-48f8-ab61-179ea32c5640", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697986867, "uuid": "3fc4d0ef-992a-4a60-887e-5a75636a8b81", "value": "24576:6ysLdg4BgWEsWdz4tMm2klLswbPiDzlXsme6KUeNjmTGVWFTw0OI3sk3zV:Bj4+WEsU4umDlLJs07lm6ca0OIH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697986867, "uuid": "092f7d02-0a87-4ff2-8614-4a864ee53fa5", "value": 1538048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697986867, "uuid": "43f40967-ae91-487c-8212-59d7822d0c14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697986867, "uuid": "d983e4be-f1fc-44e9-a481-d2d3d5912a84", "value": "009b852cc5b8c18ab550438793f9a9d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "398f90f7-70b1-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697961697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961697, "uuid": "7386c099-6823-413f-b1ac-eb98169735ca", "comment": "Malware payload (AgentTesla)", "value": "cc69f0291c32bfe2e9bdfe85126a8c23", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961697, "uuid": "97cfee30-0a38-4efb-971a-650aa733aac7", "comment": "Malware payload (AgentTesla)", "value": "ab0b368b6a4ae4cf72a0c386e05631c9c15f65748f02b809d1c30c3fb7425fea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961697, "uuid": "1e3105d9-72ac-46c6-9b9e-62272f22d5d1", "comment": "Malware payload (AgentTesla)", "value": "7014d7baed393c15135366815f3a031f05da47af", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961697, "uuid": "74d23d88-5ca8-45e7-a5a2-d172814df2f5", "comment": "Malware payload (AgentTesla)", "value": "b5b017ac2d3a491a4484efbe9ad097acc1a614eb76f93159991c3b720e6f7c5261a0c04f9487a5c23a5041c2ae594cf5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961697, "uuid": "dde1f1ea-fe23-40ee-ab68-24cea2dc4037", "value": "T1A7E4230635585FE3C01F9BFA8C41228043717F522608C79E8F96B5DEB77AB425AA5B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961697, "uuid": "7066fe0b-1720-428b-bea1-d6c36d7d6762", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961697, "uuid": "cf0dff26-d163-4131-86f5-44b4fe8582c2", "value": "12288:Vrb5yzvbYmBHemRSvGXHJ4el5yhyjfcCuibYYAl939qEYp0LvObeh:TebY0HXHL2ybcCb8b4EF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697961697, "uuid": "b18c24a5-1ac7-47e3-8d7b-a96d8d949122", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697961697, "uuid": "f50c7c7f-907b-4197-8631-c2dc9c416cef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961697, "uuid": "52b096d2-de3a-4105-b6da-e32365ad553a", "value": "Purchase order,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a36568f7-70ff-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697995375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697995375, "uuid": "0d30cd51-a67c-4af0-a587-166d3e947ef6", "comment": "Malware payload", "value": "59561b5aaa483c3401ba9432c6c34cea", "object_relation": "md5", "Tag": [ { "name": "CVE-2023-38831", "colour": "#FF3A96", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697995375, "uuid": "cc73bdf4-82d6-4e10-bec8-29c8ecc7c71e", "comment": "Malware payload", "value": "ab207c33fe08f8137af653b8aa38e2c5fe9f386fdd7f1e99086bf3eb4836aeb1", "object_relation": "sha256", "Tag": [ { "name": "CVE-2023-38831", "colour": "#FF3A96", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697995375, "uuid": "cd9e6e33-12fa-4c4b-8a52-6c6040ba51c2", "comment": "Malware payload", "value": "669de4a69ecffe7e274e16dd29663eed1d4838fc", "object_relation": "sha1", "Tag": [ { "name": "CVE-2023-38831", "colour": "#FF3A96", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697995375, "uuid": "bee1f72a-2cc4-4379-9c56-8839395f0036", "comment": "Malware payload", "value": "81588979844d54e1f2c9b73530b39558afa956fca118117785ace1caac508b714d3025720aac61377fcdc1997ae0fe84", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2023-38831", "colour": "#FF3A96", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697995375, "uuid": "f7314fe1-537a-4748-928e-a62574e8db9f", "value": "T14384239EF875ECAA0700D3F8F6FD794E556C4B38A89C82C78643035D3689728E191A77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697995375, "uuid": "f198a1ed-b1bd-4e84-9957-244030857e01", "value": "6144:ZxxLuUkpIW0NAo/mXbCrt04iYUdsO23urrSb0tXkC8MoF3PqLf/fBaRq3WC:ZzkIW0NMXADiLd2uHSAjE/Ef/fBaE3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697995375, "uuid": "ff6854ff-b4af-4ddd-b76d-c65dc710405b", "value": 382833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697995375, "uuid": "51ff1005-4d7f-4261-8bd6-3a14c4fb6ac5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697995375, "uuid": "ac7cfe1d-e86e-41f1-a671-38021a7ec397", "value": "sziauram.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4ab9b6c-70e9-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697985955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697985955, "uuid": "067e0a2f-e9b8-4607-af32-5645b0b308c9", "comment": "Malware payload (RedLineStealer)", "value": "ec9cf79bcea3c04d1a7903b02e4fd0c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697985955, "uuid": "e1b60aae-2215-45bb-be99-8ece02eebb4e", "comment": "Malware payload (RedLineStealer)", "value": "ab2c9f9cc44ed3b32b687d5e77aa4a2462b7066a36fbfca25037950543734ddf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697985955, "uuid": "5140db24-74e2-4166-9743-298662be3da9", "comment": "Malware payload (RedLineStealer)", "value": "1d7344e87cc1bc972eda5e6e9a2dd3e513955e4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697985955, "uuid": "fdf036c0-f213-4328-8990-e11a8306eaf6", "comment": "Malware payload (RedLineStealer)", "value": "8b27bcdf5c1db0e5a670d8cd07a410a11cc95bd4bfb58df5485b5418f47ea9fe8bf0a2340270359df18cc20c6309d556", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697985955, "uuid": "7c2ff88c-f910-4a3e-9d12-34373e30f151", "value": "T10F8533836AE01473DBBE477599F023430A267CC298E052572BA5AF1F0CB32C664B57B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697985955, "uuid": "0cdf8216-796f-41a6-a849-5c276b572ae2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697985955, "uuid": "3494d745-266a-484f-bba7-9dab4f7f7050", "value": "49152:6asJ8j3FB/2SCUPFP7/O85UuAM8sDDfe:mgb/iUtDTdDD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697985955, "uuid": "5fc296bd-6c0b-45c0-bc4d-3de245ae57e9", "value": 1843200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697985955, "uuid": "605960c1-b1d7-474d-a462-104a7bf84cde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697985955, "uuid": "929c72f8-6ede-4516-a453-56ffe8700fbe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "856d3733-70df-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697981581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981581, "uuid": "4977af98-bef5-49cb-8a00-4b2a8cf6017d", "comment": "Malware payload", "value": "f08aabe9aa590826a3492899aa113920", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981581, "uuid": "eb812e40-cd1d-443a-924b-66931e2407ed", "comment": "Malware payload", "value": "ac005b479b3a46bd712066ec9be5888422d8420764b8a7b5b42ca6934b59c58e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981581, "uuid": "a79a630e-2a6b-432f-9e55-fe999626a20f", "comment": "Malware payload", "value": "31474cde789b70222fc902c8878212badf5e8d9f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981581, "uuid": "4e662501-1c05-45ea-a899-07911f4c991d", "comment": "Malware payload", "value": "adbc23bf3a63eb92b7a93cd92f1ade23314a3fd785ecf60705033462bb5c39a5622f283bbbb845f3b01ccf39a0533e3f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "txt", "colour": "#BFCC1F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697981581, "uuid": "ae0cbc99-ae4d-42b4-9884-663f1838a4a4", "value": "T1B86475FA6036ED8E87370E40D1043F179C299EDB66B887F8778815D1C19CA8C9DE65B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697981581, "uuid": "a6e7fc66-13be-417b-bf71-7e9dd9d115a0", "value": "3072:YOX0Pw1G378BSo7eEc1oC0S+jXqYqToZLqCYSN6yBcgWuIm+AATmI6hVJp0Dj/LU:+IBSo7c1oC0JqTytlFxHd8c11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697981581, "uuid": "fc54e1eb-e862-4efb-bfc8-edbf23ec1a4e", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697981581, "uuid": "7e659742-f222-418b-8fcd-cb78a9c0181c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697981581, "uuid": "06aac85c-e9f5-45bc-98ee-96e4266ea39c", "value": "ab82585708a508f3307c563334f14f3ce800e5123e7fabdc066c9525.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ba7487-70aa-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697958959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958959, "uuid": "40b4f221-2b47-4fa6-ab65-e1ee7f6404ae", "comment": "Malware payload (Formbook)", "value": "72714f2e535a910b396981e4eccc1ef4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958959, "uuid": "58a6261c-588e-4243-a07c-d732154c5e01", "comment": "Malware payload (Formbook)", "value": "ac08c33b49d0a5204518d0652f2dc1bed11b47ec380edac615363e89cbf32cdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958959, "uuid": "fb883bad-d117-4933-bd62-ca9b8c9630e6", "comment": "Malware payload (Formbook)", "value": "fc34110d0f315b7dace16deca71845943818cb6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958959, "uuid": "cff59e3d-98d8-4057-99ba-ddf5540c194e", "comment": "Malware payload (Formbook)", "value": "cd5df5ce32f9168b40bb5d74e55ee773bcbe094993187937e94a068bce34d0daccda23b77f4bcdeb8fd7aee65d779a2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958959, "uuid": "8805d5aa-a3e8-4ef7-bccf-2ec32bcac39f", "value": "T1D3E4120133AC4917CBB65F78AD526401F6F2AC352C21D2DBEE9462DA04DFB784261BE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958959, "uuid": "fb07474e-d187-4af2-a7fa-27ef5bb49140", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958959, "uuid": "ea274658-28d1-4b76-bf73-046ae20d9b72", "value": "12288:hfp2H7s9Cw10QqiPpxmgDTCPHjLwqqdC7bpHnbgh3nIYA7k/GKJcwc9:hfw7s9C20QqiPPvuPD0qqMdmnIYA7kLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697958959, "uuid": "52516dce-c84a-4fbd-9e69-ad7570015e11", "value": 701440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697958959, "uuid": "29cb5cbb-627d-46ef-9f16-192456b1431e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958959, "uuid": "5082f07e-02c5-46d2-92e4-86d6e4c0b2e1", "value": "Lila Confidence V2307 Cargo Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "878e42e0-70aa-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1697958821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958821, "uuid": "b8f98b44-d459-476f-b469-9809cdf277a1", "comment": "Malware payload (SnakeKeylogger)", "value": "dc4e19251d65c38b919a36f12028dde2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958821, "uuid": "5e27b4b2-8a7c-4be1-bd04-2cb70ec6ced2", "comment": "Malware payload (SnakeKeylogger)", "value": "ac6cb2a7a2bf89af7e1034e691566907e7848070cb4166ba2f87db816a2c7b56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958821, "uuid": "d5bd9293-ad04-4e11-b412-0581b3ad5ed9", "comment": "Malware payload (SnakeKeylogger)", "value": "c44c061158f1d8f864a3a4681d2eb8440f81c8ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958821, "uuid": "af30e973-aa63-43f0-9e02-18b0aa5fb740", "comment": "Malware payload (SnakeKeylogger)", "value": "0d126cd64735eac92e85b57a36e2d87a86251c556b933ad99969b8ffb204ca010cf71c9367a46ab1e9ec13ffa4e3f9cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958821, "uuid": "199f0e6b-7a04-4387-aa2f-b3e15bb7ae9c", "value": "T11594E68B7A0B99B2CB5E3B72C59715041BB8D2427363E75F36BE239138433E9AB01547", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958821, "uuid": "b62a3acc-f887-42a3-b377-99216fa5217d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958821, "uuid": "3e7ba490-edec-426d-95fd-6dd8d0be338d", "value": "6144:QrNZnq8tYFHiH+Y+TMUKCaFCSaHDG7YYUz2LWOFWcy2CsSIo2aYcYPahZkf:QRZFYBiHsa0ABUeDy9sIqcYPahZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697958821, "uuid": "ee58221e-d914-457e-94c7-97f2c6876978", "value": 441856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697958821, "uuid": "546e2827-81f2-4e9d-9c7c-69f435814061", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958821, "uuid": "b181e0d4-8dba-410c-b7b1-1c0b540da361", "value": "STOWAGE PLAN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b5510b9-7096-11ee-8907-42010a9c0042", "comment": "Malware payload (DCRat)", "timestamp": 1697950238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697950238, "uuid": "fec83dc5-3dbd-4e1f-8144-dc4b9828ce28", "comment": "Malware payload (DCRat)", "value": "042131ad58f4624f9722ce342319396b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697950238, "uuid": "c33c1f93-127e-493a-a687-e75731aba235", "comment": "Malware payload (DCRat)", "value": "ad36fd29255e2cc7311a9ee8acf001adb391d8e7f7ab084db88b772fb6d8c2e1", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697950238, "uuid": "d8017a26-12ce-4f1f-b514-c2f89defce38", "comment": "Malware payload (DCRat)", "value": "e55031479a1a376eb230d91ae3352dfb24b5abaf", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697950238, "uuid": "5c3351a5-71d7-4685-980c-967e1558db1c", "comment": "Malware payload (DCRat)", "value": "60ed50ac173c5141914995fa680226d6ea0dd930b67cdb8a96f7fc0a4af71eb7590e59f78736dc1cc16319017083fe75", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697950238, "uuid": "9dd71be8-a814-40e8-889a-d8561e2e0954", "value": "T15C9550342EEA502AB173FF798BE47596DA5FB7A33707985D10A1038A0723A42DDC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697950238, "uuid": "31a8632b-07f4-4550-818e-384e8279b41c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697950238, "uuid": "12e795c2-19fc-449b-b93e-5e9a86169356", "value": "24576:hV2ut7GyxsE5HOT3RcchdduLG0ZAQo0wRBq+QEf9oDGIv:bjtFsRcQdiG0ZvcuGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697950238, "uuid": "9b461064-2348-414c-ba59-070216335eb5", "value": 1878528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697950238, "uuid": "67ffa90d-8075-4bf8-9523-147909d2e427", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697950238, "uuid": "46aa84da-72db-4c62-a905-91ae4619fd6d", "value": "042131ad58f4624f9722ce342319396b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8a02dfd-70f2-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697989827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697989827, "uuid": "0dfefe94-532e-4b64-a3cc-f67ab616f71b", "comment": "Malware payload (LummaStealer)", "value": "b56b3351a4162646e510d3ad34a042d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697989827, "uuid": "5549c9d6-5ec7-4ee2-860a-3390a946ed81", "comment": "Malware payload (LummaStealer)", "value": "ad3aa0432ded29c7a264898515911469edecc9c747146f314a0fcf78feda3215", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697989827, "uuid": "e3b098a8-6a54-4978-b927-2b1aadf78e53", "comment": "Malware payload (LummaStealer)", "value": "79260290b323816f5bc396488e883877b8dee328", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697989827, "uuid": "2570a30b-8ef1-41ff-bd7e-349805d673a2", "comment": "Malware payload (LummaStealer)", "value": "896312254a6051055f7555ba4928495a81021fd053253cb5cf45833895cb54c02b55e41e111d87b29584fc5af8caf571", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697989827, "uuid": "47cc3d68-af52-4c6d-a185-c4ed27ee7f96", "value": "T1BA34BE0176D1CC73C572153609E0EBB55E7EB8B00AA29EAF67E40F7E4F702C1D621A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697989827, "uuid": "040692be-9366-429a-832e-2c4a76335ff2", "value": "4f0cdfd3e1be2bc790b5aa9061b7d52c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697989827, "uuid": "2f3b1990-fd2a-4f47-8f62-e97a877d4884", "value": "6144:1fm2X4FIRd5DzznuBosiDKl51eAOu4M3/5H63aTi:RHIKd5DPyec4M8qTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697989827, "uuid": "db79d5e8-3ff0-4507-8567-fd07d913c882", "value": 235520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697989827, "uuid": "f7eb4894-eb87-40f5-a651-ea58e95d5e66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697989827, "uuid": "df797db9-8159-4873-a149-0eb78e4dcfea", "value": "b56b3351a4162646e510d3ad34a042d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9508b536-7104-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697997498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997498, "uuid": "cc77db49-2b35-4274-8156-f5f2478f4e05", "comment": "Malware payload (Formbook)", "value": "58bbfc3f4971c44d3efb60e97299a5a5", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997498, "uuid": "04c982cf-e617-4e26-8e0f-1e93abcfe995", "comment": "Malware payload (Formbook)", "value": "ad4a9f03995ef8fa50027c10e69e9e8a814f21e89f1019f482ba8b859e079c68", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997498, "uuid": "ce2f3f4d-35f9-4885-b066-9cf66047e8d8", "comment": "Malware payload (Formbook)", "value": "a487e3cbcc857afa70a3549c7820a4c75acb5c92", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997498, "uuid": "c07ab85d-78cf-43aa-95bf-629e212fb4aa", "comment": "Malware payload (Formbook)", "value": "a6b2cfaf3c36980bea5ffaf7385340c9e3b1378d528db354b8944e580ce1a1d24d0b95a4aaecb3e95d86345a52f6efd8", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997498, "uuid": "442d9fca-0dd6-4668-8848-5d2c04e35793", "value": "T1DB25BFB875047DE6666F576BDA96ACDD03B627238ACBA4CD80647BC304A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997498, "uuid": "319958ed-4224-4c01-a83f-5f4993e90903", "value": "24576:DbA0kMPWGK1nu6J2j7Sjxyei09Z/HhUGy16YzXoa+OyE+Dj1W6m+sykIsPAqnpus:p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697997498, "uuid": "64a1e14b-983e-4b53-8034-c80b47cb6d71", "value": 1006380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697997498, "uuid": "981da2cc-f460-4421-9047-05ccc9fa615e", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997498, "uuid": "5772df85-5bba-4f02-8867-3b41be812289", "value": "PO-AM2307586.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40dbda04-7127-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698012390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698012390, "uuid": "440a1d69-6c57-4b85-b8e5-7699db3e3f8e", "comment": "Malware payload", "value": "74ebbea385c581b23d31e7ab84ec1652", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698012390, "uuid": "356bbf18-9321-4f35-a949-2975c9cb9028", "comment": "Malware payload", "value": "ad545209b27a1f79bf5d9a2d56694bdeafcb4df7b018704bd08df4995447f19f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698012390, "uuid": "9ec9089a-8b76-416a-8140-b60aee9774db", "comment": "Malware payload", "value": "3bfa583c89eb85f519c1f374c817892e895cd5d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698012390, "uuid": "6d91d6d3-fea5-49d6-b085-a274c96e97a3", "comment": "Malware payload", "value": "3c4ab85e2794e3615d2f6c78d11e0ffe80e258cea89187126a2c5a4feb94dc1ae83fd4dc605b809f61a81b6ed2714133", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698012390, "uuid": "1fa85bc6-4084-490f-bea7-4824dae7d040", "value": "T1B48523C2BBF54472C96147715EF203931B3A7CA29E34862F17839C1ECAB0598987676F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698012390, "uuid": "037d5565-1cae-452a-beae-abc696a83bd2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698012390, "uuid": "dcf7bd9b-c0ef-457f-b30e-e696afe6d047", "value": "24576:pyZ4FiLw7SliIjJvst2EhC7pLA7G3bpVDdgTft7ZQSYBcxk5wMMJhbGTNBVAFrU3:caiXdsPUF/VRd8fLQSY8kaSMF/6Uq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698012390, "uuid": "c0bb4319-ff00-4332-b51d-3cf65a5a9fcf", "value": 1825280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698012390, "uuid": "b45a57fc-aaba-4a1b-bc69-88bc86226ddb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698012390, "uuid": "3ed1b889-3c09-48a7-b4cd-5cffddf6ae08", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc565617-70aa-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697958937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958937, "uuid": "b6eb36f5-3019-491a-a9b5-1852ed1f8415", "comment": "Malware payload (Formbook)", "value": "eb2f1c5332b3cb16fc91e1ab0595676f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958937, "uuid": "0390825e-539d-4516-8c05-1151f5aa053b", "comment": "Malware payload (Formbook)", "value": "aded7c29741570f0d9241a72860ffec5c5cc37271ff3957fe857201511573e99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958937, "uuid": "cc34ecf9-4963-4545-a211-264641659911", "comment": "Malware payload (Formbook)", "value": "76aa675919f347ab0badeec1d90c50e466e07cf1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958937, "uuid": "6b032fbc-91e5-4eb9-9cd3-413b37963998", "comment": "Malware payload (Formbook)", "value": "d44305fa5b8bc8660655e7295de8172062b3e2c7b6600387cbad97314578723f4d3c683ff005824d9a6b897cbb603061", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958937, "uuid": "73346147-1534-478e-9b96-4d49851dfcff", "value": "T165E4024632788923CB3A1FB9CD615200BBF29D251916E7CBDDC972DA069EF384211BD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958937, "uuid": "ece57f0c-44bf-4be0-99cf-02c8783233a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958937, "uuid": "25f8978b-5469-4aa0-88e9-adb87c718a80", "value": "12288:Jo7s9MwIr7Gs2Uqhi6MlSyqAao6ssub3BCjYj6/Ug00DR:Jo7s9M9rkJnM08aJubgR00V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697958937, "uuid": "08a1c30f-577d-4e03-b233-019c20b49e6b", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697958937, "uuid": "9b8ee7d6-118f-4a79-a22b-707cdd16bfdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958937, "uuid": "e751f6d0-13fb-433d-a5c7-3384b81f5305", "value": "overdue invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb9e179-7087-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697943635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697943635, "uuid": "2de2616c-f883-410d-b155-643848985217", "comment": "Malware payload (LummaStealer)", "value": "14e3a439204f0c68752c50c267dfd028", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697943635, "uuid": "4131c229-9e7b-4b34-90f6-3fe688539443", "comment": "Malware payload (LummaStealer)", "value": "aec278fedefcf2e8f80c3be9c9669a62add238e1e5b4521ccfc2979dfde1fb8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697943635, "uuid": "afb087f5-27f0-485d-acbc-cc3b46a99406", "comment": "Malware payload (LummaStealer)", "value": "cb461e4f64c8bc3b01f57861978f32f0a243bd14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697943635, "uuid": "2c2a3c69-ef3e-495e-b493-ec8e88640eaf", "comment": "Malware payload (LummaStealer)", "value": "614a6af8e43e7be21309cf00f0d34f2222804f850492a363f8a306c39871a76a950acdd1336a0edd0bfc852cbe6c3b06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697943635, "uuid": "7f4360a6-55ea-4383-ad78-b9c83e657e6f", "value": "T114961221B781D526EAA211315A7DD75AA02CBC710F71A0CFA3E4671E2DF09C25732F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697943635, "uuid": "1ef3713d-2a48-47fc-aef4-2f84065fe260", "value": "413704d931dd90675c12a0afcdbdaa34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697943635, "uuid": "05ca7ac3-a96c-4276-a790-a4642f1a3762", "value": "196608:zrvhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhho:zYVywfHZv7a5uCkGZtqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697943635, "uuid": "a240cfdc-0fcc-4555-b8ac-4f01f5a28f4f", "value": 9064320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697943635, "uuid": "6bcc8666-a469-463d-8781-6a2cb380c802", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697943635, "uuid": "deb9740f-129b-41f1-847b-4ac8139b3018", "value": "14e3a439204f0c68752c50c267dfd028.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "683cc235-7103-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1697996994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697996994, "uuid": "11050aef-cb17-4956-995b-e82393623f1b", "comment": "Malware payload (DBatLoader)", "value": "ee67f8e5c473d7b541be90a0ee046f8d", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697996994, "uuid": "26e0fe14-eccc-4097-ad89-ec6f07dd6503", "comment": "Malware payload (DBatLoader)", "value": "af2a5455f4de7136e90e94e7bee5ba398d01f09ab9d01ef32bb70e560030b650", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697996994, "uuid": "4a316d90-0b41-4b24-9bcd-57b2e9bb4558", "comment": "Malware payload (DBatLoader)", "value": "7eec2005dd50ba68ec84c6b6b7e350e18eefc51c", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697996994, "uuid": "525140f1-506b-4058-9c1d-2d5288e0c89b", "comment": "Malware payload (DBatLoader)", "value": "68d2bdd26367a4b681ebdec4d179a89217600109502ec9615420b53a9f23132351806eec1923013342f5b87a5ef6e63c", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697996994, "uuid": "657a9582-4e21-4c42-a0ab-abaa37f2901f", "value": "T16845AD22BED1AC33C5F3493C9F4BEFB4A91E3DF2192419A87ED5295C5A703503D9818A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697996994, "uuid": "26e76c49-f272-43a2-a337-5d4e25307f5f", "value": "4df0e13d93cb581937cac481e3c87c38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697996994, "uuid": "96313ef8-9e96-4888-8f17-4c2e14aab822", "value": "24576:qeA4Puy3YeOyFbcA3l0xdapY2bwplPYlAQZlo/:q5cZ3BmdaG26ME/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697996994, "uuid": "b9a6ac25-bdda-4c08-8227-66128618f2b2", "value": 1262592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697996994, "uuid": "71bea9fe-1258-42bf-ac98-c14b27a627c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697996994, "uuid": "1d2c4819-f852-4a43-ad03-9f83a90877ad", "value": "PO9823.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e14e447c-7079-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697937926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697937926, "uuid": "85558d34-3e2a-49db-9f10-162061bb95bd", "comment": "Malware payload (RedLineStealer)", "value": "a0fcb18241245aea368298f59b7b1927", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697937926, "uuid": "d10210e0-a6c9-4ac0-a630-3dc2c51e7da0", "comment": "Malware payload (RedLineStealer)", "value": "afde1e8ed9e621c6d00a725164136ec0ca856714194f3e5c5220a0948fa6bb7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697937926, "uuid": "b864e7bd-4f95-4423-901a-67b69b6cc775", "comment": "Malware payload (RedLineStealer)", "value": "7a94af466e4389958f2795228b4252a2a7039e23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697937926, "uuid": "ef802304-70bb-41c2-922f-d8b777c7f750", "comment": "Malware payload (RedLineStealer)", "value": "009af6e2c33b04658754273c30673771b8b6adf12993fcbc0421ee68aae9c672ecc6c2fef621339f1aecda72244daad7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697937926, "uuid": "4f532dd8-0d19-4d53-802b-e91d9b11f851", "value": "T17AA7CFDF5788101BFB3F693985C8AB24F40CE26B1DD69209903C95EFB124AF4BDB1568", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697937926, "uuid": "7dacb802-272d-4996-8afd-662c52727bf1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697937926, "uuid": "2411f150-e4eb-4db1-938e-6038d2e3dcf7", "value": "393216:fDqei7llcVMmKZIbiUsCvXjZKYhT4f+qVAbvzrz81iv:f2974VTbjsCvXjMYhkcw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697937926, "uuid": "9c788578-f059-407e-bf6f-90b75562f259", "value": 45037388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697937926, "uuid": "e5123ee9-b45e-440f-bdfd-d029abbfde1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697937926, "uuid": "8a32601e-45c5-49bf-b25a-d45fc06450dc", "value": "a0fcb18241245aea368298f59b7b1927.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2085bbb-70aa-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697958946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958946, "uuid": "42b62338-816a-4013-ba96-138996ad2b8b", "comment": "Malware payload (AgentTesla)", "value": "6a3dc50e03e59e381f3f64156606f999", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958946, "uuid": "eea3fa75-6e4e-4903-b340-f56c65a95f34", "comment": "Malware payload (AgentTesla)", "value": "afe0a1288c4168ac8cb545884732514e0427b9c227b97a81befbba07e9ffb4f3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958946, "uuid": "6617abac-de58-4e8a-8f11-71c9beaf27f0", "comment": "Malware payload (AgentTesla)", "value": "aa4aaf42fab376b621bca0d028c49f91242e80c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958946, "uuid": "b96f507e-c0b9-4740-bc2e-d5f1f7f034b8", "comment": "Malware payload (AgentTesla)", "value": "8c9eb9b2260c21e8839c6a050c878fbd8696527b598f793689f8deeb2c3f14080cbde1df2d46f5d35430e93f631776e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958946, "uuid": "606cdaae-5fd2-42d2-8220-79e0ebe77d02", "value": "T1A2F4CF9D325476EFC95BC976CAA81C70E660296B431BD243E05312ED9A0DAE7CF241F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958946, "uuid": "7b0c3291-cfb3-4277-80d8-3fd1bc4071c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958946, "uuid": "2116a73a-736f-4149-a5d9-fac2c8beec2b", "value": "12288:yYOyL7s9lwDQqs/EjIBlurFojPJ+82nwh0u+t6U4XZcXO8TTPuoXwJGdLy0PYdGt:yYDL7s9lpqsAIBlOFojPJFTrkZ4XZc7T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697958946, "uuid": "0a62b480-50cc-45de-9b4b-8c68f98c752e", "value": 784384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697958946, "uuid": "aec146da-e38b-4ede-83c8-7933f873b3f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958946, "uuid": "4df59459-da59-4aaa-a483-cb50271d9013", "value": "Metalcom Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4be6d339-7113-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698003818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698003818, "uuid": "a0d66ce7-87db-465b-a718-8155b2f1a21b", "comment": "Malware payload", "value": "9974e1d529f3b14ce4a5541cd5d8e788", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698003818, "uuid": "1e7054fd-8615-4cab-9d50-b4ee5a4f127a", "comment": "Malware payload", "value": "b0ab31e02bbb250636020b3d78fc6030f115316160023b0db90362fca76597a1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698003818, "uuid": "38884524-b94d-42c3-8251-ac012311cfbb", "comment": "Malware payload", "value": "84d37624f738216a900b04d94dc133c9d7e35511", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698003818, "uuid": "f1285ad5-0cee-467b-9550-f2b013f25815", "comment": "Malware payload", "value": "34b8c80d4f64d76d4ddd0792326c7818ae980852a69867b1d7631c437f3ad46e0eb760b6a3d9f616055e605f01015c7c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698003818, "uuid": "e04422bb-37eb-450c-8a21-d967eac2f4a2", "value": "T12F63298F755083F2C74D03B9EB9A9E05463ABE1667E4C1132F96C6C96B33393B636241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698003818, "uuid": "f28c0174-8646-4216-883e-814549178a69", "value": "f34a76490ed9332cb045cb34816b469a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698003818, "uuid": "4b4d1c39-5f5e-4f2e-b096-e636298a75c2", "value": "768:Z0jzIzUiq3fcd12rFieAzAmY+3lQ7wJiQEZrl0VtmLUOlZqSfZ1t7I:Z0HIzUlfcdeFAYeQ7TFrqtmLUOPV1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698003818, "uuid": "5e04e1e8-f6cf-4b79-a110-330c065139dd", "value": 69632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698003818, "uuid": "27aafb01-4402-4dcb-9eb6-12c1cb7fa0a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698003818, "uuid": "51ca1e17-0dc7-4be9-ae48-bb1ee28fe864", "value": "SecuriteInfo.com.Variant.Ursu.813733.18299.24549", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b8307a9-70aa-11ee-8907-42010a9c0042", "comment": "Malware payload (PureCrypter)", "timestamp": 1697958828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958828, "uuid": "1463ef63-0abf-4a4b-a7dc-a0ff935c0846", "comment": "Malware payload (PureCrypter)", "value": "de27680c97817a80d129bd4296b07aad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958828, "uuid": "0bda0f82-2679-4630-b9de-b91c2cd5d9e9", "comment": "Malware payload (PureCrypter)", "value": "b0cd061d54e8b33318b34ae93ae6daeb5658e5c7a1af209b48ead04bff0137b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958828, "uuid": "bc386b54-a266-4441-9dcc-aa5baf170c3e", "comment": "Malware payload (PureCrypter)", "value": "0a65535b0999203e92a09558e4788fa35ce1356f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958828, "uuid": "821e595f-d62e-445c-8cb5-2cc4c1e90950", "comment": "Malware payload (PureCrypter)", "value": "2c1ef4a3edf8ac29d854aefac9bdb2a2c7f310bd7935e6ff16958274d1f0e8a29ab73e453a84c3b312af393526892e6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958828, "uuid": "6561e3ed-18f9-43d7-8cf7-6a7c83ed34fa", "value": "T1C0721B12F2589A52D2F90573CD8EA240262CFD51A8AB425F2CD3BD1FBF7B7312513A52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958828, "uuid": "812de160-5703-471f-aa4f-125206eca057", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958828, "uuid": "2ad9e229-e124-42c5-bd40-d242ee13e561", "value": "192:P2aJAwmOk+4YlpUiCI/BpFNPNZJ9afe3tkBV4:PVXuQUiCI5HNPNZJ9afedAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697958828, "uuid": "a6371e00-e2c8-4ffe-a266-8b72f8e589da", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697958828, "uuid": "42f6f1b1-b7f8-409f-ab89-428ff58c211c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958828, "uuid": "a4af8dea-fcb8-49e7-8828-4c7f3bc4b500", "value": "231005-001-ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eafa973d-70af-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1697961135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961135, "uuid": "2aad5332-be6d-4596-b68f-74c2089b6a0a", "comment": "Malware payload (DBatLoader)", "value": "6895e9adc8fc5bc249d8705efa5cbdf8", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961135, "uuid": "ce88b7c1-93c6-4d88-8602-18bda59e354d", "comment": "Malware payload (DBatLoader)", "value": "b18969cab36df3455301f298361f0c163ab4ceeac62c5ca9aabaabf3acd66deb", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961135, "uuid": "863ce62f-a36e-46b0-9e96-f98f6656e8f3", "comment": "Malware payload (DBatLoader)", "value": "74b53d35134e36e5be0bb667e940bd9ac01c55f6", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961135, "uuid": "29dacc64-18d9-475f-9107-2bbe650e3d2c", "comment": "Malware payload (DBatLoader)", "value": "e51326893387709990e37d1bba7cb1b3c1dc47e353f259f00c1b8756e78143918135efdd200d9d296da595650d08cf6f", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961135, "uuid": "763a146c-0123-46c4-836e-41ba42c30898", "value": "T1D395E126B2F24433E2334739CD675395893B7F213E686892A7FC2D8D9EB968534161C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961135, "uuid": "3c23bd3d-c2b4-4f9b-b09f-5ea16120aa88", "value": "4569aa626af1b80196dcb0b68adcc830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961135, "uuid": "5930ce75-ff9d-40c3-a09b-a902df68867c", "value": "24576:3Te9LrsMoZkD/VOP/6juQp6DjasufyJIZlnLxGgVzwmDi1ETNay76nBWWnmQqKrU:3Te9NLVfn513VzrunExND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697961135, "uuid": "ff5fd0aa-af95-4823-bc6b-d3cf3970435a", "value": 2038784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697961135, "uuid": "311f2baf-26bc-43d8-aea3-583eb0608847", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961135, "uuid": "22723ff2-612e-42ae-b87c-c8502f50c9d5", "value": "6895e9adc8fc5bc249d8705efa5cbdf8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3157d02b-70aa-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697958676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958676, "uuid": "78a1f2e1-05dd-4a24-ab9f-31bb9f545dab", "comment": "Malware payload (RedLineStealer)", "value": "2b2ea29ff08291b32cc0fb149d752809", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958676, "uuid": "707dba44-d80c-4b70-8ef7-ace8813481e7", "comment": "Malware payload (RedLineStealer)", "value": "b1fe8e781835e41eae759a167f5a866f9c979203c6e3798a060383eaf5420b14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958676, "uuid": "39315680-bba9-43bb-8076-0a6974488cba", "comment": "Malware payload (RedLineStealer)", "value": "8390f5b948c6124c30c526db6d12c26b6b0f2eec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958676, "uuid": "8b223f16-a3b9-4eda-b530-65f89ce087a5", "comment": "Malware payload (RedLineStealer)", "value": "fb1f8c8d905209415bcb3e234469b512308d190af3069cfe132db3ac6645e4d1a0355c5dbe54f395656fc3b2ea4265e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958676, "uuid": "ac3e442f-7b49-4f69-a084-31296f7d2a5e", "value": "T16955DF53A58C4C60CB641936F8D581C10373EC394F7A881FAEC47EEE3A7A826A61F5D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958676, "uuid": "77e9ff24-d28c-42f7-b94b-7fe5521683d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958676, "uuid": "00a83f06-2050-4c72-a7bc-ac97fa81593b", "value": "24576:TUAp29SeetE44L6EkMRtqrhL6krlcTAdT2:T1eetE4i3+hGkrWsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697958676, "uuid": "d9ecb315-f517-4f7d-91d3-a2382275c789", "value": 1305392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697958676, "uuid": "40063be0-6b5f-4e34-b95c-f37cb530b58f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958676, "uuid": "44d5e4db-9492-4836-a98f-3cc98e0144ea", "value": "2b2ea29ff08291b32cc0fb149d752809.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd545729-70ab-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1697959368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959368, "uuid": "d3669ae8-ab18-4134-be4c-ecad7d57e64e", "comment": "Malware payload (SnakeKeylogger)", "value": "fab6b48ae4199dc7b5fb5a470ebb0677", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959368, "uuid": "35532e28-b764-4738-8f17-196a05d8fe60", "comment": "Malware payload (SnakeKeylogger)", "value": "b2821e2d11401060218dc7e459e364d9dcdc9d71beef226ae081594a64b6449a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959368, "uuid": "31a90c4a-1432-4381-b8a1-c0d393b96ca2", "comment": "Malware payload (SnakeKeylogger)", "value": "4edc17560ceb04983de7516b05eedfd982e46b80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959368, "uuid": "1c80acc1-e9cd-4123-8e9a-b96c465f8d7c", "comment": "Malware payload (SnakeKeylogger)", "value": "9dbe3359b202f7fe9268f2d35250bddeebfd9c569949bef4ec6bc79233c31ca38a44f018d04c518e87230b821cf7255d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959368, "uuid": "396dd0ae-4dad-49ee-a67f-6078e13fe477", "value": "T15AA41254B25ACBD4C12F4376EA7AE774003C1877D442D31C2DD635A22AF372AB90B9E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959368, "uuid": "a6daef65-b35d-4b04-a6d6-1fe4a6520570", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959368, "uuid": "470fec89-bbdc-48c5-94fa-d844c712c5a0", "value": "12288:gVfD2S+j5Rhw+0o0r/E+HJeTy5i8k6ceXd0:kbzo5nwLosE+XHk6LS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697959368, "uuid": "7122cd1c-fe2b-47cb-9dd8-25e941fc0608", "value": 472576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697959368, "uuid": "a4c5331b-a222-410f-b8ad-ae1ee2072890", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959368, "uuid": "8dfd68e3-95f2-4c89-a307-e34136ac79b8", "value": "SGH00987789000G.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8d5d29e-70ab-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697959306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959306, "uuid": "34430a9c-be44-48cd-9490-03ca45a5a75c", "comment": "Malware payload (AgentTesla)", "value": "2c7c6c70bf86d30ca868631989469d39", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959306, "uuid": "c1268cf6-fa95-40fd-befa-bd7f4d9ed806", "comment": "Malware payload (AgentTesla)", "value": "b293fdafb3b61bd572eee2195762d9d364c94aaf750e8f3b3dcf5402bd09297c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959306, "uuid": "660433b9-9e1e-4f16-a4b9-611e98dea3e5", "comment": "Malware payload (AgentTesla)", "value": "9fcc192848ae5438c0b82457434b4942337a5c24", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959306, "uuid": "cd93fd4d-2df5-4228-b08c-725f951b658f", "comment": "Malware payload (AgentTesla)", "value": "c0e04f7050cc9e9a4d141abea71c5eb86c1ac79512c8a962be66709da7eaf7f5d7a02c439452b7095b9d9d72d5700416", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959306, "uuid": "d9480c0e-80a4-4c50-8de6-118f7d015073", "value": "T171D412997794B6FFC563CAB59EA02D688320356B671BD207A42315DE8E0D0A78F107F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959306, "uuid": "70014e98-ea67-4ec0-bca4-b0e32c8ff605", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959306, "uuid": "9083c98a-ed51-4541-a59d-3a05d12e4358", "value": "12288:Ja/jl0ov0TqfrW3h3lluaVy16LgtDSx2rFMsGwq596J:0Ld0TyWx32argt2OQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697959306, "uuid": "ba700ba1-777c-402e-a88c-923762d75cca", "value": 635904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697959306, "uuid": "2fb1806c-de3c-4545-b921-3dcebcb0f225", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959306, "uuid": "9f346b6c-569d-4c98-bda0-5a37e027adb0", "value": "Payment Files.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b663dd7-70b1-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697961700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961700, "uuid": "be8796a8-9afd-4091-9460-1fdbddf7aec1", "comment": "Malware payload (AgentTesla)", "value": "27498ff7caf86df0a18025bd2483a64d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961700, "uuid": "488ac76c-a201-4277-97b7-6a9c388ba930", "comment": "Malware payload (AgentTesla)", "value": "b2a66c29e74c2c3115c7fa7f07694dfea64957d6701c5c9b54d9b9a14abd8462", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961700, "uuid": "f9ce38b4-b891-4ff0-b685-e049b789409c", "comment": "Malware payload (AgentTesla)", "value": "2a5b83e521e8013b8f16abeddd445dd00ed87a29", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961700, "uuid": "44d77e45-54ff-4329-993d-a5ba75d84864", "comment": "Malware payload (AgentTesla)", "value": "5e0cc3f6f3e1c02c498edd152f91c882479425dbc9b879f8f9e41bc3abcf1d883290aaeb8b210b63f7f2efb217567a55", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961700, "uuid": "b25f7d49-b7d0-441d-903a-3ebfb4c24ec7", "value": "T1DD05234973D8D777C10843F98951A1009B3CBE12A20AEB9F5F8671EDB1B27925F16B0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961700, "uuid": "8eacedd1-73b9-40b4-b610-7d9861b16671", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961700, "uuid": "610123f7-827e-46be-a858-a7715e5b08a7", "value": "12288:2b5yzvbYmBHMECPkU4VnkjOcuTmXRN/jDV827xwm/QVB6OQ6/nckbw5MnDHUBseQ:EebY0eZAvnSviAxwSQL/nFyMDHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697961700, "uuid": "74efe21a-9474-4ed5-b4ac-cd462db7eaf3", "value": 801280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697961700, "uuid": "9d78e79b-f2aa-4165-83cc-f8db1b19cb65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961700, "uuid": "010c1f17-4a7d-4eef-8106-43922df64448", "value": "27498ff7caf86df0a18025bd2483a64d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7aee912-70ab-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1697959385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959385, "uuid": "67fb3f0b-b35c-494d-9ccc-cb65eed76c69", "comment": "Malware payload (SnakeKeylogger)", "value": "1a691869fcecce8373212a390d1fa3e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959385, "uuid": "a9849c69-2bbc-442a-ad68-3bd82dfe7472", "comment": "Malware payload (SnakeKeylogger)", "value": "b423c0f05afa1b0e32ba18a552ac0d4020bb69a055602c94323d5bbd4c9cefa8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959385, "uuid": "867c6258-aec8-46ba-b856-31a5d4112fcd", "comment": "Malware payload (SnakeKeylogger)", "value": "a952c873d4b825940b012e2d0ceb849dd9634d64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959385, "uuid": "305e720a-811b-454f-b3fe-0ee272cc2488", "comment": "Malware payload (SnakeKeylogger)", "value": "f3b8d96009a624ecc7f9f668ee70b03ad61375ee2fac3af3da54fc7924fb766b50ee4de507d41a782571a81e353cc1f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959385, "uuid": "c87669cc-1ca6-467b-b3a2-d3bb64a7d20d", "value": "T18384F19AD5949A24CD1F1370EA324B14403DBD379576E30C7ECBF8A12AB32469D96CB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959385, "uuid": "3c13a660-1f95-4682-8c0c-cc5274588be2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959385, "uuid": "1f1839d9-b6d3-4380-971f-514fb62183fc", "value": "6144:L0nJBIKD2SJMz2dR8rZNlvzbV+dHhZdZcZmPaFTPM+OAHhBMdk6ceh9X3P9t0G:sJfD2S+nRbV+dHhZdZcZm2TPZHhBak6I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697959385, "uuid": "83385cdd-7708-415b-add1-dc81c02f61ae", "value": 375296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697959385, "uuid": "fcd63823-0a14-4469-9be2-fa893aae2ba1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959385, "uuid": "b46ea29f-f29e-4ca2-992c-a3dfa368437f", "value": "Drawings.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df8ca9e2-70e2-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697983021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697983021, "uuid": "3b600794-3259-4028-adb0-0d577c47a102", "comment": "Malware payload (RedLineStealer)", "value": "6a4a55f19a0705131339c6369486eab5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697983021, "uuid": "db364b4a-42e1-4859-a83d-69c0b6a74387", "comment": "Malware payload (RedLineStealer)", "value": "b556e33b8fc5c524c6a60bb285a31fd3e9e997dc8bd4509db218889d20d6f1ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697983021, "uuid": "53095591-0973-4425-856f-c3f41fe7f0c7", "comment": "Malware payload (RedLineStealer)", "value": "5647c3cdd9fe0a671f8e49d7cbf6393a86e64bab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697983021, "uuid": "e4c4ba8e-e706-4437-bf47-6d907e70dc27", "comment": "Malware payload (RedLineStealer)", "value": "ce6fed5962b1688d4ee1893dd6a5312300bb83f2d01f7bb96f4d439667a75ebe69983cbd513c028deed255ab885cad2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697983021, "uuid": "41546c0f-e2a3-4936-9464-b78fa5f96ccf", "value": "T123853307D1CA9162D9B363B094FF03CB2636BCF159B93352B696E5A90D736C128B434B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697983021, "uuid": "b0c1cc67-36b7-4030-9568-156775cdf77a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697983021, "uuid": "e9d64d1e-ee54-494f-a1d5-346d0b135657", "value": "49152:hGRJEgBEGpNhUGBJCb+jywaRGn9EMavw:ElBppfJC6OK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697983021, "uuid": "f8440bee-d28c-4c34-bbee-fc5e6d796314", "value": 1842688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697983021, "uuid": "b6aa3935-cde2-408f-8484-51420d608ed8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697983021, "uuid": "0cf11577-19e0-4f5b-b538-a1781cb6f70e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f65cea5-7124-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698011152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698011152, "uuid": "505af042-d1f1-4a8b-beaf-f7e6432033ab", "comment": "Malware payload", "value": "b6ad83cf9997a8ecf1123ddef17b4747", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698011152, "uuid": "d4ecc84c-876e-4d02-88c6-704e8b216f4a", "comment": "Malware payload", "value": "b5b47105645a8f5d02429e5d856f3b57411344272202a89c7d88a28fcc96a18b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698011152, "uuid": "f10a2d7b-14f9-43db-93a6-ff80a9eb0a86", "comment": "Malware payload", "value": "dec1a2b595715245762bd0b1dd8cf9616190b7d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698011152, "uuid": "a343427e-09b8-460e-b6bb-df65dbeb02c3", "comment": "Malware payload", "value": "1cba889ebcae9d08b5c3d54f4a5fde399776b91b1fce995c9fdeffdedd8314dfc77e034913de3f83358a634c3623fe70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698011152, "uuid": "f00ac8a1-470f-4652-b692-45f0dfed4a8a", "value": "T1B285234997EA412BDAB4237059F602D32B763C929A74C35B3A486C561CF2588B37373F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698011152, "uuid": "b17ffa24-d051-48d1-9208-f9d45876cf3c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698011152, "uuid": "4b9f6b97-91b7-4345-aeb0-ff5b7c2d2696", "value": "49152:EXZFnStLxwltWu9nirNau4xTpssI7L9qoUp:OStFObnuNpOTCsII", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698011152, "uuid": "89bf3843-b96d-499e-aae7-d158b0b4c0a3", "value": 1827328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698011152, "uuid": "d8f5f851-26ea-4fe7-a908-3c500cacf87e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698011152, "uuid": "9fdcab35-a30b-4838-b980-0b98ec80005d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab8bca37-70ab-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697959311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959311, "uuid": "49476b47-4506-4ab1-ac29-2b260489d9af", "comment": "Malware payload (Formbook)", "value": "d23453a8ddfe473c8a3f060b68d08bc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959311, "uuid": "033e4327-d5ab-4bfa-ad9c-57252821340e", "comment": "Malware payload (Formbook)", "value": "b60cdb596b455177d283fb0eb60bb38ebade575c406bf803015f7eeb0855b8f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959311, "uuid": "9f36fcf8-510a-4c56-996e-ca335f52eeb5", "comment": "Malware payload (Formbook)", "value": "3159fe6e34771237ce134c7d984b6ca8bc600a49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959311, "uuid": "796efa0f-7b40-4935-b30c-0c06e19055af", "comment": "Malware payload (Formbook)", "value": "c72c4d090ee1ea1b3995dec438c702776a7c1a878377c7ccaa576c53625d134dea567e46df10296572e24cdfa6c05c13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959311, "uuid": "8828a5c0-b27a-4858-b142-1ba1b131b39a", "value": "T187D412A975A0B1EFC123C63699D42C209730A47B9B5BD217AC5324CD9E4D6A78F40BF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959311, "uuid": "b4dda4a5-dca0-49d0-b0cd-baa126868b6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959311, "uuid": "98142ee2-090c-4185-bea8-ae022d24bfbb", "value": "12288:3/j2mG/hjFMRo9T5B5Z1ahV7KMtHuyaFOWSvJU/rj7KogasE9N:3L2mGpjWa9T75Z1avZLakJU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697959311, "uuid": "954760f7-03ed-4701-984a-9ec1fcbc27b1", "value": 637952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697959311, "uuid": "7f95895c-0f80-4a25-bb19-01184cbb4fa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959311, "uuid": "bf446c88-decd-40df-b46b-25b8111d03a1", "value": "REVISED P I_INVS210090.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f08e77a6-7104-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1697997652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997652, "uuid": "d4e1d872-becb-4d26-940d-0e64a055b203", "comment": "Malware payload (RemcosRAT)", "value": "de6151515965f1235b2b7c91efcaff41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997652, "uuid": "32b1eff7-43b2-49c5-93ae-14595de6e013", "comment": "Malware payload (RemcosRAT)", "value": "b6931c9629912e152dfdee5e6c46c3f56071e2817cea4010328e685f954dbaaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997652, "uuid": "8f4fc21c-e601-41f6-9a20-c3ea9bb12857", "comment": "Malware payload (RemcosRAT)", "value": "fb671e1660a6f5e809b02df196db79b6ad343816", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997652, "uuid": "8a80df49-bfdc-4b54-ab5f-aba4f57a171d", "comment": "Malware payload (RemcosRAT)", "value": "ecdd40e52c8c32ae78336af3fa563da6381e57756b6790e17e11b3710c18e63712aa6af2e4baa2c1190a57d549225783", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997652, "uuid": "4a5c6926-3f9b-41e1-bb13-fa5dd1405a42", "value": "T1CA45E10A5B912FA5C2AE0B35D352009887F0C29BA69DD7ED6CC403F5DE5671B7A032E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997652, "uuid": "9c1cf023-4d08-476e-b7da-e3f885cfa7d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997652, "uuid": "71c9f923-b2aa-4885-9010-9ff4166e0f1c", "value": "24576:6qZk1rTNVOh1F3cQXm7oK7aI94UP07Bj3jG7QqyX8OQgJtjBuMz8d2CRNjF:fZk1rTNVOh1F3cQXm7oK7aI94qo3jGsy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697997652, "uuid": "8fdab4d6-4db2-4eba-bc64-fae3e6906469", "value": 1214464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697997652, "uuid": "cdf5516c-8bf1-44cb-91ed-4229f88f0575", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997652, "uuid": "101eca5c-1d56-4cb4-90b9-cbab5717ad6d", "value": "img09202023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f325ed45-70d5-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1697977470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977470, "uuid": "5d17d4de-a7d7-4271-b46b-d1def54718c9", "comment": "Malware payload (Gafgyt)", "value": "d832b09e183b73cfce6c3520d46e3b4c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977470, "uuid": "c2d2f697-f655-4baa-ba67-00642e115aa1", "comment": "Malware payload (Gafgyt)", "value": "b7434292e44e19e2c62c1d4d69aacc9946dd457d79bf38933f7988ed9e4895f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977470, "uuid": "a6148a58-11ab-499a-8957-57fc377673e9", "comment": "Malware payload (Gafgyt)", "value": "c9fe4c37793a0987d49d52bd8bb5f00c2943bd21", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697977470, "uuid": "84287e23-732d-459c-bb03-3f2aa5aff87b", "comment": "Malware payload (Gafgyt)", "value": "82450df2ffec5f4665eb88337a4614d4c3957e399874be5fef1cc9316576cfb4f4986142f8b86618d2ee482c081dbadd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697977470, "uuid": "c8112ef5-273d-481a-be7d-5d2234c9af14", "value": "T1A7F39436B7618EB7D81ECE7305A945121C8CD99702D92B6FB2B4E518E76BC4F08E3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697977470, "uuid": "1d2aa9cc-b189-439b-9d5c-5ae692170371", "value": "3072:/CIdWY6DDtQ7dLzyyNbLbQrT4tanOFrJqNb:/CvDxQhLzRNbLbQrT4tanOFrJqNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697977470, "uuid": "b549d8a2-b355-4f4a-b506-d861984097a5", "value": 171425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697977470, "uuid": "73464924-0c8e-419e-8157-1731b58a8f9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697977470, "uuid": "492f8fd3-8928-4ca3-89cd-094556867991", "value": "d832b09e183b73cfce6c3520d46e3b4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaf91629-7090-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697947821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697947821, "uuid": "d056fcb0-d7c5-4bb4-8f4a-b70a2053fff9", "comment": "Malware payload (LummaStealer)", "value": "922d837e2362b26f6f5959eb3dee8ac0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697947821, "uuid": "2286fe37-adf1-41ed-863b-ece638f31c3a", "comment": "Malware payload (LummaStealer)", "value": "b77f4d3db225704207278652cd1a4aa67b4bd324765d977e60124652672063dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697947821, "uuid": "1a714ecf-560f-4481-9dce-932c11573b61", "comment": "Malware payload (LummaStealer)", "value": "90daf5ded16aec44ccd8acf6486883b1ebebb2c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697947821, "uuid": "92c08eed-a426-4af8-b60d-62af88ae5721", "comment": "Malware payload (LummaStealer)", "value": "5f29e069a12e338be283a645884526282a538498f7b4fbbdb4278af1261199a5ff4bf74b8b9fbbeed34d84aaf91cb394", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697947821, "uuid": "a2b23312-0d46-47ec-90f0-a8b8bd9b014c", "value": "T1E165235BA6D42173DAF60BB4D5FB13A70B35BC525A74932B2782A56F0CB2AC09431337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697947821, "uuid": "f52c8b7c-a1dc-416f-98f4-02d6045e4378", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697947821, "uuid": "698cb7f1-49c5-4a73-99ec-258058473aa9", "value": "24576:myAE9WyjafEe/+FXfiSA7OYZKd5JHS7rJdTqTHNBNLEq5GEUXgg1lmq:15oEafrKXfdoOfJHSJZqTlLJUXgA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697947821, "uuid": "0f72f124-9c3d-41b6-8527-7f2bfb59dc59", "value": 1491968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697947821, "uuid": "97be23d0-dc74-4974-aae7-2d03496acd14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697947821, "uuid": "dd72d2d5-b5f4-4462-a7fa-bfb0d322daca", "value": "922d837e2362b26f6f5959eb3dee8ac0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c4f2f8a-70aa-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1697958802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958802, "uuid": "26bcedb2-68b8-44c0-9c1e-86593ae12c04", "comment": "Malware payload (SnakeKeylogger)", "value": "c3fd40f62d9b66dc9907f57cb51dfc02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958802, "uuid": "29d1cdee-ebb2-4322-841e-ad0740e4f475", "comment": "Malware payload (SnakeKeylogger)", "value": "b9c36da42919719dcadd5252cb675cad35f0f63566b24a7a95fc0f5dfddb5497", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958802, "uuid": "48fce52d-9ac2-426f-a6ed-4c9defd3b7de", "comment": "Malware payload (SnakeKeylogger)", "value": "4c315086caa77760f3a5439fd06b33d31dd5ee9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958802, "uuid": "add81232-b81e-48ec-ba00-ea4eff4458bd", "comment": "Malware payload (SnakeKeylogger)", "value": "f3b58c278a0ea680372a7d446d8e66a5db40a3eb871c600c0f020ff2d0d8e0923a2cb3a051af3fd8b7b8778fea6c54d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958802, "uuid": "fd31c4d1-eeb9-42fe-82c1-d1df16c0b58e", "value": "T1AC74019E292DCF24C74F1330E65A4310523896378407E7496FD6B57A2A73398ED4AEF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958802, "uuid": "e35d7872-80f9-43eb-81d0-6d7ce13bfacf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958802, "uuid": "14e810a6-7e40-4350-a272-13e00ccb76a5", "value": "6144:L0ntBIKD2SJMzsdRytZNYvzMsKTBhoR/wHD3IRopPMM2QAxWaqJJzdk6ceh9X3PL:stfD2S+FeZesOR27hCfk6ceXs650", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697958802, "uuid": "deb488be-4810-4b02-aa67-832cfb09c307", "value": 365056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697958802, "uuid": "c1d2081b-11c5-4ff5-875c-f3833cf9ce12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958802, "uuid": "d3f0afa7-fb31-4150-a88b-3a4a16c49df9", "value": "KH098765680000000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70836bfc-70ab-11ee-8907-42010a9c0042", "comment": "Malware payload (404Keylogger)", "timestamp": 1697959212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959212, "uuid": "0f3ecf51-d31f-4fae-9edc-2376207528d1", "comment": "Malware payload (404Keylogger)", "value": "bd0c8445b28a28372a7f0127255c28d8", "object_relation": "md5", "Tag": [ { "name": "404Keylogger", "colour": "#252FF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959212, "uuid": "b8d67a44-302a-4dad-a117-da2111030220", "comment": "Malware payload (404Keylogger)", "value": "b9ddaa5f4184a903b5e697bbe07fbf4661ac0410ba07c9f44882ff466b37ba3b", "object_relation": "sha256", "Tag": [ { "name": "404Keylogger", "colour": "#252FF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959212, "uuid": "24c17a1f-6fa4-4207-bee8-c3d4f5e8ada7", "comment": "Malware payload (404Keylogger)", "value": "6305bedaef3391409609ac26ae08b58b0dce58a3", "object_relation": "sha1", "Tag": [ { "name": "404Keylogger", "colour": "#252FF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959212, "uuid": "637d018a-535a-49e8-af7c-984d2e5142f8", "comment": "Malware payload (404Keylogger)", "value": "68b65b1d17ae922aae165bc7ba89ce40fa2ee1d04bfc05a40094cdf5f2e2ebdbdda4c095febab5f88eea1c2300565832", "object_relation": "sha3-384", "Tag": [ { "name": "404Keylogger", "colour": "#252FF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959212, "uuid": "8db06f23-a046-40bf-ba4d-8f4872ade4a4", "value": "T1D9E4012136FD475AE0BF8BF248291A489B74A5BE2416F70C0DC370DB25A9F848745F9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959212, "uuid": "898f4c4b-e783-40b1-b047-17af5cc8732c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959212, "uuid": "4c391d7a-3755-48f3-ac70-d1f3c6151d65", "value": "12288:c76yiRJU/WcrUPEKsW8VkbSM8OcGyFfQk5crM8NKYn8:gBFeu2e3VeiXCk5Oa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697959212, "uuid": "2372b27e-37e5-4ab7-98b5-425e04a9f24e", "value": 700416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697959212, "uuid": "d8ef4fc2-241b-428f-8a39-ad0c726878ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959212, "uuid": "40a41d03-6140-41e6-96ac-91c7336bbcc7", "value": "bd0c8445b28a28372a7f0127255c28d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c0ba6b9-70ae-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697960439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960439, "uuid": "d5a5655e-d00f-4460-a8ae-cdc70fdf16d1", "comment": "Malware payload (AgentTesla)", "value": "34d89335361763bb3b593c5343b9e48b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960439, "uuid": "3b2e578a-80de-49d8-96f8-597eaafd65d7", "comment": "Malware payload (AgentTesla)", "value": "ba265838add6a233d8c2d1fbe1ba1869d2e528a6790b24259c56a199a2f038cc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960439, "uuid": "d98b1913-a5ca-4ed1-9f4b-f47658c4cb22", "comment": "Malware payload (AgentTesla)", "value": "273298c505629472de86081488f069fc2a1a89f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960439, "uuid": "986a02a4-e388-4843-ac51-53131453d3bf", "comment": "Malware payload (AgentTesla)", "value": "ac5de52f8af49d70b36cf180f43bf5a2ebb354b1ddd7483ae968387b61a31f05139d776c719440c36081c35805b9abd1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960439, "uuid": "f5757cf5-cfde-463a-91c4-b229bf9d7b08", "value": "T1D8C4134833E20332C1F99BB9957147951BB636EC5932F7296EAC60F53AA3F441704E8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960439, "uuid": "dc145261-8aa5-4435-93d8-2a16325cb51e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960439, "uuid": "a3cacd3d-ca6e-4de1-b35c-0a4b4c683f36", "value": "12288:il61vjJGGna1Vvc+7qRUo4yu5uwGkqZmmWcwaMVuLaz73ARR1OAvf1:il61LJ1na1VvgUo4yauBkiWvMYqcy1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697960439, "uuid": "cb1c186a-6250-4d2c-bcf5-c765e6b57458", "value": 587264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697960439, "uuid": "0d196dc8-1b8e-401e-b045-fb55a7ab43a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960439, "uuid": "f1f64600-19c9-42e5-b677-5037815dff8e", "value": "paymentAdvice09312023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "661cad84-712d-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698015029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698015029, "uuid": "e582b2b2-4ff3-4e6e-8488-841545274587", "comment": "Malware payload (Formbook)", "value": "0a825802ce5c89853836f25bfa73f734", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698015029, "uuid": "d9f6ef4e-f858-4834-8977-948e35d75796", "comment": "Malware payload (Formbook)", "value": "bae695d097b890cff199e0aeaeea8cedf4d1b520a0d77a0789fc4f9e5c0bbcd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698015029, "uuid": "d1cbbed2-7536-44d5-94c6-527f17444186", "comment": "Malware payload (Formbook)", "value": "bcc7f68f904ef17a9003cc372680c1850420fd42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698015029, "uuid": "c2e66154-3709-4669-ad83-5494b7487db0", "comment": "Malware payload (Formbook)", "value": "8d62f26454a79969d92b2aa5b078e55ee28f8d1c4ac6d9d47edc3c2b6e66051f5e6575d592437feeb8ec5f561c785be2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698015029, "uuid": "0c636017-c541-488c-b1f6-aa890e2899de", "value": "T114F41202BBDD4422DDF167F05CFA02D30736BCE78EB852662B15496A0DF2295B876362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698015029, "uuid": "ee89a663-6c06-48dd-8f00-8314daaf4cb4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698015029, "uuid": "6f927b6a-68fa-4da5-a135-0a0dedaf76f8", "value": "12288:/Mrxy906tiYFuXTphm3yq3MXm34VRupODOegOqfLWm3mpS6o7uCmSyDj:OyDr0XTXq3MWIbTYOQWpS6So", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698015029, "uuid": "7e6dfe46-83c3-43a9-af8d-06b18514500c", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698015029, "uuid": "1fc19549-f667-43c7-88c3-0ba8c5578287", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698015029, "uuid": "d2af691c-c3f8-4d7d-928b-6d13c6c8971d", "value": "0a825802ce5c89853836f25bfa73f734.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9df2195b-70e7-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697985058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697985058, "uuid": "08dbcc24-47eb-4885-b0ad-251366f0f399", "comment": "Malware payload (LummaStealer)", "value": "bd4d214295e90511ff5531e43a1691cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697985058, "uuid": "2f482361-b3e3-441c-b0f3-da7a972f087d", "comment": "Malware payload (LummaStealer)", "value": "baf9296588edacc9274caf8b74aaf2a0cc86a42564f083e7d46c536262e9d903", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697985058, "uuid": "01cf5818-eea1-4f0a-bac3-fa8dcb2d33a9", "comment": "Malware payload (LummaStealer)", "value": "a5946a4a1b9600183f73068bd2b28b8f99219b3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697985058, "uuid": "2ee3633c-881a-4848-9d54-eaaf1e42f035", "comment": "Malware payload (LummaStealer)", "value": "b6e57d2f218402a3cf178cc22ed4425a8765c3c0975698197c3f9b6271eaae56d7ecdc188c06b41ae97a88d98bf2c45b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697985058, "uuid": "ded67b0c-fb25-4194-8a17-fda4782f9dfa", "value": "T16285236276E5A572ECE8137064F606431D36BCB1CBB2A7172A84BC9B1D723C0B4B1767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697985058, "uuid": "7a0ad11b-ccd1-43e4-b972-17260247d1ac", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697985058, "uuid": "940698cd-14d8-4a48-b917-91dcd0145f24", "value": "24576:Ayo3iMPOCLpmShbRDWgz1YaAIQsK27tCI3R4WMNyHEcePGIV9O3dfB15H3:HX0jbR/1Q/7AHMsHEHPlw7b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697985058, "uuid": "6f868a2a-37fb-4e4b-b042-a77683516dd2", "value": 1842688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697985058, "uuid": "817c1db1-762b-4716-95b7-253a115d8f00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697985058, "uuid": "4b4f94e9-1758-4fd7-ad19-cc69650088a9", "value": "bd4d214295e90511ff5531e43a1691cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8b42568-7105-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697998068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998068, "uuid": "a475f0cf-8d16-4d30-92ec-4def868205ee", "comment": "Malware payload", "value": "2f5228d86cfe24a02fe678c9dd43c220", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998068, "uuid": "08d75aea-f408-4cb9-9552-55475d6925f3", "comment": "Malware payload", "value": "bb408563d5078aed3a3c8a22fe27f1c7db6ab5b1c2eb01c0c4a6a0c6c2cc663f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998068, "uuid": "72aa35a9-b094-49ec-a9d9-17c940747203", "comment": "Malware payload", "value": "1f8f359a2649b6a6026834a4db8567adaf45f7d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998068, "uuid": "4d413875-f98e-4f07-86ef-6ba9f54c9126", "comment": "Malware payload", "value": "55e1a6d82af774d477b2219b6663c2d860ece368c61658315cc728d48d93619c10372c366d3342f01000073cd856227f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998068, "uuid": "50aeaa1d-fa0a-4481-b3cc-27b8c8f76bf7", "value": "T19E46337F93A43A0EE0421935ADD39466ABFDDD0C2035E3C7B1D5939CB0687A56B1CB0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998068, "uuid": "3de76e6c-c1e3-46b7-ba58-8fe0ee37d548", "value": "98304:owr2GPG3HkTWLQN+wY5gawfnE2+VKJf9+Ek7CEFxyqZoL9FxNszODpqKhYg+U:VN+3EykNlY5gawM26KJV+EhixFCJF8OP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697998068, "uuid": "86a799d6-7177-444a-b281-92f62ada32ad", "value": 5735033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697998068, "uuid": "54e1a25e-c132-43fb-bc7b-e2083d335657", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998068, "uuid": "a62bae16-250d-408e-99c4-e6c6e7526a61", "value": "2f5228d86cfe24a02fe678c9dd43c220.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2faf09f-707a-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697938359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697938359, "uuid": "ab2ba4fc-fc2a-4991-ac56-2873f0c1e509", "comment": "Malware payload (Amadey)", "value": "1821ef6332debf63f0c98fcde19b2f2d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697938359, "uuid": "6042ecd7-087b-4fc4-8104-00bc7b54be1b", "comment": "Malware payload (Amadey)", "value": "bc5d2f1649b96a8d50cf4f7184f421a073c0e653d25a068222ecb40b253b53ca", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697938359, "uuid": "decfc633-ff18-495a-8d68-503741e14b4f", "comment": "Malware payload (Amadey)", "value": "8892583c6b22d3894c4cce06576b99fa04d52a8a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697938359, "uuid": "84bd5d5b-5661-493b-b14f-8367d1eee123", "comment": "Malware payload (Amadey)", "value": "552c508c6d524c0b01bc9144b7f81c40efefe036b602f9df7d450b17c254ca4e4143afe81e58d36b2a1324a46454aa93", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697938359, "uuid": "82a986ca-f55e-4302-adc1-39a2f1539370", "value": "T1A7652323B6E40136ECB2277069FA1A4726353CB0CE794A0B3B59F59E68736D444B437B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697938359, "uuid": "709ca45f-ac05-4901-b3db-1bdeb731d135", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697938359, "uuid": "cc3c30c1-dd31-40c2-b9d5-c37f5f38d8c7", "value": "24576:/yl7PDDXIOZvTHL9j4A01OKWlNRuqodxQ6aPAGB7noroEW/B:KlHH2/1Ox9exQ60B7nlEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697938359, "uuid": "052cb1a7-eb62-4f53-9480-8c4d114f55ad", "value": 1496064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697938359, "uuid": "d995a8bc-c9de-4b9f-8094-a830dd306d88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697938359, "uuid": "cc51ede2-bcf5-4bb7-970e-15943d6d8e5c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b4cc5c-70f9-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1697992555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992555, "uuid": "b3b65ab6-a8bd-4dea-a64d-a9e32f8e4c72", "comment": "Malware payload (Stealc)", "value": "b64709413a36f0a4107ff9591841efb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992555, "uuid": "56ef7ae3-6795-444c-9aef-29424985a108", "comment": "Malware payload (Stealc)", "value": "bcf4ef94bbc060323e215f9ec7674609414ae2e1b00d53a09eea903416a9ce59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992555, "uuid": "707463fc-109c-405a-8beb-23f3db27a636", "comment": "Malware payload (Stealc)", "value": "ef86e5ed41455861c9604d5e47e919508b7f8880", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992555, "uuid": "905ca61c-54ba-4d06-8e54-78a53ef5ce7c", "comment": "Malware payload (Stealc)", "value": "7851bfa53f16941d3f3059acf1f29cec3776a558d4fe77cff860dfedfa354f5281a41797e45fbda7ac24df0dee070863", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992555, "uuid": "e743b4f5-bf37-4c57-92de-bac1fd23e45d", "value": "T11204BE1076E08072E1A769345970D2A12A3BBCB26B7540CF37983A7E6E703D19F76753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992555, "uuid": "e9a5f313-ad9c-45d8-a446-b979dbd416dd", "value": "6ae03e1897875cb6ffee8a530dc88389", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992555, "uuid": "f2f15a9e-28a8-4b08-a935-a488d2b73e5c", "value": "3072:AEyBN6fIr6A1scr3xvsAx+EgDudEaKh4oF2UQyx/H23QKxYQX:Qh+A11r31sAxLRdVBFylHR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697992555, "uuid": "5f719e7b-6558-43ab-9eaf-9cbe18b110bd", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697992555, "uuid": "76be6ec9-708e-4780-85a9-a7ecb7c1cc8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992555, "uuid": "ad4eaf8f-f8ba-407a-be37-9128a848c36b", "value": "b64709413a36f0a4107ff9591841efb0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8ed3c55-70af-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1697961132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961132, "uuid": "e54e786e-f0d2-4a99-972f-695e778cd497", "comment": "Malware payload (DBatLoader)", "value": "02cacab858429c58516ed1a24b344ded", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961132, "uuid": "d173bac0-6da9-464d-ba84-30f53de2ec48", "comment": "Malware payload (DBatLoader)", "value": "bda80c4c5d44d45684f6d1b7726a72f40f5a398304041bba78ab376cadac3fb4", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961132, "uuid": "80c8717e-ec0c-40ff-87b6-83c455b953bb", "comment": "Malware payload (DBatLoader)", "value": "9b8a2adcd0cf0e12de5176709a6d089945b07753", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961132, "uuid": "f50b427d-b058-4c41-9a54-f3f0efcf3998", "comment": "Malware payload (DBatLoader)", "value": "f1ab789df8d85d632a4098d4832b9c1a54e492365ab5151a059ac10218d1b387a00dc402e18dcee4c86e754bc2a24af5", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961132, "uuid": "21814331-1961-4623-9157-f9cb016e1616", "value": "T16895F135B2F29437D1734B34DDAB92A5893B7F203E28989667F81C4C6FF52843866187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961132, "uuid": "d9c2eaf3-4d61-4f1f-b641-21e1867ed3b5", "value": "4569aa626af1b80196dcb0b68adcc830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961132, "uuid": "963f2ef3-f87e-45f7-8994-b56b6550dccd", "value": "24576:3Te9LrsMoZkD/VOP/6juQp6DjasufyJIZlnLxGgVzwmDi1ETNay76nBWWnmQqKAU:3Te9NLVfn513VzrunxxND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697961132, "uuid": "442ddb8d-e5ef-4b3b-b28b-c6211caa448f", "value": 2039296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697961132, "uuid": "d52b8c26-7bb8-4117-baa2-0590787997cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961132, "uuid": "756baffe-4e8f-4d8f-9250-25a3e1f0a382", "value": "02cacab858429c58516ed1a24b344ded.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a7572ec-70b1-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697961698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961698, "uuid": "9d65c041-ab30-4406-9bb8-1a965d859e95", "comment": "Malware payload (AgentTesla)", "value": "609df6f45affdcbf51cb39a5fcfaf415", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961698, "uuid": "cdf83400-b01e-475c-94eb-bee492d32ce4", "comment": "Malware payload (AgentTesla)", "value": "bef157a5652da00c4e51f79e8a96bd0017216ddec319309074338c2dcf3dca8a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961698, "uuid": "acb7b547-a60e-490b-9b98-2bbe66599763", "comment": "Malware payload (AgentTesla)", "value": "dcc8c0fc0bfe4ac0621da24292cabbd1cff2d3fb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961698, "uuid": "f84cc74a-17a2-4149-9b04-7a38ca4e0bed", "comment": "Malware payload (AgentTesla)", "value": "cc756d4afd3ec4649660b4c1d1b7b445c4193b4e8248f143a5df0f5509de93c92372cb5c2399dd2593079fb3280659f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961698, "uuid": "d212b3ab-d8aa-4825-9559-17d2ec700e96", "value": "T1A4E42322A528D62BC41D07F7286151C1873BAE230115DBED6FD570E937F2362AF2A71B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961698, "uuid": "deb35975-e5da-4aa5-8196-88b52641e3f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961698, "uuid": "765e3e49-54ae-4830-8d60-bc20e68a2f2f", "value": "12288:Ub5yzvbYmBHmiR1d+f+jqqAUxCucPUV0uradJu5K+4vmST5dJmnqWA/8QgN6e3:mebY0Gw3+W+1Ux9cPqXrYu5KRmSTVmnT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697961698, "uuid": "85bb4083-5f2f-44f4-99f1-e7cc7590d6f2", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697961698, "uuid": "2709b2c8-daab-47f0-95f3-f26f750f8447", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961698, "uuid": "501d53db-4676-4ee3-b5c2-ea0237842d0f", "value": "RFQ_20102023,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3ad77ed-70a0-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697954627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697954627, "uuid": "0eafa3d8-a762-41b4-88e0-760778235740", "comment": "Malware payload (Mirai)", "value": "6237a159b42745e9aa84668234a43640", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697954627, "uuid": "ddf8109b-5a7b-495e-ab12-683f0077fbb6", "comment": "Malware payload (Mirai)", "value": "c033af90aaaf95cb228de9049252bbe481c6fe2f5a1cc8f021d0c64d0f34fa8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697954627, "uuid": "9aa04f4b-5ea6-418d-be9a-db3d4511c762", "comment": "Malware payload (Mirai)", "value": "3955550b439342120d680f354aea336d5dcc0713", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697954627, "uuid": "6db21604-642a-44cc-810d-2159c0c71cc4", "comment": "Malware payload (Mirai)", "value": "cec665e1bcd88f7c0e7c5fde183f8ddfc29a7b9b6a7c7f043fc01873e1a26aa9cf376a2b7c6ab78c310a16ee89fd803c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697954627, "uuid": "7f477aff-0816-4a80-ba5d-c53b6a688d3b", "value": "T139535CC6B8119E7DF5CBE6BE84224D0EB821722150931B27BB6FFC837D731648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697954627, "uuid": "174f3693-b45f-49ec-8663-6221d1e459df", "value": "1536:AXyRgQFTTbSX5dhLepSGYacFuxYhON2PPB+qG76E8x:N1GjR8EVGO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697954627, "uuid": "669cb411-148a-4047-b60b-bb03712721d6", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697954627, "uuid": "c1515cf5-6e01-451a-a825-89d5d6cf3ff7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697954627, "uuid": "3240e62b-3f03-46bb-a47a-f4cec38f3e9b", "value": "6237a159b42745e9aa84668234a43640", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f24f5b94-7114-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698004527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698004527, "uuid": "b8d3acba-a027-4a39-b1b1-3664f83c08c1", "comment": "Malware payload (RedLineStealer)", "value": "f21055b866b284321cd9a4d541043041", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698004527, "uuid": "83999190-e797-41fa-9dce-593fe15e20e0", "comment": "Malware payload (RedLineStealer)", "value": "c1354dcaa9389550c2013e23418bb5c71474b6c368f8e68e51e31faa64ba4ea1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698004527, "uuid": "25f8dccc-e8ec-475a-84ba-56a06a4df3c3", "comment": "Malware payload (RedLineStealer)", "value": "c9d2474f85c6bc49f904622c8fa4c7dcad9ba27d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698004527, "uuid": "fb520e94-0df1-492f-b67d-9869a9e16a58", "comment": "Malware payload (RedLineStealer)", "value": "be6839a8e6a591f8db848d78b750064d939a8f93eb781b97e2ed8d675c95b2308c489e59568ed169ba67d92c7e38735e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698004527, "uuid": "dde79279-db17-44e7-a0e2-c45fee437fe6", "value": "T160956C1BFC9454B5C4AED6368A66A1957B31BC040F3123DB3A90B37C2FB6BD0AA75704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698004527, "uuid": "4cc913c1-9f6d-4e19-ba63-9a142d912f29", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698004527, "uuid": "4797b226-ee39-48cc-9122-618d10e138cb", "value": "24576:vHvjVNpiW5R8oYo5VPIoajWxivzxRogitpe1flIvJfFMU6wHUp1A:v7nUW56boxajvXMEmJdMHaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698004527, "uuid": "92adbfc5-46e7-437e-8371-83ab8bd9b546", "value": 2009088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698004527, "uuid": "6c137901-64de-4162-92a5-e58f6b24f19c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698004527, "uuid": "90ddb124-c548-4ee4-b60c-a89d422f902f", "value": "ab7a0cfcd79996f8d24cf6a207095bcb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c95c48-7133-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1698017500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698017500, "uuid": "e69154af-16ea-4752-ad4f-161e8145903e", "comment": "Malware payload (Mirai)", "value": "b911b41ab130f10d1f42cd6d2b62fc7a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698017500, "uuid": "c9d2cf53-291b-41b4-a623-d16287917caa", "comment": "Malware payload (Mirai)", "value": "c16efa1f285161628720e66c71a2b189e8b10b8c6a257829aea0ca81c9ced09d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698017500, "uuid": "1569623e-e65f-420a-a4a6-dbb107746da9", "comment": "Malware payload (Mirai)", "value": "c1fc84138e377dffdc8e1b8953c4ead9412b4ab2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698017500, "uuid": "21fbd00c-7ff9-41bd-bd05-20f743fda501", "comment": "Malware payload (Mirai)", "value": "b8e31b02fa009c91cbfa8d8398220e7e35e4ecaeec19c20ed433861f7226e40e04419ebd24bf8ab6267a03390ffd69ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698017500, "uuid": "ecf8de45-c234-43cf-87f5-be0b84b6809b", "value": "T179F33C46EA418B13C4D62B79BBDF425633239B64D3E763068528AFF43F4679A0E73501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698017500, "uuid": "7cf4f403-47b0-42fa-9adb-95c64b20b5c6", "value": "3072:l2jvkxgzR32uAcbJaG85Nrw1xzNBy68ZxFtNKgv5M/9TEK:l2jvkxcJaG85NrwPzq6yx7NKghM/9TEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698017500, "uuid": "e6f9fcb3-dcb7-4427-b35e-4cc6fb35c390", "value": 162946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698017500, "uuid": "41f4381b-139f-49e2-b72f-6f819a772376", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698017500, "uuid": "75c687f3-fc25-404d-b6e6-e3a799cff721", "value": "b911b41ab130f10d1f42cd6d2b62fc7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7243c1d-7115-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1698004830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698004830, "uuid": "7c974020-faa3-49e9-93d9-086a9122bee8", "comment": "Malware payload (Formbook)", "value": "b852cc7ef18ae94ac4204ee99b0b23f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698004830, "uuid": "be454818-a0de-4c3d-a56a-cdeda01638e5", "comment": "Malware payload (Formbook)", "value": "c1b9b1ac584870f1a63dda7d1b46c6b4daa0862e3def6b22480e8be47ca0bed8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698004830, "uuid": "08ee9192-1a85-4ade-8b33-0afd8cc256ef", "comment": "Malware payload (Formbook)", "value": "eddc746025dd1693732c1856cde3ca0c5b2e3c45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698004830, "uuid": "1bcf0138-bdf5-4530-990e-a1433edfd248", "comment": "Malware payload (Formbook)", "value": "53f0037510d1c1e9fab1081478ab4a277ea14c7115ae584639aef656d18eb8ce6eeeee9475701b8a60dc1bf696635123", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698004830, "uuid": "4a18202e-114b-4e65-8484-c4dbb6ee6402", "value": "T18F049D1174C080B2EA72193609B0EBB15E7EFC340F609E9B6BE74B725FB02C19675967", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698004830, "uuid": "e2c38d4a-5db9-47da-9069-9c0892d47e95", "value": "8c347d587a6b42414b9cc837958b02c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698004830, "uuid": "9d3810f1-0d20-4d4d-89fc-ca606fe43244", "value": "3072:PDQiwizKw/kal99mdVeiOEru0PIBQcuHs60KHp7xnd:POK3l99cV4EEuHsVqxnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698004830, "uuid": "8ef3df0c-c6f5-430c-a2ca-e46553213608", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698004830, "uuid": "043c6cde-7e8a-45ad-8efb-f7519616f542", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698004830, "uuid": "62424f34-f812-467f-988b-9f3e1617dedc", "value": "b852cc7ef18ae94ac4204ee99b0b23f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b3dd5a4-70f9-11ee-8907-42010a9c0042", "comment": "Malware payload (Nymaim)", "timestamp": 1697992784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992784, "uuid": "9e8f91e5-8979-424d-94b7-582af12c62fa", "comment": "Malware payload (Nymaim)", "value": "9ab9bb50d51e41faa3701c170847482c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992784, "uuid": "053890b0-e0ec-410f-ba8a-3af794f7df28", "comment": "Malware payload (Nymaim)", "value": "c21780bbce51e887ead9136cbe9bf5988c58464863144ab83035a1c2b5828387", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992784, "uuid": "325e0ff2-f338-4ce1-99d2-4856ed2dc5f8", "comment": "Malware payload (Nymaim)", "value": "73b2784d96cf29c53bb13ba6e3a9e0d7660d6fad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992784, "uuid": "a01e1d3e-a8d9-4d9a-8769-3b0abbf7590d", "comment": "Malware payload (Nymaim)", "value": "9b2e5983120418c0b15b17f10995eebe9b6330dc30858c0abc674d06b4832cdfbe4f4200e10066710c339f9fa715407f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NyMaim", "colour": "#0E3AD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992784, "uuid": "063bfee9-83b6-4044-ba5f-44c00ee6caa9", "value": "T13AE4127C882927FDD76D67794CDC883CBF6222A54EA8A448179935D66F01F206E32FC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992784, "uuid": "450dc282-fa11-455e-986c-25479f201373", "value": "3f612a85b383fc846fb2c4f939b907f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992784, "uuid": "3a00b831-85f3-492c-b002-90cb2b1f164d", "value": "12288:pWlx4HF04aNmCnhdPBSv2ZoEvzC5Q2RqJ45PpBHN9XTKlN+6Sl0o3K5qmnHR:pSx4PQPBSe/G3W49DrXel86SVaJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697992784, "uuid": "e4ba766e-c33e-4080-9f73-f288f971dfbd", "value": 688128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697992784, "uuid": "4a395110-ff1c-4080-a0bd-3587cdeb771b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992784, "uuid": "62b56108-b8d1-4698-b037-460fd78250aa", "value": "SecuriteInfo.com.Trojan.Nymaim.238.11814.13246", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ff0120-70df-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697981426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981426, "uuid": "aad84ce0-6f20-466b-bcf1-ec6c24c6656a", "comment": "Malware payload (LummaStealer)", "value": "dd6dcdfeb2323c093ac0d82770fff601", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981426, "uuid": "de67ac42-b9e9-4e2a-9586-c5ce95f47032", "comment": "Malware payload (LummaStealer)", "value": "c38e73c6ff9f7ae331150ad7ca8bfea3a49971fd29b205d726d207963494c545", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981426, "uuid": "1c2d3636-6c84-4cac-880b-25c9949d0844", "comment": "Malware payload (LummaStealer)", "value": "d23a96770825f38f60b7f138b2bba8e43445dc4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981426, "uuid": "c7ab7325-fa87-4541-97c6-24d654e7d0f1", "comment": "Malware payload (LummaStealer)", "value": "3e324d13c24758c94d2ba7f5487f0ee209333e45fd0a4fca9b351fa0c2a7b45c6b59416ab5c6f2461019dc19680e2b5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697981426, "uuid": "edebc927-7b63-41c4-933c-c2d914090f7b", "value": "T1E9852323E5E44023CA7513B44CFD975B2738BD612D26437B2B9AE45E1CF2698B93432B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697981426, "uuid": "62bc9c16-72b5-496f-9d7c-c9cda87b4f56", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697981426, "uuid": "90a78a3a-ff7c-4c33-91d8-d701eca8b398", "value": "49152:7Sp0DDW3NzKz6zQjgkbnRUA/b1jQrQGJW:i0DDWkzrtUA/JcrQx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697981426, "uuid": "42c83d6a-bbee-4439-9270-315ecc933a56", "value": 1836544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697981426, "uuid": "7f89bb55-85e6-4979-8812-aaf4d5b98bf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697981426, "uuid": "2eb7515e-e596-4d46-9d50-492e28e88308", "value": "dd6dcdfeb2323c093ac0d82770fff601.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36e0c6f3-70e6-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697984456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697984456, "uuid": "defa14fa-e34f-4e48-91f1-db894c964a49", "comment": "Malware payload (RedLineStealer)", "value": "0dfc38f5fe0451fcaabe1af94be1dd08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697984456, "uuid": "24f3d979-7529-4a7d-a72d-54875cb91aae", "comment": "Malware payload (RedLineStealer)", "value": "c4381d9ca9184e49e88f2825a9abfcd69ccab4d3eb04b1947105bf3b073778cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697984456, "uuid": "cd068b9b-fb2b-4c46-847a-c6adbcc27ba8", "comment": "Malware payload (RedLineStealer)", "value": "22aaa3e068b6ac5ab24fba0d4777679f2e7ff5a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697984456, "uuid": "03008929-be21-4527-a1c2-fccd2149106d", "comment": "Malware payload (RedLineStealer)", "value": "83f0db61e7d4cf0d639e92f4efd39398a67f1c905ad3b0c56faa632e1cbb26bcb64f1a8905e5e61a72fee6f3540ebd8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697984456, "uuid": "934566c6-d65d-4b64-8993-7151d9b0f4f1", "value": "T1D16533A3AEC44163D9F9477808F65BC397347D026A31C5A21B817C6E59B32E61CB6B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697984456, "uuid": "76455220-db2a-4670-8e52-0f336b6c1b63", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697984456, "uuid": "a03ebd35-6101-4ef0-a667-ae142b9d679f", "value": "24576:RyC/xjsIQR0c1/18E4IDoNzI61MqEuXYiMjEcWDp9xUmEKl4d4Ix9o95Rh:EQjsZ2c9EIDoW6kuXYjjM9xUmjKdL9gj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697984456, "uuid": "8cbd17da-6fa5-4b30-9ff2-23f6fff1e355", "value": 1539584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697984456, "uuid": "bb47a9b8-30d8-4940-bce2-be6592b99f74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697984456, "uuid": "b3fd2c47-b52d-4aaa-a95e-80441f900225", "value": "c4381d9ca9184e49e88f2825a9abfcd69ccab4d3eb04b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b72c6a-70ae-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697960425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960425, "uuid": "91b56cec-bf4b-49ba-8db6-c49647140067", "comment": "Malware payload (AgentTesla)", "value": "01bad3c23c560177ea0fc99980e64187", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960425, "uuid": "5534b99d-92a9-4827-b107-da74cf07cbd5", "comment": "Malware payload (AgentTesla)", "value": "c47a112d279634c2f0ed20a66b44d3db3c0fcb0936a07f8a133acd06f506eb09", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960425, "uuid": "bf18f3ad-9e0c-4f9e-ad8d-b4cf93a697eb", "comment": "Malware payload (AgentTesla)", "value": "96a12cf86798517dfe7206e1ef3630f3d0557562", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960425, "uuid": "acb4e54b-c1c7-4d27-92f8-fd52ee2beba3", "comment": "Malware payload (AgentTesla)", "value": "ff736f56d936fdab22944703da01bd33210dba46b80af469f809d85de8256ef991271caa8ea124cdc7e8cba8edfb83ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960425, "uuid": "bbf983f5-44e4-4ad5-9701-8ad28dfd94c4", "value": "T10DE4228E73F05B32C8BAE37D56B52390533A95155A32FB194DAC81EE6A23F0C0605F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960425, "uuid": "536b3730-2a8a-4b99-aef1-8edf3283b516", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960425, "uuid": "99d9f31f-305d-4da7-b2d2-70a3b2681482", "value": "12288:3601vjJGGna1A8VezDhZpEkq8gd0lhAugx4nb4+d3f/AG+ystloQ41CtsUV4o4/1:3601LJ1na1A8VGblhrgu4gHAGyT4Itxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697960425, "uuid": "e6034269-fa50-4240-9468-fc01de8ffb52", "value": 661504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697960425, "uuid": "5d127b4c-8e96-4f06-a432-69880dd4f8da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960425, "uuid": "7ed2da65-2105-466c-b965-9f4196c1526f", "value": "001102992002pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f30af0d-70f9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697992791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992791, "uuid": "d477a378-bfd8-4709-aff1-d05a9b4f1a41", "comment": "Malware payload", "value": "67072ed93ef85c8c584f99c2de2c2fe6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992791, "uuid": "2adbbf3b-7e00-4535-8c3f-1e6fbd59f040", "comment": "Malware payload", "value": "c50e55ca96b9f0829a545d619ffa0bfed1b198b3baaffda97c5c676aad6c1f2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992791, "uuid": "d49d1a6e-7d14-4225-8921-1da83ad8982a", "comment": "Malware payload", "value": "8a228db83fb752dbfa38cb889adab554ca1e8550", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992791, "uuid": "a1cce6f3-f596-4324-a4d1-014795094397", "comment": "Malware payload", "value": "f88004e438fe9c4e7cd32caf32ac38fd96ddf90c6bb944bcef58501145f1369441da8e99620d3f291e709f3b8dbeffc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992791, "uuid": "b2852b76-cc05-4c4e-ac79-e2599376950c", "value": "T1CBD5120AF2470212DC52423D8906E362DB72FC549771CA9F36E4BA6D2DF2EE261767C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992791, "uuid": "05855683-9536-40e3-a93e-c01b7ea451f5", "value": "281cb3477e7a33fff5cde019f87d8bb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992791, "uuid": "5793e4a0-d99c-4f42-a846-0e9b69d90b98", "value": "49152:7N+OARxGlagy6NpCBe1onUfi6yrGlhCz5H1iPWcNAz1/LicDSV7xY9YRsd1Nu6Yz:7l1y6NUBLUf+rUhCzR1i8oNY9YKHY5jB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697992791, "uuid": "938440cb-8856-4709-9314-101c4c57616b", "value": 2774576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697992791, "uuid": "ce788864-863a-4a70-840d-a6831e5815ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992791, "uuid": "bcf0dbdc-8c16-4031-8263-49cef7df4f8f", "value": "SecuriteInfo.com.Trojan.MulDrop9.4672.16304.16504", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee44a90f-7104-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697997648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997648, "uuid": "f2e508aa-6ccd-40a2-89b1-591bff57188b", "comment": "Malware payload (Formbook)", "value": "6317594cfbeb0e5ee59ba50267f11e55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997648, "uuid": "e4edc531-ba9a-4a35-a67e-29d194daacd6", "comment": "Malware payload (Formbook)", "value": "c64ff88a1adad81ea8c0c3f81bc6ecfb54f3ff1319565815ac80327ea33f0af5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997648, "uuid": "0deee9da-f9fd-4d16-a89c-454e8785c358", "comment": "Malware payload (Formbook)", "value": "c93c089a945fd23b77079d484e0409198af92b16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997648, "uuid": "9dd219eb-8628-4933-b3fe-4870040130b4", "comment": "Malware payload (Formbook)", "value": "cd4f8929a1d04354a72fdd1f82928eab95fe5006252e4ca5e08b003ce9a21701bfbb80862a7ecde78e0a8edc498fe0be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997648, "uuid": "3ffc5d08-2a45-4bad-bb61-ec75f9ce112f", "value": "T11D351202BAD29472E4721C3359B56B12B97DBD200FB58ECFA3C0492DDA715D1DA32BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997648, "uuid": "74b36631-c953-4e91-90c5-da3ce31f8546", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997648, "uuid": "48078c4b-60ef-4f97-94f6-087f84a29181", "value": "24576:NTbBv5rUanKOOyeXEfqGOm60/9+CYBGa6mXcqIAXiDFWmhHpaX6:HBjK4rfqFm6s5LAXicQHgq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697997648, "uuid": "6c49b8a3-4409-40ed-93b1-acf1f2770e5d", "value": 1144434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697997648, "uuid": "b084d8f8-3454-4e70-b1d9-783466232a9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997648, "uuid": "f392959c-63a4-4861-8397-f611c429e244", "value": "IDESA_cotizacion.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0953266a-7105-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1697997694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997694, "uuid": "8b0877e9-c7f3-4023-aa8f-a975d1a03288", "comment": "Malware payload (DBatLoader)", "value": "3732dfb52d34d5a49ab18a51bef182df", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997694, "uuid": "23eb0c18-80b0-4cb9-91d9-0c83d5bb01b5", "comment": "Malware payload (DBatLoader)", "value": "c81c51e79ec83b510a584da82e7fb404eb3f5d371a9d2c05fe1f0b7c7356803a", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997694, "uuid": "8911267a-987b-4cf1-9463-2408b92716bf", "comment": "Malware payload (DBatLoader)", "value": "42792a4136da6c199d70161fe7d0630d081b7817", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997694, "uuid": "b8bdbe15-517f-4a7d-9a8d-b405778c7d0e", "comment": "Malware payload (DBatLoader)", "value": "8b7dc25a8f436be6cf54f0d1fa63e0d9fd69e974740f1416558c6a1be29b822ceab809e34c5d057604dfe9de14d23b43", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997694, "uuid": "538cbc1d-5ee3-4aa8-8984-169dc8d9a8ac", "value": "T1E9452B4ABFADDC50D0A127FA8D8E1BE2B82D79D136B5CC9122643D4B09113E57DD80BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997694, "uuid": "86e42672-9f16-42cc-a5f6-c32b633781c6", "value": "d020f949ba89411d7c49f3baa1ad9952", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997694, "uuid": "455a039f-7b58-47f2-8b06-59070d8981fc", "value": "24576:E+x0KeaVl6fTAz/92jMRffknKdEfF17E+/:E+9zIf1I+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697997694, "uuid": "5eec3b5b-e5a8-4d3a-a507-df0b40ffb900", "value": 1178624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697997694, "uuid": "3f62efdb-8617-4973-8d85-dfbc5fda502d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997694, "uuid": "5acbeb33-c009-4dfb-a3ed-2bb2d6bf5dee", "value": "RFQ #180222BG24 and #160222BG71.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "669ac3e6-7103-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1697996991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697996991, "uuid": "5b4facc5-29b1-44e4-8228-e46db1e79c70", "comment": "Malware payload (DBatLoader)", "value": "f5b37331c84ea702bf92bb46d429f777", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697996991, "uuid": "450b8797-e25f-4118-a879-fbc7d2cf91c4", "comment": "Malware payload (DBatLoader)", "value": "c9f192e7d1592bfc56e3209da73bbf5fb8a5fbcfcc2d492dbdddfc60c77a1d20", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697996991, "uuid": "ecb7ab4e-a123-485c-b7d2-414d30663e48", "comment": "Malware payload (DBatLoader)", "value": "bfb2b066f3b645a9f1be23227704c1b1fbe5b523", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697996991, "uuid": "142b0cf3-8426-4b0e-bca6-e2b8d4f23ff6", "comment": "Malware payload (DBatLoader)", "value": "27f116c42bf27ba06db060d689aeff8b4b39e405f1a3070f0a5b23710e1587e8d6de5d299e45892a4efa4ab68963b53c", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697996991, "uuid": "862e9d4a-eb62-45f4-b460-39ca58955a7c", "value": "T160458C12BED19C32C4F3497CAF47EFF8A81E39F1192459A97ED8294C4E703513DA918A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697996991, "uuid": "a51e5c38-8425-4b11-a7e6-31e945faaaf0", "value": "4df0e13d93cb581937cac481e3c87c38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697996991, "uuid": "b5f50e52-6d95-4026-9a1f-05a27d7b6e99", "value": "24576:qeA4Puy3YeOyFbcA3l0xdapY2bwplPYlpQZlo/:q5cZ3BmdaG26pE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697996991, "uuid": "e4934885-7c0c-410f-b2cf-e1d74735ff17", "value": 1262592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697996991, "uuid": "73c5af22-7fb5-4f92-bba2-b47069522cee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697996991, "uuid": "42a077fc-6964-4477-baad-585c49f1faee", "value": "Mzuqswqrwoihde.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce56be2-70ae-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697960441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960441, "uuid": "24f8bb87-b3f1-4571-a4c4-41c12b32b508", "comment": "Malware payload (Formbook)", "value": "7a93bc269b2ebe1348969bcef1267af2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960441, "uuid": "a32d8c0f-0e47-406b-ab3f-6afb6af5f5da", "comment": "Malware payload (Formbook)", "value": "cab1239af46720e7dea7b06c3c9c6e3fc7928445e84db2636fb5427ae1ef4196", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960441, "uuid": "130aa8d1-4313-4ff6-b56b-7b256d9039af", "comment": "Malware payload (Formbook)", "value": "7b54993eb8d2d9c7a1fa67d08152fc29f7f42cfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960441, "uuid": "06328726-0bb4-4c48-a575-25a0f6863bc8", "comment": "Malware payload (Formbook)", "value": "84c9354689e931e0abaf7effaac8354e0a04157c34f244bef2bfcacb8201a89c0443239697207c6b751aea02af628e6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960441, "uuid": "836e4dcd-2698-4539-8537-21a86247372f", "value": "T1BCD4128063F02726E4B94776157102E093BA76E5A632F719AD9D90EABF33F904701E4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960441, "uuid": "c684cf0a-3106-4dd8-8206-36cdfa191b4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960441, "uuid": "e5c598be-4233-4fdc-900f-685dfa36f979", "value": "12288:w6NL1vjJGGna1sJ3h6ioYT9KryxykutduJiYOX/F81:hNL1LJ1na1sR6ioYT9KrSyaJZh1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697960441, "uuid": "2068483f-5b86-4a52-84a0-ac5be4158449", "value": 607744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697960441, "uuid": "83587b61-c520-4a34-9624-a9e0a9fa4dd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960441, "uuid": "e02d9169-59bf-42bf-9f36-a13a94a0e4df", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4498be12-70ae-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697960427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960427, "uuid": "7a4b9862-1a23-4dd6-8428-d53a5cc79143", "comment": "Malware payload (AgentTesla)", "value": "5caebbaa73cf214b8d2dd3dc91c4e135", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960427, "uuid": "ab4449e9-8f19-47a3-b225-53654edc1777", "comment": "Malware payload (AgentTesla)", "value": "cad1d46bc8411cde24e24a7503eb12376cb688ddb94e2821fc51cb3e439770c7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960427, "uuid": "a31f8475-f327-4687-b3ec-766abf6bc41f", "comment": "Malware payload (AgentTesla)", "value": "be44e74ea1317a2ae00a9a1cfa6a267dc2ce0e9e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960427, "uuid": "3e967500-98d5-40b2-b95f-ac9aaf67e861", "comment": "Malware payload (AgentTesla)", "value": "dca1c61f997b3c17745bd5afe0feb160ad09849f48f2a887067495ef84c8e6009df1921f7d4a16a086926515a5c0eb69", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960427, "uuid": "71e7b891-c56a-4614-b941-32d036fcae81", "value": "T1E8C4232032690A57E61912B21D7905C68BB14E7A2952FBC93DC432CE9DFBFE44520BDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960427, "uuid": "6429edec-0f31-4419-815b-d693fabfd1d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960427, "uuid": "34a678ef-e556-4b78-9327-156a9ce01fe0", "value": "12288:/8zS55mFza3BRWTL9oZU0OXVd0Sf+qaNQsZ22Gsp4SI:/f55qmy1uUh/2qaeNsp4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697960427, "uuid": "2bdafb89-5f75-424c-b64c-98b1ba884537", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697960427, "uuid": "fd902d04-9bb0-429b-a91c-2b3b884c3905", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960427, "uuid": "d2ae1493-e1c4-4d3f-9067-3705a403d6d6", "value": "payment new order october--0720_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "622ae257-7134-11ee-8907-42010a9c0042", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1698018029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698018029, "uuid": "c25df0b5-39da-481e-a54f-b2dbb6a6fcdf", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "10546d4f84b9966d5f72ed3bdf530c4c", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698018029, "uuid": "58b0cb99-2630-4257-968b-0ebf8c7f11fb", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "cbf2171616a11736845095e1a1e40b71c7a6b51e3c4453da03db769132820714", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698018029, "uuid": "dd2b0fbb-cedb-4a82-9d78-0f621b33e115", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "f0179725a1691177a47341327ebaa2e0d2864edb", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698018029, "uuid": "3d704cfb-9bda-40a3-9c4c-ce4755feb90f", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "6aa1078e12a05ef84e476e9b88c5f740ca0c1a7b9c92a359aa05ea3fb4d3661dfec93550df36e7337eb673b17b531851", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698018029, "uuid": "ed4249d4-d387-4d18-a25d-30b2f6789bbc", "value": "T165151302BAF98032D9B2677068F5079B0B7A7CE10D7881F71252AD2D1E726C5D57A33B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698018029, "uuid": "e4863fd2-9111-4c54-8f88-032a9c3b345f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698018029, "uuid": "03f9ffd9-7364-4cef-87de-63101ef21438", "value": "24576:pyzao0HuuMlmyvo5SO93mlKkgpvkryQwJiQHehoZM:cHuMl503Dkgkyiu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698018029, "uuid": "28f48e18-9998-4752-93ab-a5af7347f898", "value": 880640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698018029, "uuid": "12516882-1429-4db9-85a9-0541db5cbf7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698018029, "uuid": "5b9cc75b-4860-418f-9819-160dcdc83a2f", "value": "10546d4f84b9966d5f72ed3bdf530c4c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e8d956-70ae-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697960424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960424, "uuid": "d18f5e05-a49b-4f68-95fa-aea328c3c1d1", "comment": "Malware payload (Formbook)", "value": "d2ce1b062950764be73d0f88bb5946fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960424, "uuid": "2ea0f251-9c02-4b5f-a92a-22d15881ab33", "comment": "Malware payload (Formbook)", "value": "cc45a32dae18244aa06e2fb47f7139895f924dc1b6ddad21551cc804b0874a13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960424, "uuid": "49de06a2-a4a3-4504-a4bf-cd26b26ad3d4", "comment": "Malware payload (Formbook)", "value": "587f963a0cedc623081025e4b506b49b57211242", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960424, "uuid": "8b2d9581-d903-4887-ba1a-2ab4e23c6de7", "comment": "Malware payload (Formbook)", "value": "e8f6b40e0ca1b849b65d09b2d8e484aafb58a4d7050f1dda410adb11c49f4ffe1960ec931c8464a5d871f4c6de3da30a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960424, "uuid": "941d1e49-1f50-4ab8-b2a2-965f6cf4680c", "value": "T14DD4128432284746DB6907BB0E369EC59B345D976852D2AC1EE536FE0EFAF844312F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960424, "uuid": "f095a3ef-03d1-4948-b570-d7fcdc21d404", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960424, "uuid": "4c462119-063f-45bc-a68c-3d340edf8771", "value": "12288:J8zS55mFzX2YEJLW3FzZJQjK06T7FPAMx4MbkG0Gcc9IkQnpNd+Xx3yS0:Jf55qqj1W3FzZJ50aF4a4ckZGccad6Xo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697960424, "uuid": "66b6b665-275d-4337-9d80-2585884fabd5", "value": 652288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697960424, "uuid": "11dff9b6-c8c3-4b6c-b2fe-14ffd55784e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960424, "uuid": "9bf6795b-6e08-4663-9b17-3cec87b5173e", "value": "Form Copy 04 10 2023.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db8357a-70ae-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697960442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960442, "uuid": "75cfae22-ac27-4ffe-b720-bdf216f107df", "comment": "Malware payload (Formbook)", "value": "010c9d1a915b7550181014f34ed12a80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960442, "uuid": "16758e6b-778b-406c-8039-8215519447ab", "comment": "Malware payload (Formbook)", "value": "ccd3d1ec6d5b5723225b7d0c6488de099b2b22c5b70bc1c521c148160f5997cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960442, "uuid": "980df586-76b8-4e55-8d7d-41af288150d1", "comment": "Malware payload (Formbook)", "value": "687bb9aa1047c3d19e76570e130d5efe76a9a336", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960442, "uuid": "16ea5c92-31bb-465f-a5b5-f7f1037e9ad1", "comment": "Malware payload (Formbook)", "value": "a25d4d82e1895d8ed43db8f2673cc1976c772f1f5cbe0b053fd1d73287177a8bf4b698c478a8983c233a4788a072e457", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960442, "uuid": "17de353b-a86c-411a-9567-58062078634c", "value": "T190D4120477F4573BC1BA87395574838053756B6E6A73FB282D9E70FA2A33F884501A8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960442, "uuid": "0006e6d5-4d01-4efc-8236-053ccd6de53a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960442, "uuid": "47d3d991-7e5c-4788-8d2c-ebb6f5227825", "value": "12288:2OW1vjJGGna1q5IscdEjcdja5VySGJE6awd6jQH171BFM2AYOMgKqhxgyVMwl1:2OW1LJ1na1Or0E4dj4+Ei/BFMlRMgt4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697960442, "uuid": "e6542de8-aaac-4bfe-be09-2313d28898ce", "value": 607744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697960442, "uuid": "694102ff-d344-4048-9fe6-03f850e54b28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960442, "uuid": "dc95f99e-e97e-441e-943a-69652e3e229f", "value": "Quote Request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04aceeb8-70a8-11ee-8907-42010a9c0042", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1697957743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697957743, "uuid": "35d5826e-6295-4ed9-9edc-64a1cf94fcc9", "comment": "Malware payload (Rhadamanthys)", "value": "342c12a64868de09b5a7f3d7a9817877", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697957743, "uuid": "1c55edfd-e61f-441f-b279-736caf57a748", "comment": "Malware payload (Rhadamanthys)", "value": "ccdd03de2362617a2b4b862c075aa440d337edfe4a29a4b6992e96d4e40f4b96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697957743, "uuid": "2e8800f3-b742-4a0d-84eb-58bf942ac705", "comment": "Malware payload (Rhadamanthys)", "value": "4d63262737bf477ebf75dbe84415d7ca189e5804", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697957743, "uuid": "ff6df5ea-7c27-4c1d-bc00-96515c63ccb9", "comment": "Malware payload (Rhadamanthys)", "value": "e07ed02949e392a5744b7648f552128e937921603db181c648dbf6bb802b73b16e85dc93f3a34e431f6829dbb5c6d907", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697957743, "uuid": "6f0e9b8f-c09e-43d0-8687-0afcd7dec575", "value": "T1A3D48C71B4D49C81D8B78D3E9BF220E1705F2E351CA60FA677842D24B3985A07B395EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697957743, "uuid": "9c66c42f-0ff3-46b2-bb5d-ca868f1e8453", "value": "59e9016f955a6d31d640ba2784453b31", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697957743, "uuid": "315a023d-fe8c-4bf1-9171-294377b9b905", "value": "12288:V/L1iILsWJi4Rsn3JvmBJ3wWDQpXPcr5/ej1NcyOCL5J:XiIAWJlRs3JvmbnDUUr5/egyOsD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697957743, "uuid": "d198c367-4f13-4a6b-b83f-c8c0a1441438", "value": 606776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697957743, "uuid": "e00d943a-2eb5-4bf4-a226-3816b80536e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697957743, "uuid": "3ec61294-de27-4854-a870-707cb89540b6", "value": "PO65398367.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4b23ed3-70a0-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697954656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697954656, "uuid": "962428ff-85be-423d-94b5-b715a2d8c73d", "comment": "Malware payload (Mirai)", "value": "45522617d63d5953a8a971b526add16a", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697954656, "uuid": "cdd6cfd1-dbec-4a81-930f-031c958e6402", "comment": "Malware payload (Mirai)", "value": "cdb9801ff1d514937b9aade5ef0dba05bb99ad1df773594d524d4d22acd17121", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697954656, "uuid": "5e86d86f-8cd7-4a1f-a50b-e04f591be533", "comment": "Malware payload (Mirai)", "value": "3583ea30410cc3278983855d2ffd236ad991c618", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697954656, "uuid": "42a5db89-bea6-463c-aed2-6d47ba6f3221", "comment": "Malware payload (Mirai)", "value": "f536fe1297b5c0717eb0858d753fe9e00907d27cbaabe89f7ff9c1ce57539cddae741a2995ff23fe3c76bc5c7c2a7772", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697954656, "uuid": "36c9369d-1f36-4a2a-bf56-7b571992d3d7", "value": "T1D7D2D1A981E7F2B8D0EAA6B5043E42C4FDB67216D11A17B308F92566DF571C90D30EF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697954656, "uuid": "d15bd0bd-e19c-4dd5-8e67-04e38216ae7f", "value": "768:NYSoXdJZETc51aBfdNRQkHy3xWEMcw6qByR+LSx0s+:NYJdJZiy1aBnQfTqBy3t+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697954656, "uuid": "92e5e585-dd4b-4fc6-bd66-a76398f4355e", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697954656, "uuid": "257fb535-796d-4755-ba4e-f64dc5b5ef6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697954656, "uuid": "e900abb7-003c-4b3f-ad1f-66be4d240509", "value": "45522617d63d5953a8a971b526add16a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d613c2c4-70de-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697981287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981287, "uuid": "a535dfd4-b284-4474-9996-260c6df0d00d", "comment": "Malware payload (Amadey)", "value": "bf5bf495093825bd8a5f2bc94c0e64d8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981287, "uuid": "06be2a07-200c-463c-a689-8951e89ae629", "comment": "Malware payload (Amadey)", "value": "cf41db53b04a78272cbaa39b577733537b5af0e36a06884b98eb3deba728f01a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981287, "uuid": "5812b0fe-4dee-4219-aed3-9d0eda553ae1", "comment": "Malware payload (Amadey)", "value": "c4816d42a4bfbeae7ede9d3baaeb2d8ecf2b1c26", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697981287, "uuid": "97b8801e-89d5-4490-877d-f1dcd0e620e5", "comment": "Malware payload (Amadey)", "value": "8f935a36b1832c3d4604bb38d1cdf26998d96553872c4ae9cb86f3e7f03e99cf05720cf6bff48d1a8925f23f3cd0a14e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697981287, "uuid": "d64f961d-8f2d-4b4b-b2c7-a29e95562d28", "value": "T182852312E1D54177C8F10BB181F607A337317DA0AE784B9B67A478CA1D32AD0B87679B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697981287, "uuid": "34894ded-aa89-4dac-9aca-ca5eb1216105", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697981287, "uuid": "aabcaff6-a948-47ae-bc4b-56b816122769", "value": "24576:8ry2HVopGsN+cbR0kNMUlD1Aylf+sOngvsQDJWBsHN4aEOrBGv6YYedQV6MCroX9:8emzsN1ThFlSnGsYWBstPBWQgzsG8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697981287, "uuid": "89facdab-eb08-449c-bc4b-40024ad20104", "value": 1842176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697981287, "uuid": "d5af3712-8211-48c9-8751-710264360185", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697981287, "uuid": "0f1c10c4-d25d-465c-9e28-31971635ff1f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6e3afc2-70d0-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697975221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697975221, "uuid": "fb59b9b3-31da-4a47-b138-378fd2e57f06", "comment": "Malware payload (Amadey)", "value": "ea10bd0336fb54e6ecee7723f9758f72", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697975221, "uuid": "32898e3c-1544-4470-a739-f4dedf6aadeb", "comment": "Malware payload (Amadey)", "value": "d05be12e067ae76076328d295b7269ba57a4ecc5831e9f1b2efe23602490f3cf", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697975221, "uuid": "5326dea6-2060-40da-abba-60859c585d0f", "comment": "Malware payload (Amadey)", "value": "b4e50fe9f73cd5b41cb61ba4b94de25afe1c749c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697975221, "uuid": "ff58eb27-5c0c-49c0-917a-e727d838ad2c", "comment": "Malware payload (Amadey)", "value": "acf8667acaacdd37e1f69cd24c2d3853d0263494983f78712212457bcd925d2f67dced7b0c19c16aecb0b4690ce39948", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697975221, "uuid": "d1057e91-c63d-4568-98a9-93e457bc8f78", "value": "T1C4853307E5E29272E9E523309CFB428709357CE48D308A2B6B4589AF5C63AD5BD7071B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697975221, "uuid": "66064b22-2525-4ed0-be57-68572730090a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697975221, "uuid": "5000d613-d640-4173-9673-2b971a630df0", "value": "49152:SX+90UFZ6azD741X3iV3pMkPgNwxcluAT:A0DX744WkI2CT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697975221, "uuid": "536d969c-8ebf-4bc1-aa39-729a175f9b81", "value": 1843200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697975221, "uuid": "2930d05e-76f7-45f9-a812-358b96c96a7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697975221, "uuid": "11bdfbd1-dfeb-456f-a2e0-451f50653334", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "253eed59-711e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1698008478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698008478, "uuid": "bb7fe32c-4572-4fd1-9eb6-8d9ed37ff83d", "comment": "Malware payload", "value": "f2303e5f7b0bbb7b3b0e5822966cc36d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698008478, "uuid": "4e1e864c-5e0b-4098-aeb2-59a6a48d055f", "comment": "Malware payload", "value": "d21d77361ba8b190552b4cc7014c8edc11c6599cb3be3948bfb69f7870fb76e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698008478, "uuid": "2261f8c1-81b5-4511-ae6e-ac195c9cbc38", "comment": "Malware payload", "value": "d0c44daebf98cd156ebe63faffa6ee4e11d04ca5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698008478, "uuid": "c9cc674b-c9e3-45d9-9b7e-781a5d115867", "comment": "Malware payload", "value": "e3cf657edcea776bef6373673680ba355fce19bb1bb17283b1948140920cc79e930c653f3f8c43d842be04dcd6ea2d5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698008478, "uuid": "46874def-5a2e-477a-b723-0b65d222cb9e", "value": "T157853342E7D885A2D95517B388F503C71338B8E3917CA3AE3269AD461CB32C461F976F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698008478, "uuid": "90ab431e-60e3-44be-b31e-4f08342336ce", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698008478, "uuid": "c75321d0-4ff7-458e-822f-216973bfb59c", "value": "49152:pnm8BX9Sn2QXWoQwMiYshd8QjzZO8z+U:8iX9SnBX+w1RvFvo8zj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698008478, "uuid": "8490f10e-a9bb-4bc6-af6a-2fe9930a1069", "value": 1824768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698008478, "uuid": "60cb809b-3488-47ee-9042-b5169d87d2a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698008478, "uuid": "57749ace-7953-41e1-b725-bf394412f0ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "033a88e5-70e9-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697985657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697985657, "uuid": "633cd078-9440-4625-bad0-1253fba6e92a", "comment": "Malware payload (Amadey)", "value": "7bb7f22b1c3b3ca5f503e9d246fa6be2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697985657, "uuid": "9c8e14da-ddf8-4706-a41e-c6e658fcc90b", "comment": "Malware payload (Amadey)", "value": "d2d060464c4eee35427dccaff3292f25906d61bc81494b1cff43c37bc682c378", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697985657, "uuid": "4dcd6d0e-1a5e-4dd2-832a-b52f96d334b1", "comment": "Malware payload (Amadey)", "value": "0228c1cfbb310bc2c9d2c160a0cab9effb37fa7d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697985657, "uuid": "4cc9d7e0-d020-4cb9-a460-fa1b03b9a6d8", "comment": "Malware payload (Amadey)", "value": "ebe95fa9be2c89328cf9643855e6f082beeefacbc2477769f1918461c945772dcff23cca686a62b64a7c4828b8fc0ac7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697985657, "uuid": "53d3d4ec-2f37-4ddf-827e-e72c80939d77", "value": "T15D158D2138C49172EEF320B787ECBA3682ADE0B0071915DF06D857EED7506D27B36696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697985657, "uuid": "2afb8db3-91a9-4995-9d04-30658191a385", "value": "09b5d280d2d122a8b769c1e2cd1b4ca6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697985657, "uuid": "1ec94f07-dfde-4d55-a343-65284e8fb8bd", "value": "12288:oq25RbmNwRUxiPyK2S++syCWQ8i1zxmstP41eSbtuvS7g/+p:kmNwRUxiPyXS9RCWQ86xzb+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697985657, "uuid": "71be7ec7-871f-40c2-bd84-30fcfec25783", "value": 933888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697985657, "uuid": "ba592185-9d4d-4b00-8e2b-82d071f40d40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697985657, "uuid": "d9986d06-5e4a-453a-9634-9fd4c95f1deb", "value": "7bb7f22b1c3b3ca5f503e9d246fa6be2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9253569-7104-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697997640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997640, "uuid": "3dd40699-a323-47d2-a288-823edee52f85", "comment": "Malware payload (AgentTesla)", "value": "08e9726af71afff24f4f803989872313", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997640, "uuid": "002d4517-66c0-45e5-825a-6c2220a5f3f5", "comment": "Malware payload (AgentTesla)", "value": "d3729ee774783f9a15211e79e021238418c97d4625631368f7c2e187678ba72a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997640, "uuid": "9ee2d2d5-345c-4cee-bc1a-fd33b3015cd3", "comment": "Malware payload (AgentTesla)", "value": "b083e5356585b1fb246f5f38878735fa0f232151", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997640, "uuid": "014388e3-ac3d-4633-9d0c-bd3093e960b4", "comment": "Malware payload (AgentTesla)", "value": "9185cd28e854107e4aa75813d3a48c14c829dc916f1cf2f71f26ea0ec3b5936d6389f5eedae4f92e162d569dcbe37313", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997640, "uuid": "6bf421c9-5420-4fea-93c8-975db25f6a51", "value": "T1206512027ED264F2D1732D371A656B22E9BCB9301FA98DDF93D04969DA304C0D735BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997640, "uuid": "854640eb-2281-45c2-b61b-31f5b7b9554a", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997640, "uuid": "cf05ec28-a5b1-40af-8cc8-d35c1597ad84", "value": "24576:NTbBv5rUanDK1DKvMrBW4ey2Tygt90e+hoxkSKo:HBjW4vMr8Maygt+HSB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697997640, "uuid": "cb12a471-bc78-47e3-a6ff-b247948d5900", "value": 1427459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697997640, "uuid": "32c93012-9dc9-45d5-b676-9dc1d82daee0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997640, "uuid": "82cd7bc7-62e8-4858-afe7-33d418ea23c2", "value": "08e9726af71afff24f4f803989872313.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d80558ce-706f-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1697933616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697933616, "uuid": "effa0e23-399e-47b2-9cae-badd0eed6f89", "comment": "Malware payload (Stealc)", "value": "3254b63521cd1f39896433d9c760be3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697933616, "uuid": "a8014a02-65e3-4937-b858-f649b94e211f", "comment": "Malware payload (Stealc)", "value": "d51b7b19cc192429c283de37da93b85d400fb2db78933fa94edc47b728e404de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697933616, "uuid": "87cb4713-f47e-450d-88af-a01415ed01f1", "comment": "Malware payload (Stealc)", "value": "3de53e336ccffc45a65a568e7b9705cb8fce1770", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697933616, "uuid": "cb27f0ac-c0c8-4778-bb4f-a179a086be4d", "comment": "Malware payload (Stealc)", "value": "d8e3fa0946ca6e30d9cd1fb9767f2a890622141e87ae035bbf1533c62667ab19934c2f9e2bfbac6429782110f6808ac4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697933616, "uuid": "5ea8eab6-c901-4a59-8410-c8c2dd46dac4", "value": "T126652393D6E86237D8766770A4F2A3E31E747C920E34561B3B45EADE1C32384A47532B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697933616, "uuid": "f74bb3fc-a5c5-4d0b-a9d8-793c795cd57a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697933616, "uuid": "754e247b-8395-4bc7-a179-517b876485bc", "value": "24576:eymAOgIriniU0LKRPlLkxOAKEzkCbX80fmWQhdilGG9Mby1L9QqMAAoUP:ttXAiIKRPlLJVEX80fI+Mb4SAXU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697933616, "uuid": "fdc0b5a7-818b-483c-9a8e-b6d7b2c4cb8c", "value": 1493504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697933616, "uuid": "9ec0fa59-9b98-48ee-b61b-9fc3bfeb290b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697933616, "uuid": "b17a418e-1ed8-40bf-9659-cfde670d419c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3be7a87f-70aa-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697958694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958694, "uuid": "009a7f6d-a1b4-48c4-b400-f30c06f6c436", "comment": "Malware payload (RedLineStealer)", "value": "5826d10afe52299106b0eebd0b0ef37e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958694, "uuid": "03f28c9d-6704-4c1c-92c2-bcc88d598d8d", "comment": "Malware payload (RedLineStealer)", "value": "d63919ed0f114d621246580eeac739de531ccc3fd63fb3ebff01d38279ad70f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958694, "uuid": "6d84ff14-51c6-46d8-8acc-58ccbb8e6956", "comment": "Malware payload (RedLineStealer)", "value": "106c30ee28a85ae7463d60790b64f0c947da74e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958694, "uuid": "bf71f6a6-01d8-4555-8902-423d3db017b6", "comment": "Malware payload (RedLineStealer)", "value": "af50b893e7a6c8db296a1a0ce4f7df2122662d0e4bff297ffa73f0274a9bca3c06a1186f2b7376556989d2e582a24e91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958694, "uuid": "25ed75d5-f1d6-4533-9a9f-36cf36707a8d", "value": "T19D24C576E304551DE87E433DB01C38B09E707CA2E16ED32E45FA7AED683BB498A145D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958694, "uuid": "021e3385-1ba0-444a-89ab-0fd07909ae56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958694, "uuid": "9054b177-a46e-4662-bb58-51156ac9b350", "value": "3072:KVyymrtnYNgctkfHrUkFTQmX1DJVt/qqfb2/fluHdOLa:qyymJYNgctwLU21/Rb2/fY9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697958694, "uuid": "c6891e45-11c8-4bb6-bfd1-a4f6c23c6a26", "value": 226816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697958694, "uuid": "932cefbf-d5ba-4f7c-b5fe-7b5c072f6249", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958694, "uuid": "d1208f06-4da4-425b-9825-46263d4fa58b", "value": "5826d10afe52299106b0eebd0b0ef37e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8294bbbb-70ab-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1697959242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959242, "uuid": "c504ecaf-be9c-4718-9304-4066ca112fd0", "comment": "Malware payload (SnakeKeylogger)", "value": "ff81a14b73d0578f174ac77fda9afd59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959242, "uuid": "7c0295c8-15fc-46fc-9b41-f14f8b1c7beb", "comment": "Malware payload (SnakeKeylogger)", "value": "d6e68eab347e95b242f3f1ea311f8a219253b6e9a95ad198d6b574fee149f2e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959242, "uuid": "b3770ed8-c76e-4ccd-86a7-8fd0046f077f", "comment": "Malware payload (SnakeKeylogger)", "value": "d6a94b13cd5bbc2bf9c611ef22420dc3310535f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959242, "uuid": "e18165fc-2d83-4881-b9a3-8baa55c25212", "comment": "Malware payload (SnakeKeylogger)", "value": "653ca9707132b77b6369bff61c0ade221645bbaea8d319fd935202e8fe40e97492095e28cc20205319ab9ccf856e3fbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959242, "uuid": "fae30472-bec5-4877-a1cc-5cd7dfa688fc", "value": "T14464012439D2952ED8D13BF46EB4925326662C604278814BABF47E28BE33513DCCF39D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959242, "uuid": "dbf38ac2-7630-443f-b277-2750154b0ac1", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959242, "uuid": "c49597f1-024e-4339-8126-3399a8d2a4f7", "value": "6144:UnPdudwD/EVDiMyfb+hYffxzElzvWVI9SrSLi1pS8Jqzrbh77f9U+:UnPdLbnb+OffpTI9xOqzJ39R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697959242, "uuid": "6d9613f3-c835-4e13-9576-927856989e58", "value": 336140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697959242, "uuid": "d6311e29-75a9-4652-9fdb-e2d96413a05c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959242, "uuid": "8a1c972b-4da0-4c8d-8c1f-36f815f59069", "value": "FACTURA065000000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c157c463-7105-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697998002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998002, "uuid": "cf7e6b8a-623e-4088-8f1a-c58945ae520b", "comment": "Malware payload", "value": "dbca079fc1d4cdd2d9deea42b2d7be19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998002, "uuid": "dc7ff4bc-3cad-4b66-9774-62ba592daf00", "comment": "Malware payload", "value": "d6f7ad00b08be5d5dcade11fdeab8013e4cd6a2bbcd8bcca4dbf6b91eb892ffd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998002, "uuid": "d26c6a66-4967-4c56-850e-7bdc6e66bedc", "comment": "Malware payload", "value": "9b767afc536cf5a50330f0fbc2831ca502f73460", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998002, "uuid": "3cd825ea-fd67-45a2-b788-5416a5e27f38", "comment": "Malware payload", "value": "e561087995cbe63f9ad006cc236e4c55b4dd7bd0988169fdf05ed7221992d7a1b2f6ea27232a30a94f03354900b38efc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998002, "uuid": "2ab3e8fe-0fbf-44dc-956a-a3331d5cbaf8", "value": "T107B63328959998D1FE15437898CA89B0E0A9B04150E5CF772DF2076F6F5EB84806F3EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998002, "uuid": "d05ebc37-19c6-4e59-aaf2-835baa478c40", "value": "196608:8BEE5VZ0XvIEYjhhJtwrouCEM92vCHtUFX2GtgrE/RTBPLUCU5+MGqyd/bK+mNpT:2EESgzjhhJtwre72mVURTBivGpbKPrFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697998002, "uuid": "6177a7f2-3499-45bc-8e5e-3032c45f89d1", "value": 11162107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697998002, "uuid": "b6755e3f-f620-4e54-81ca-01d9a6d88043", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998002, "uuid": "6bf2b9cc-74b6-4d24-82f0-27b8c2e3f03b", "value": "dbca079fc1d4cdd2d9deea42b2d7be19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d11a9aa9-7105-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697998029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998029, "uuid": "e86e9ba0-cd8b-4ce3-8834-dc54fe3c5102", "comment": "Malware payload", "value": "cead55f143cb8265bee779d1c18b6487", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998029, "uuid": "e9774e41-1838-4fcb-91f2-beee91743ecd", "comment": "Malware payload", "value": "d7b63be75e892fa2a049186268f46a7fa6fd116d8103c956f4d609906bdc56d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998029, "uuid": "2d7875c6-e712-411a-a938-80adfc3f4a21", "comment": "Malware payload", "value": "8a1cfa0328878e361ef0aaf1a725845b49fdb46d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998029, "uuid": "0191d2eb-f204-46c0-9c17-adc0ee3912a3", "comment": "Malware payload", "value": "12daedb50cae46f02b189fdfe1afc001ea401ed610df7f3ef98ff22a42322bf579b6099400a58da9e48eec3132439910", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998029, "uuid": "647978ca-2139-4994-a76d-8abda8571886", "value": "T1BBF522B713751085F9E9CC398537BEA971F6037B8A40E47869EED9C12E368E4D223943", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998029, "uuid": "590504a9-87d3-473b-9cd3-a59c11909b52", "value": "cb122ba812b756fae1182211e0d71b1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998029, "uuid": "a2945e0b-1af3-4328-8f3e-a94b31a4280a", "value": "98304:dCUPT4Mzeh+6D6UH+phuRO5bezZvSZ0N/:dCwe4O7H45bezZvIa/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697998029, "uuid": "328a119e-e9e3-42c5-bdf3-0453c8ae2ec5", "value": 3458611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697998029, "uuid": "51de973a-3a17-4f75-9faa-3a1fdfc12685", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998029, "uuid": "1f5a1ed9-90c2-4249-aca9-f2f4b545dcbf", "value": "cead55f143cb8265bee779d1c18b6487.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "962f9ad8-7123-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1698010815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698010815, "uuid": "0563cc6f-1c80-4ec7-a129-2c2c2689f72d", "comment": "Malware payload (Stealc)", "value": "b74b6336bab5b27f8f580a2b00f07962", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698010815, "uuid": "2578f024-d96b-4f29-bab9-8e14ca99e7d3", "comment": "Malware payload (Stealc)", "value": "d7ef12fe6b0e4f051b2bff36b37ac97ed07a853f031e39b1bc95aa80460fe7a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698010815, "uuid": "f4c34375-55da-4689-8954-6df86ea9c9dc", "comment": "Malware payload (Stealc)", "value": "10c0265f844e57999c641ffde4d936620174af9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698010815, "uuid": "c3a9efb9-c174-4bce-adb8-ec984cddd757", "comment": "Malware payload (Stealc)", "value": "80316d307db305bfb30a80b1bdf1d172e220e9a1733592ae32672e4686c025e3726190e5822f4cc1da5cbe1943de9dcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698010815, "uuid": "ee728d1b-27a9-4c6c-a48d-bfb6620aa6c7", "value": "T15004CF21B5D0D072E0A75931053485A52E7BBCB1AB3641CF37983E2EAEB03E05B76B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698010815, "uuid": "8a9bfecd-d523-43ce-916f-e6d935decc1c", "value": "b4dff5a08e23018869237b48ff2d1876", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698010815, "uuid": "248fd5c2-842d-43f5-94b8-9588866fb036", "value": "3072:QyBNbfQueA9cSTHxyBzSXD84Yua0UXi2SwJWEkNS0R7Rz9BRBX:j+TA9/THIJuarXOwJpP0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698010815, "uuid": "1fe5dc5b-53a9-4ab1-bde5-9c81f84d9c29", "value": 183296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698010815, "uuid": "9d44c712-48be-4425-b2ed-4c7f9f206af0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698010815, "uuid": "a01a23cc-4116-46dd-b533-9665821cdaee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9fdf3e4-70ab-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697959308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959308, "uuid": "8f33010e-2833-4a4b-82e9-126beccdd515", "comment": "Malware payload (AgentTesla)", "value": "1f936998a57622365524a5f69c0d1c02", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959308, "uuid": "238a9e80-e4cb-4833-bbbf-658c844fe932", "comment": "Malware payload (AgentTesla)", "value": "d86eaa75fdbc0d2de5b239974b02038200247b981ecc99074e86b5ad51a5906a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959308, "uuid": "61291ce7-11dd-4255-a23e-987da165ca2b", "comment": "Malware payload (AgentTesla)", "value": "ed1d17f04611bedead935c4bbfe4d2aa75f59ef9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959308, "uuid": "67fabdf5-a221-4fa5-9de5-725519e2c00e", "comment": "Malware payload (AgentTesla)", "value": "127b2f182c49641c36965ae29de8a8fc3fe963ef7ddac7e0862cb1ead83aac94fb18a324bc4f4a3c39f714f722710565", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959308, "uuid": "2dd2c40a-df5a-45e2-a612-4ec72d4377d0", "value": "T18CD412653790A27EC5738AB185E53C14A3202937536BC312A46321DD9E8E2EBCF51BF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959308, "uuid": "e429ba76-5a21-40ac-98cb-75f407019b2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959308, "uuid": "bbfd0d04-d74b-4187-8c7c-ad539ba1257e", "value": "12288:b/j6MLCOH9MqE92drhI6DkkZh7ravtoLRt+x+YITIHQK:bL9COHks1hDkkZh0oL6O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697959308, "uuid": "db0cfd69-1dc3-4ecd-af28-ab543540c939", "value": 653824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697959308, "uuid": "8f6db4a2-5cbc-4db6-99c8-c9655bea62d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959308, "uuid": "f2eeb43d-2275-49d4-a419-186dd4ccb788", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3136a3f-70ab-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1697959377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959377, "uuid": "6ab7f9ec-bbe7-4c57-9edc-0fe88aea3e42", "comment": "Malware payload (SnakeKeylogger)", "value": "1547a83da18ae73b5570ced53296b7d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959377, "uuid": "1e056d73-973b-4721-b499-d9f458328ec7", "comment": "Malware payload (SnakeKeylogger)", "value": "da16aec5cb0b5b984a32e4ca45a32a73266ca3e6148aedee8758de7f0ba66df3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959377, "uuid": "7ce02c58-3431-4729-8e0a-848a6b6e1965", "comment": "Malware payload (SnakeKeylogger)", "value": "d24f9c3a567142783e20869bfbb44e8e84aa657d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959377, "uuid": "1994f47c-c444-4d60-bd89-ac1b9ffa1cda", "comment": "Malware payload (SnakeKeylogger)", "value": "44f8d5777e01d5094ee4dc51ce3af6ce75b8a38e5551850eb6aa0e06ba3d3ef56116d8c47b0b4d05e1cd2529f244882d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959377, "uuid": "7bfe5989-f0fb-4224-9936-471c15b7e74c", "value": "T1E2C4125873E45B65E1FEC77A9570039163BA356C4922EB2A6E8C90FC3A23F584741F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959377, "uuid": "e91d6b24-3675-42f1-880d-c3b10f1803cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959377, "uuid": "58ea22aa-687a-420f-8d18-9b45bfdb46d4", "value": "12288:K60q1vjJGGna1WWgQ94bMYDLpzSr+MtL0NVS1eLVj/tWjFB1:T0q1LJ1na1teIYHpmr+igPooNMD1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697959377, "uuid": "ac134d12-9181-48f0-8edc-d578ba647b85", "value": 544256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697959377, "uuid": "b255616e-5b83-469f-9c38-970b35b4bcfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959377, "uuid": "721e4d39-9111-4e4b-9fda-88fe880e3b15", "value": "08A347B6-6FB3-4B5E-9A49-9EC1E49DF8F1.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5a1bd84-708b-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697945611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697945611, "uuid": "c0330586-6668-4c07-a463-27f7cef99bcc", "comment": "Malware payload (Mirai)", "value": "d5df5d42740d91de0351bf95f2ad591e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697945611, "uuid": "8413e4e6-c874-464d-b656-e1ecaf38ddfb", "comment": "Malware payload (Mirai)", "value": "da74a5b3064dcb3726ddde7e626547c2bc2860fbe5d78044038d8f0ec0022f35", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697945611, "uuid": "b4ca9149-1b66-423e-aeae-340ccc168f90", "comment": "Malware payload (Mirai)", "value": "82a14eebf42dd5760f5fd14c42015beb48a5c79f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697945611, "uuid": "2dd32198-286b-4a50-990b-c8001bada292", "comment": "Malware payload (Mirai)", "value": "93b808fda1ddad010a1291e333798d3e8e8c9af7a0ba531a89206258e4ac68c5feeb957683e602b69af7d8a3859d12f2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697945611, "uuid": "3d5ac21b-8532-41e8-9a3d-154bd3aa35a1", "value": "T147632995BC829627C6D052BBFB6E418D332653E8D2DF32039D216F20778692F0EB7651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697945611, "uuid": "edee35ce-746e-4d86-b33f-30fc84e23750", "value": "1536:oN+S5wF1z0fhw150bB418nTcapt5O/+3GwnzNSvpp:oN552bfOoGbO/+3zGz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697945611, "uuid": "04029ffe-2705-4bf3-bc03-40ec2eb281f4", "value": 67268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697945611, "uuid": "1d42af3a-5f55-4e78-b9b5-0f3586745f46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697945611, "uuid": "73ec5e5a-5a90-41db-9275-38867f867db3", "value": "Aqua.arm4-20231022-0333", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5540a804-710a-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697999968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697999968, "uuid": "6c6ba54c-07bf-4acf-984d-93dbeab5cc28", "comment": "Malware payload (AgentTesla)", "value": "0b3664028d6cd327d55dac4f88e66672", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697999968, "uuid": "bf323d68-67a0-456c-b5bd-aef1399223d5", "comment": "Malware payload (AgentTesla)", "value": "db2b522a985ca54292acf8fcf6a994bbfe2e53ddb60200b8da3c5baff989d162", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697999968, "uuid": "866d706b-57a1-4d2b-8473-75103cf8049b", "comment": "Malware payload (AgentTesla)", "value": "7aecf587c6cf2fbffb62125b6065d1d4c3b1b816", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697999968, "uuid": "0537e23d-6f23-4b33-9e9f-d1b65103af03", "comment": "Malware payload (AgentTesla)", "value": "0fdd9190d72d207fed209016517f0b89b051a82b6f98031eb36aca8060e558d6caafa626ce48ac05c7bf195052a6d687", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697999968, "uuid": "c3abdb0e-8611-40ab-9198-d7782860b299", "value": "T1BBD4230D63018BDD8AF11C2EA05BA9D7E2ADE294BA945623145079834FE703BEFF1747", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697999968, "uuid": "fd597e3c-bbf6-48f5-8310-1af65c605928", "value": "12288:HGZzYg+zrsYa3yicuVF6pWVzTJt66gHk3EHJYmgoL3snw9O/4qJJVwj:gzjTZ6pWVzNt/gHkBmgoInK2TVo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697999968, "uuid": "cf2588e8-95f0-4b1e-8712-35fbf6ffeabc", "value": 647766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697999968, "uuid": "a8e76818-03ea-49e7-b02d-8b1fe8da2ac1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697999968, "uuid": "f0cd6248-1afe-44ca-b00c-e69bd2775b46", "value": "INVOICE AWB 2199695443.Pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a925a05-70f9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697992783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992783, "uuid": "cfa1ff8d-4734-4426-9f99-c220e9be4995", "comment": "Malware payload", "value": "b9a4fcfe1df8cf0bc0cdd5d9c9e19498", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992783, "uuid": "0b60d8ad-ffe3-4899-a2e9-0a3d454ea4ce", "comment": "Malware payload", "value": "ddaf6208d1dcacb9a5f8626be126700d7e06e6d62bb60cee11d15bad9fee4732", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992783, "uuid": "d74906a6-41bb-4595-828e-a2ab407a3f51", "comment": "Malware payload", "value": "c828e4504ff83795836271d0eaec9d481c4bd298", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992783, "uuid": "7da3703c-3069-4355-a5ca-9ee888be45ea", "comment": "Malware payload", "value": "a3be5859c14e731dd4d76f154a92934a01d9c31976f39ce4d456826b38b5992003c6e288af817e686a9fb4c01a07249c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992783, "uuid": "12d31a92-bfc6-42d3-8d4f-c3c210a07e90", "value": "T1CCB46A72F691C0B2C697163C0EA6EB359BB4AE0509258A4373A4FF497D31531DA3A33D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992783, "uuid": "fbc6395c-fd03-426c-ad76-2a5048a2cad6", "value": "77b4d4cae9079b4a19a61e1bf90e1776", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992783, "uuid": "eb595c6f-22df-4eb6-bcc0-9380bd4c41a2", "value": "6144:cxoMQk3extmtMjpjbCHhz57ZWZBme8p44WyVsyfgdvUzc8V:c+k37tMjp+dZ4D9ym1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697992783, "uuid": "1daba8ac-300e-46c6-8b53-6718762122d8", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697992783, "uuid": "2f6ecfed-6d50-43dd-9eac-26143fbc43c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992783, "uuid": "00500320-3867-4036-ab69-3c87f2ba67d6", "value": "SecuriteInfo.com.Variant.Graftor.388539.8314.3676", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ffeaa4-70ab-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697959334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959334, "uuid": "861c54eb-3ac6-4f81-90ed-e51de8e32944", "comment": "Malware payload (AgentTesla)", "value": "ee921b2dc2d6e6243259b9f30a514485", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959334, "uuid": "fbb42612-637d-4977-81e8-ee6148776b91", "comment": "Malware payload (AgentTesla)", "value": "ded73ed6ca06dda8a329517c6f4c343fec14732efce77eff750f79544b846285", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959334, "uuid": "574ecf73-7d61-489b-b066-c4b08cf34d61", "comment": "Malware payload (AgentTesla)", "value": "947bcda15957d801a4b6294d4e3a8d59d0933173", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959334, "uuid": "46396cfa-4962-4503-b954-6133e96ca29d", "comment": "Malware payload (AgentTesla)", "value": "022ad420283e114fcd089c4e4d33ecb7a3d184eac92a84845cccdb1be889f618c75c4877bba4a356fc54178e269e7da3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959334, "uuid": "b559f07f-d7af-4f69-b039-f0b1327a4e6a", "value": "T184D412947B58A2BEC523C5358AB56C20A722797B631BC213AC27355D8D8C29BCF107F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959334, "uuid": "35218a3d-4632-4ad1-b1e4-3ad2ec60ee11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959334, "uuid": "be4f1d02-cf84-40a1-bf29-fbed92815c80", "value": "12288:Rq/j92RTlap4SpDbldYoDHhh12FXJfmirt4d/5avMgxJD+awlAz2:IL9UTlaeSRR62MJ/tIo/JDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697959334, "uuid": "986f6985-4b99-4393-a4c7-930c46b9cbf1", "value": 643072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697959334, "uuid": "49349bf5-0ae8-472e-9344-afcb47f3e1b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959334, "uuid": "b4523e84-b46f-4aa8-8d6e-dd5d99be39c3", "value": "XdltUFigfkX9CKG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d0dc9ec-70aa-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1697958750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958750, "uuid": "9f2c6678-9895-48c8-961f-a4fa1ea09c94", "comment": "Malware payload (SnakeKeylogger)", "value": "4abb9a7ffc4d990d37ff1108c826ff7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958750, "uuid": "3c57a4af-3719-449f-b6b5-9593d2f76bfa", "comment": "Malware payload (SnakeKeylogger)", "value": "e046ceab4b255e8af9af409eda3c2f1135bbd3dae0cc9af9b0102c9b054e66a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958750, "uuid": "4e721825-3221-4f4e-994c-6a50a3826922", "comment": "Malware payload (SnakeKeylogger)", "value": "8eff53ed8340c6c563d5e8a4b4d61c1db94165d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958750, "uuid": "f307a832-51d0-4ae2-9fc5-c92a18b19fa9", "comment": "Malware payload (SnakeKeylogger)", "value": "6a28f58b7dad3cdf962bea88a08ec7add7ff12fe3ed6dde140c16780d80eeea5b7ae299482d0956c506022b049a7341e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958750, "uuid": "d15810d1-adc2-48fb-9796-72ad56520334", "value": "T12FD4BDF526A8C7E2E7B557FF666750305A373D161835C28C3ABD31990EA2B934422E33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958750, "uuid": "6ec1e1b7-3a5f-48e8-bcf7-82d3613d888b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958750, "uuid": "f2dbb4ee-4bcf-4708-bcce-b3e682368987", "value": "12288:zWNU7s9/PMDT7jAm4I1Cja3YrMjkk+Ba52Nwa:zWNU7s9nMSI1QXEkxa52Nv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697958750, "uuid": "7b66451b-c545-4b47-aabc-c985a5292f0b", "value": 625664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697958750, "uuid": "78755611-065d-4193-bca5-d8d7ac3819b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958750, "uuid": "69d2e532-218e-4eff-8cb4-aedd44f3d58a", "value": "\u0645\u0646\u0627\u0642\u0635\u0629 \u0631\u0642\u0645 GST008010.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de9413be-7105-11ee-8907-42010a9c0042", "comment": "Malware payload (Vidar)", "timestamp": 1697998051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998051, "uuid": "10870a5e-6e51-48bb-9b76-dc15ebbe29ff", "comment": "Malware payload (Vidar)", "value": "b818812e87cc611226e5f4eb7e4a5e6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998051, "uuid": "3a0124bf-3352-432b-ab91-9836febe4710", "comment": "Malware payload (Vidar)", "value": "e08d8afc5e83a54fa0fb6c84de49af3e864ec3f362ed4e3c09459bbafba7983c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998051, "uuid": "68608d53-86b4-4b9e-8ae7-7c8309c2b054", "comment": "Malware payload (Vidar)", "value": "1bf3a74c13064590db411e2ca57392cb6d6ce966", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998051, "uuid": "0d1fe821-6f3d-4199-b852-3aa78786d7b0", "comment": "Malware payload (Vidar)", "value": "c305c70eda7fe2142f9a0638eaef29df0652b0b79e70d59c4b181dbfbc5af4c701d6e3ad9bffb136c5d9f025fa3bb534", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998051, "uuid": "88827848-f94c-403d-95a2-81934a89120a", "value": "T1B8859D09F39405F9D85BCB30C9199F32E2B4B45A07219FAF1B66C6872E73AD15F3A211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998051, "uuid": "58f25f93-522e-4232-8e3d-66f6b9a29018", "value": "8a73a83fdced3fd9c55fbc1b70e551ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998051, "uuid": "f88c2fe4-106c-4f9e-82d0-62aba1b7b671", "value": "24576:o+MOMrtVi51bGcK8UNQs3AU2dSUEfz7MZPQeEt5BQCDBULKhI:+OMr72NqNuyEilU26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697998051, "uuid": "9bf7179a-e612-42b3-a110-964ed8627965", "value": 1797856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697998051, "uuid": "5fa84361-a1ae-44ad-bf61-164f8fe4489d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998051, "uuid": "1dde9edc-64fd-4417-ae52-8e65eca37345", "value": "b818812e87cc611226e5f4eb7e4a5e6c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6102e95-70af-11ee-8907-42010a9c0042", "comment": "Malware payload (DBatLoader)", "timestamp": 1697961127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961127, "uuid": "19fadcee-c4a2-4080-8168-53fec4251d1a", "comment": "Malware payload (DBatLoader)", "value": "5d04f1abefccbc330d74800269bf79ef", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961127, "uuid": "864a6f0d-f261-4f87-af4d-168e3bd5d3aa", "comment": "Malware payload (DBatLoader)", "value": "e08e4eb8aed0ba0a861e34391114375bdaf9e958f881819760edd0f09addcb04", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961127, "uuid": "50b54659-4319-451f-a51f-0869c1c452e7", "comment": "Malware payload (DBatLoader)", "value": "d0cb9eb0f7cabfffee374a4604cb7cf6aeddf287", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697961127, "uuid": "5bac9985-03ca-4dd2-9a55-5a51b37d8839", "comment": "Malware payload (DBatLoader)", "value": "7410851ec0fda167a939288c0c38e6b51cb9914887aa4f41713ca4b186f6003d4d87b7ac19e5b09a6c5edb8d187f03b7", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961127, "uuid": "3e39431e-ddd8-4ae4-a7f2-c333690ad598", "value": "T1E395E125B2F28433D6335B35DCAFA295893B7F103E2894D6ABF81C8C5FB65843466193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961127, "uuid": "1c4455f4-92b1-490c-b762-c8a9cb6e419b", "value": "4569aa626af1b80196dcb0b68adcc830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961127, "uuid": "95434e3e-15de-43dc-822c-1e17d535898f", "value": "24576:3Te9LrsMoZkD/VOP/6juQp6DjasufyJIZlnLxGgVzwmDi1ETNay76nBWWnmQqKfU:3Te9NLVfn513VzrunIxND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697961127, "uuid": "498c701b-158f-41d1-a29e-b23e9464e27c", "value": 2039296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697961127, "uuid": "466e47e6-79f5-439a-9b4c-aef584b8236b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697961127, "uuid": "e93dc9ec-c2ed-444a-aca0-520e46648f2e", "value": "5d04f1abefccbc330d74800269bf79ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd8b9fb-7105-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697997996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997996, "uuid": "d583b975-1beb-470b-9bce-1286babcfc64", "comment": "Malware payload", "value": "606dce5bf2f39e865c865b42a41ff4ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997996, "uuid": "26b9718a-f0be-4daa-830f-6ac301936580", "comment": "Malware payload", "value": "e0bbaf1aab0f13de99c9d2754d782c3620fbb04fabadd8ef0f7e76816b9414a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997996, "uuid": "086fbf33-1e9c-4731-983b-5e6af1e9e267", "comment": "Malware payload", "value": "e7c73637296b9af34cd0c3674aa5b78d63925ac0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997996, "uuid": "5fb39643-f6f9-4758-8732-c846588a8b62", "comment": "Malware payload", "value": "7a08d44e35a581c360ce3012dfbd48002f2b0f0fe5aaf19bc009c604def6ded3c8410f4cea221010fec6a2ee67cd9b60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997996, "uuid": "755aa10b-a56d-464e-9adb-445407a9009f", "value": "T15C86331FCFE0A525EF99D2B85471254D1339DE2B4941B8FC30E12EB12B3BA24DB6E251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997996, "uuid": "3869dfbf-4c1f-46d8-9a76-7748c409e916", "value": "8d9da60ab1e5bc81384af66b8d964906", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997996, "uuid": "d8a13184-5e0c-4d34-bcf7-70074cf575e8", "value": "196608:Usvw/Vgo4LaUoYQkHAJGz//EKqyCP0kH9lZNh+:+NHSfSGz/cKqyY0ijNh+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697997996, "uuid": "2d853122-63fe-4963-9508-1740cb55787f", "value": 8547275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697997996, "uuid": "3ec3efa0-da48-4346-ac6c-430102287471", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997996, "uuid": "76761428-1f2a-4ffb-a504-542cf6dfc5b5", "value": "606dce5bf2f39e865c865b42a41ff4ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b09966c8-70ab-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697959319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959319, "uuid": "edbf03fe-60fd-4797-9f68-d5ed5eb644fa", "comment": "Malware payload (AgentTesla)", "value": "a469460d02981b95c69e690df52b3a03", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959319, "uuid": "b981505d-a6aa-4e85-adbe-345856000263", "comment": "Malware payload (AgentTesla)", "value": "e2811e462b73fc7c62941b8472d9989a048509e8e6aed7012bc5f786d0f7bbe7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959319, "uuid": "60016dd1-5bd9-433e-b906-148679daa181", "comment": "Malware payload (AgentTesla)", "value": "ce84d5e69148433406694946b6014328a7b068a5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959319, "uuid": "364b3c83-93f8-427e-8bd3-ab1a8441af57", "comment": "Malware payload (AgentTesla)", "value": "e8f721f47d96945e877b79eb0f950d27f2e2dc3d46309469608bc9d802ddf07611d07dc745b801c8ac6652e8f499caa4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959319, "uuid": "c5eb4756-67ff-4bb5-84e1-2e9e4fc130dc", "value": "T1B4C412A43380B7BEC827C5798AB02D90E711A45F570BC666A06760DD8E4F69BCF507F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959319, "uuid": "d52a66f6-e1e0-48b1-b9e1-78211e2f24a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959319, "uuid": "6fec2797-1145-4be1-814b-2e8e42d7e8cb", "value": "12288:R/jR6Vy+MNI+MJNEAfKipTE0IhJ4Rnz0Dv3V/A211wd9kEnxE:RLwwNI+cVTE0v6/As1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697959319, "uuid": "3a0f7d8e-d5ba-4756-a07b-33f19e6faf32", "value": 571392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697959319, "uuid": "d1f614dc-b72b-40e6-bfe0-e574cd1be990", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959319, "uuid": "ee71d04f-8e56-48d7-ba22-0644058987c5", "value": "ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9cc8f49-7090-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697947819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697947819, "uuid": "b2a83b90-0550-453e-b7af-3def313ed062", "comment": "Malware payload (Formbook)", "value": "c1de658c25a91872eb189a4a0da3884b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697947819, "uuid": "0cd3b014-0001-44e7-843e-3d574a35fea2", "comment": "Malware payload (Formbook)", "value": "e29bea0ff59c99ab514f71bdea806d5839f9df80723bd8e589c51bb53f274d87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697947819, "uuid": "0a5d28c2-0d36-4dd3-a7d9-c8a508c86b3d", "comment": "Malware payload (Formbook)", "value": "de1bbf2b693d0a955e9c0cc87ae3ae069087cef0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697947819, "uuid": "132d2723-bcdd-4850-82fc-09b088d6c1c5", "comment": "Malware payload (Formbook)", "value": "d9e588fe7ace2ef93b68051e0d2b3b977894ddc0e9c5181fb5f8289f8165dd06015a5aee9d3a31341801e0ad6215e027", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697947819, "uuid": "b799de24-fb39-4cbb-b438-7996d0423e64", "value": "T1D0157D2138809232EEF320B787FCBA2542ADE0B0071955DF56E857EED7606D17F32696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697947819, "uuid": "49b1c8c6-4ad3-49b0-b18d-308f602193c0", "value": "440e77e14aa712e0e687ae6e10b63f30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697947819, "uuid": "a18e37a0-d696-429b-93bf-9e8bd274418c", "value": "24576:ZhmtwAOC4b6HtHHHHHHHHHHHEsydhVrjeQ:2OC4b6NHHHHHHHHHHHah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697947819, "uuid": "01f20de6-117a-49a9-b319-d4d194575206", "value": 938496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697947819, "uuid": "12f26b29-630e-4f35-a258-7bdf56f09af7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697947819, "uuid": "d3c468a6-acc2-4d3a-b75b-69452dec0678", "value": "c1de658c25a91872eb189a4a0da3884b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdb9d3ba-70ab-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697959341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959341, "uuid": "fe3e3e5b-9c3d-49da-b170-561ea92616bf", "comment": "Malware payload (Formbook)", "value": "bd7d9e25eb411dc50797883dcb932a9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959341, "uuid": "a704ac95-bfbf-435f-8ed9-5128298124fe", "comment": "Malware payload (Formbook)", "value": "e3bad3b72d6b9d9572d3c2df6e6e02b08366065d4dca0d65d868c4d7d9ff52c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959341, "uuid": "43e57fad-cd25-44a6-98d9-dbdb669dec5a", "comment": "Malware payload (Formbook)", "value": "16a066628f7d9d0fe4f4053eca6b51f19844375e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959341, "uuid": "e48c5e79-76b4-4958-a4d6-5ab718b6cc51", "comment": "Malware payload (Formbook)", "value": "9590c970d261b6b7c3f02e3f0dd162a75b2756e474b61a0b34ee50983399e21b0029232ebd58bc6817f860015a5dae0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959341, "uuid": "81d32fa3-e2ef-4d12-95ef-a5982d136a91", "value": "T19EC4125D3794B2BEC977847A96F02C24D761353FA31BC312946321AA8A4E6878F153F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959341, "uuid": "7a098ba4-86d0-41c1-9639-ea217827ec51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959341, "uuid": "fa6137ee-c86b-49f0-8f07-c73eb85cc8b6", "value": "12288:dvs/jTTrK3U0DMEJ5T0nPc/wVI7ZZ41x8//SEeXD+wl:xsLTq3FvNagHdx/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697959341, "uuid": "7f1f6a55-bc95-4414-b939-b3367fba1bb5", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697959341, "uuid": "fecd64cc-8e55-4e42-818b-38a77ffa029e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959341, "uuid": "577725d5-ae64-42c0-b77b-bfb43f50e22e", "value": "HB-252-23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d174455a-70ab-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697959375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959375, "uuid": "8bb270b5-380f-42a4-8e28-356c4c248f58", "comment": "Malware payload (AgentTesla)", "value": "d5cf794b8931228454a9218eba67c8c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959375, "uuid": "15be381d-6d39-43b5-abc7-971d807117f0", "comment": "Malware payload (AgentTesla)", "value": "e51cde73b2f4b0b897843235d5db557cbdcd41f3e5b4c2a4c31886b95e5301d4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959375, "uuid": "e51acfae-9319-4826-902d-7eb05575b0a6", "comment": "Malware payload (AgentTesla)", "value": "c58237c6e67e028bccaac59d4fb6791bf8ed646f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959375, "uuid": "897e4fe2-8656-4f01-bd39-fc1a1cd10666", "comment": "Malware payload (AgentTesla)", "value": "9b6b35fc5feaba7c96d1adf6d73009a021d58e6484d1b77e8e8559ed8686467a27624a274e25e1024a25de9b47c774c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959375, "uuid": "3665260f-8fe0-4f9a-9b4e-c387145cec7a", "value": "T141B4120013AC1737DEBA47FAAA545140B7B69D2F5A53E78C0DDA32D707B2B548632B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959375, "uuid": "89e56f0b-617e-4da3-b88d-fbc3a48f5602", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959375, "uuid": "6997180e-e4a9-4e1a-977d-dd30bb38a800", "value": "12288:ob7s9TQ9WseH/0px4aPQqyYxe8Bxm78xlaGgci:c7s90EHu7t3xPiWyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697959375, "uuid": "6fc307d2-0264-43bb-97c5-6619d5c577b9", "value": 542720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697959375, "uuid": "3637d07e-31c3-4ef5-9523-b9a74bb29972", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959375, "uuid": "952b1274-8d38-484b-bf60-6fb45009c065", "value": "231009-001-FACTURA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b1a4f25-70ae-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697960465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960465, "uuid": "eca84379-4f12-4a1c-be34-e46f1e4f2db2", "comment": "Malware payload (AgentTesla)", "value": "74171a0664cd5359666991b36d21161f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960465, "uuid": "1698ec6f-41d2-420e-b3a8-594e012191cf", "comment": "Malware payload (AgentTesla)", "value": "e538275e29f02ec135d0adb7ac25074f85409c332c6fdc9b286a7574d4e36ce9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960465, "uuid": "7c034f05-dec9-40fd-9b4f-8ab1111b28e3", "comment": "Malware payload (AgentTesla)", "value": "4ecf1ec1fac16773ef0561355664c03062db884a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960465, "uuid": "e47a610b-0dfd-4e39-b5fc-5a78e7a247e0", "comment": "Malware payload (AgentTesla)", "value": "af1ff587a7a48db1650955d191b7548a071a822acb9021f023d28ecf75ba77b7088db9f6439547757f5cebead6e2d8dc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960465, "uuid": "3e12caad-6cb0-4c60-b84b-40812ba7967c", "value": "T1B7E4238833F80BB2E5BA637DD1551260877662251E32FE265EEDE1F83923B9C4501F87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960465, "uuid": "c2682043-aa41-4652-954f-d283853f5f9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960465, "uuid": "6cb59e01-0c1e-43f1-a0ab-ee5e2a4857cc", "value": "12288:lMm1vjJGGna19n/2zuYbcTrIAkwb0SFAUvchvRfmSC6UVHGKH0KqY7jhjSrHT1:lMm1LJ1na1R/2zuYbrnwYSFzqzYVUaFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697960465, "uuid": "722a20cb-1588-4794-a924-ddae5667d0f6", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697960465, "uuid": "9c8ebf4e-e91e-4f36-b9e3-7b544b26f24d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960465, "uuid": "67cda2fd-f7d2-4ce4-bda3-ac1aed07904c", "value": "Payment Proof.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa4f0a7-7113-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698003816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698003816, "uuid": "e303da45-1f28-44f4-98b3-fb46c4cea0da", "comment": "Malware payload (RedLineStealer)", "value": "0e74d282ff4a6d6d14917330acb11e19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698003816, "uuid": "d3ffd2b0-f2dd-4a44-bae9-d1a2860e1a23", "comment": "Malware payload (RedLineStealer)", "value": "e658a5b736828e06a859fe0cd526310e7b89a2ede6f81929249d91521343505f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698003816, "uuid": "6786e72d-ab6c-4ed3-b4bd-c84868c3f7a1", "comment": "Malware payload (RedLineStealer)", "value": "9ac6ffde7f76f8b1048db435df76b0a21065d92a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698003816, "uuid": "1929dcdd-c56a-42f8-9fb6-c83b0ca1e367", "comment": "Malware payload (RedLineStealer)", "value": "e0438126587f2a2fcd663cd117ad457dfe9118dc502233a53d7232768f11904171a9b301bbb804d63b08db5b46a600cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698003816, "uuid": "2a1f2ccd-c514-446e-8ac6-2b13bfd9dd24", "value": "T1D9B46A51B0094F2AE3F2087CEACA5DAE4D507EED6F530B8F36C54B8167967D1A93810B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698003816, "uuid": "2ff1c0db-34aa-4297-b2ba-c01bfae7ab46", "value": "d350427820086a321ccf21b695161218", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698003816, "uuid": "60d65900-1f18-4d47-b3ca-c9c9e24dd37d", "value": "12288:k8m2l0KEQB2o97Hr62k3n/+pLsv9+eXUeF6+1L:VlbEQkAr62k3n/+pAv+eHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698003816, "uuid": "16067213-389f-48e5-afbd-48e9404cc946", "value": 507976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698003816, "uuid": "705de5b4-bff7-4928-994f-39587e22871c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698003816, "uuid": "659a6500-0bee-40e5-a5f2-2046da5123db", "value": "SecuriteInfo.com.Trojan.PWS.RedLineNET.6.26028.14909", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cec455fc-70a0-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697954646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697954646, "uuid": "29fc8666-b73a-4a44-bb42-61e78ca35b1a", "comment": "Malware payload (Mirai)", "value": "e801440a0b217de67fa9142bee4582d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697954646, "uuid": "df278509-17d5-4129-94d6-6b88e02d198f", "comment": "Malware payload (Mirai)", "value": "e682b504d8dc625eddc2e511c8a5137dab2bfaf682e9b0d37de8d601c30b444f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697954646, "uuid": "1cde833f-ebcd-480c-9357-da0aa3333d84", "comment": "Malware payload (Mirai)", "value": "d9850a1e465cd6b6645ccd8188c74a2b9898ff29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697954646, "uuid": "3fe600c5-14a1-4ca9-8af6-d18ffa413270", "comment": "Malware payload (Mirai)", "value": "6117bbe42392a6b21ac9dfa097a67b9938e029aae5088e0a973fde4a06928001fc25d2e66267e6a6dba0a4bb9f67fe10", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697954646, "uuid": "6b3ade9b-692e-4f2d-8544-9e7bbc187424", "value": "T1FEE2F1A39372A052DD786AF1F9ADC9C76BBD4B6CC57B30B3160516182D5A0435E3C4D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697954646, "uuid": "e375e115-e7b9-48dd-b503-cf85a425b9dc", "value": "768:PoiWiO031vpAPbrVWZK3XVGxm9Xq9q3UEL5Ix:Porm1vpALgUJfLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697954646, "uuid": "f84b7225-c4a2-43fa-adc5-4af4308f6adf", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697954646, "uuid": "c2a13987-8ea9-498f-bfb3-3202edae557f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697954646, "uuid": "eaa84965-8b0b-49a0-a955-04df057878d6", "value": "e801440a0b217de67fa9142bee4582d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a921fea-7106-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697998125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998125, "uuid": "6af9375f-c9ff-4db9-a52a-b8504cee7b46", "comment": "Malware payload", "value": "9dfda03705d9f495375c68142432f08e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998125, "uuid": "b2936c73-04c9-407a-b876-7c4aa3a5a8b0", "comment": "Malware payload", "value": "e6e1bb6ffce2f35be1d676524ab141ba5cb6c1f434d7416a45321506ca0cd6a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998125, "uuid": "5d737bd1-b5b7-4a00-8a39-b77caf3245e9", "comment": "Malware payload", "value": "b51243c3fbb38acb12028cadbf0682abe733bb33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998125, "uuid": "f0b2e2b1-bcf7-4e95-a8b0-404079389510", "comment": "Malware payload", "value": "eae04925fb5bdb25f764982d739be4a010ef7511af8399b08e325d90d2314774d5ef6a61070e8887e0260e39c49ef846", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998125, "uuid": "dfb04229-03a9-4804-9f1f-3bdba4863363", "value": "T1FA262337426D000AD0F5CC3E953BBEA931F553B29B816CBD55FAAEC0372686CF146692", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998125, "uuid": "6d0e68ec-3f28-4319-a6a1-81c3e045854c", "value": "4aee233d15b685ccabdbfcc2a27aab2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998125, "uuid": "18be8fd3-4907-4968-9b59-1a9d276264e2", "value": "98304:sm9mYZ+XMNXmLVi4XcE0+r6g0Ip7ZU9cYM622m9WmIuZttxaVSuyJZyQ:YYIphsE0+rPeXM62cmIItAPc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697998125, "uuid": "4ee0b880-ffe9-4398-afc2-4152fa055a38", "value": 4809644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697998125, "uuid": "2f31cc5d-ad40-4227-aac5-73655e6dccfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998125, "uuid": "e3c25f7b-23d2-4978-9669-ddab2e661881", "value": "9dfda03705d9f495375c68142432f08e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d702e128-70a0-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1697954659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697954659, "uuid": "bb7e31c6-2378-4bc2-8317-85e71046d26e", "comment": "Malware payload (Mirai)", "value": "50614fb3b2beda062dd894dc2c2ff78b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697954659, "uuid": "66a3db8d-0a71-4f85-99c1-378aa8a40a79", "comment": "Malware payload (Mirai)", "value": "e705e59130236863ecae126e4b70f3741c16ae0ea36123c48e5ac9dd7a875ade", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697954659, "uuid": "9a7aea05-967b-43b9-b99c-96da64e73040", "comment": "Malware payload (Mirai)", "value": "d71f3081acc28d252bcf73e38e5abc6ed301966e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697954659, "uuid": "c6d1d47a-d43b-4b64-8a17-c3a4af9972b7", "comment": "Malware payload (Mirai)", "value": "04c9f3d5a244c677c3c92aabe22fcf9bb4806e35c13603e2ebf298192fb635061afbc8d38aeb33fdac1f7cc60569324a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697954659, "uuid": "13da2f0c-fc7a-4817-82a2-0b0cdc66bbe9", "value": "T15A539FA5C5ACAE58C71441B8B654CD388723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697954659, "uuid": "3721ae3c-587f-4377-a1bc-4e52224fe062", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697954659, "uuid": "a1240260-2d83-4dda-914f-f84b535c977b", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697954659, "uuid": "503074c2-9b1a-46a0-be37-1340db225da3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697954659, "uuid": "c501633e-a0db-4758-b0c2-4888f37dc854", "value": "50614fb3b2beda062dd894dc2c2ff78b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555de30f-712c-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1698014571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698014571, "uuid": "b39c4747-aab5-4b1e-b792-c848ba7917c4", "comment": "Malware payload (RedLineStealer)", "value": "233fe23ec789ac2a46a1dfa31d426239", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698014571, "uuid": "1fe915d5-86f3-4602-bb3d-e58b31c5825a", "comment": "Malware payload (RedLineStealer)", "value": "e7265bde62bf6e3ac1823bdca2a6cadd062331558ee13465dc4813ebe47860a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698014571, "uuid": "edd0534d-b485-41dc-84d7-5f52c6c60cd5", "comment": "Malware payload (RedLineStealer)", "value": "8913a914b15d3a10d5f35f4ac508b16fb4b0af7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698014571, "uuid": "6cc91f90-61d1-4cf1-aba2-30599872e9db", "comment": "Malware payload (RedLineStealer)", "value": "547795ce44d5d9c1870f60e41b316c0a8a8b879d4931d1ca537e9086a8708086617c6d8244fa5eb36a2122223688404a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698014571, "uuid": "c2850858-3f8d-474c-86d6-3d5f46180275", "value": "T1A5B48DAEF5D0F831C077C572C81F6728D4939E788B061BE77EA1C56D16882E2BA764C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698014571, "uuid": "de378a53-44a2-4582-81c7-d772f045aba9", "value": "d52ccff4f325ce6b295038c3a3f9150f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698014571, "uuid": "75042f25-f3c0-4fa7-9305-68ec4da1d92a", "value": "6144:ZnWQryTu88a32/vpUOXia60CoOO5R2ZnxQdLTJFb246eQB8ApxwNh:lWQM8awvpUOXia60C3O5R2sdLu4uBPyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698014571, "uuid": "857c2f1a-bb9d-4d74-860e-30e7209662d8", "value": 509512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698014571, "uuid": "b725a1ef-b04a-4e87-92e6-cd5f06fe8724", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698014571, "uuid": "5219f95e-0c73-4430-bc0a-6c1b8da2cc4c", "value": "SecuriteInfo.com.Trojan.Agent.1754.4985", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d007041b-70f1-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697989437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697989437, "uuid": "8ebbb20f-e7e7-47a1-88fe-8813ee1b01c8", "comment": "Malware payload (RedLineStealer)", "value": "a1fdf74f23be947253a251aa93c1fe04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697989437, "uuid": "93371e34-0516-4469-bd20-0eb27c82444d", "comment": "Malware payload (RedLineStealer)", "value": "e748eb9edda2ec9503bd01137e398e447294a6796d9c52618d07c03601822b29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697989437, "uuid": "8c52d633-056f-41bc-be35-86680b87b3df", "comment": "Malware payload (RedLineStealer)", "value": "10b563c8cc16ded3c2dde24692eb0e0b3ca2bc3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697989437, "uuid": "efd1c2ef-6155-4973-9c13-d981f0baa8a3", "comment": "Malware payload (RedLineStealer)", "value": "e3c688ec6ea3066cc45d82f676a30f3713b6d073a4581a80b397c8c2fd5f1639f36c76d84ad1d9e368ef7c1522d705f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697989437, "uuid": "585c99d9-2ace-4b01-bbc1-ede89065d45e", "value": "T134765A97FC5151E4C1AED37486664262BA703C881F2023D76B50FFB82E36BD4AE7A354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697989437, "uuid": "629a3979-788e-4143-b203-b64b07368a12", "value": "85cddd6092e65c1a58dd1e6e9ab9fc63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697989437, "uuid": "9d8f7b25-b48f-4426-be82-9f2d097dedec", "value": "98304:duHAksPOiudThBPNp1NAZjNojMCPeT8ogafpLUhPDFHy2Zr11jr28ny/4hqZgNdF:du/r1bJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697989437, "uuid": "52a24cce-40fd-486f-a4f2-ed1a5ee8bab7", "value": 7790080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697989437, "uuid": "6c771912-a5f3-4744-837c-fc04597caa1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697989437, "uuid": "047ea261-bb35-4ff2-aec5-cb1877326a73", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff9849e-70db-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697980042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697980042, "uuid": "6e2d91fa-92d5-4b3b-8950-88312cbff870", "comment": "Malware payload (LummaStealer)", "value": "f550ae83fc02518ebaa7a774d88f2532", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697980042, "uuid": "3869503b-afc6-44d2-981e-ca654d02c540", "comment": "Malware payload (LummaStealer)", "value": "e75b58075d267d0a6e99f8c1b712ed84f7511570de67042e805ccbfe68abca43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697980042, "uuid": "02b591f0-81ab-4e1c-beef-e6b1c4de2608", "comment": "Malware payload (LummaStealer)", "value": "13e19d4433d8bf8f7ade06e13c36d5743e433ac3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697980042, "uuid": "de6c9a40-f6e2-47e9-bc21-73077ef4b344", "comment": "Malware payload (LummaStealer)", "value": "7dd70f212fc36534cffd3fa2603e960ed63e8024bc72bae96f5926914920aeaf33f3392b77ea1e2317a82216fab44f5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697980042, "uuid": "ed9f2de2-d413-4114-a415-e9580d0a504a", "value": "T13F44D01176A1C832E5626D384930C6662E3BBC729B7540CF27A43E3E9E713D16B36B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697980042, "uuid": "efce4d61-4250-4e07-b6d3-f717b6027c6d", "value": "d2a54e4207f7fb1f334f58a667aa3417", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697980042, "uuid": "feaf317d-200a-4b5e-8993-28dfa353e679", "value": "3072:byBN7fcxA7GaNA3ISy8g/CEaM/sD+ECh/wV46UPXHaxECb:qdf6A7pNAYLj/CITECh/o3UfH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697980042, "uuid": "9c6f9cd3-a07a-4266-bbfa-eb6be38bc48b", "value": 261120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697980042, "uuid": "820c318a-2fe2-4804-b5d1-4de91b444a3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697980042, "uuid": "7eaf2dda-0196-4e3e-b951-ecdfc556ce80", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c8b2623-70f9-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697992787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992787, "uuid": "cd4d4c84-3d33-4197-b7f5-a979e447df88", "comment": "Malware payload", "value": "6b2385d15e3245449abe7c09a47e6c80", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992787, "uuid": "52ed7d33-d3a2-46c8-a007-182144904c26", "comment": "Malware payload", "value": "e7a6ed43ea18934838e5061f80368fd261d04006220eaac6c584742225a01c64", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992787, "uuid": "8e21f318-dcef-4bb7-95e5-b0054361ff7f", "comment": "Malware payload", "value": "9b91b3c923caee0259bd6bb73de4c116ececb946", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697992787, "uuid": "12295fb8-61b9-429d-9063-8cb42c410fb1", "comment": "Malware payload", "value": "ffd66d513b9677588f696c79940c872dda160c90b90c97af5bb69879a7a6e44c53799623025dbe7edb0546311f2afed7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992787, "uuid": "77fc6254-641e-4f72-8721-2dff3b068315", "value": "T1A2747D6A79EFD436C03908318DC78BE4BA69F8174C8346FF6AACF61C1D39550A933265", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992787, "uuid": "8236f1a4-55f9-4f7d-b237-ab1512fea34d", "value": "e07e82552a366c026046c6e5bc1b7de0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992787, "uuid": "b7e1c634-950a-4ee6-b922-77628a8de923", "value": "6144:JV7n4O9gIjxtwVlanyvMC+oSKtOCORcxsfcemTg:JR4hI1tOlrvsoSKtOC4fcTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697992787, "uuid": "51d45df9-ddc6-4b11-bb89-845abe5c825c", "value": 361480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697992787, "uuid": "edb812f1-3d57-43a0-b802-e00974b9d61b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697992787, "uuid": "af386582-8481-448d-aa10-be1d6442d68c", "value": "SecuriteInfo.com.TScope.Trojan.Delf.1509.29974", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce6bf9bc-70aa-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697958940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958940, "uuid": "8a8aadb1-306e-4f2f-87ec-6ac0e8727d91", "comment": "Malware payload (Formbook)", "value": "b381723baa76f866458dec454fcc9829", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958940, "uuid": "00e61ce1-fb1e-4318-ae86-276c64c41e2f", "comment": "Malware payload (Formbook)", "value": "e7acff90a1aa9c97969814dd2161c54e1e2634b1b6879fbade91fd2649e7b819", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958940, "uuid": "0f9371a1-92bb-4187-a10f-cfa1987fc44a", "comment": "Malware payload (Formbook)", "value": "ca7089f9271534c664c23f641201516ddf13c81b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958940, "uuid": "74b69dff-27a4-45dd-bd57-6336f1943bfd", "comment": "Malware payload (Formbook)", "value": "8c94bde78be79c79608d2e93f0160e08c60a1410c967355a7fe1fc2e6e7eccb04573a6e9189cf111de407ad84260048b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958940, "uuid": "d03a7246-bb7d-4ad9-b83f-2b176b02757c", "value": "T104E41206B3AC9933DFBB0F789D662201A7F1692A1D11C68B9EC471DA14EFB344520BD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958940, "uuid": "abec6065-df9b-4c3d-9a92-82f56b671470", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958940, "uuid": "6ba8b21b-852f-49ea-8c14-7c345a9fe28b", "value": "12288:6Ak7s9/wMgHZRZpQj0XWMzp6DZInFuwhXc0miKcwsy58urKZI1i/mmDv:Nk7s9/Vg53u0mMziZInFhhs0miKG1aij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697958940, "uuid": "6913abee-3317-40ca-8b65-fbc39bea6a12", "value": 700928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697958940, "uuid": "d83e8a19-c506-4fe5-982e-25ad454b4d4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958940, "uuid": "3466a3bc-b2cf-4a8f-9c5a-b6f63f13400d", "value": "SOA SETTLEMENT RECEIPT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7bd64e8-70ab-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1697959358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959358, "uuid": "3ad59e38-a612-49e2-aa62-70b134049e38", "comment": "Malware payload (SnakeKeylogger)", "value": "2d66096847c27f7bf622ae8476542ed7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959358, "uuid": "66de3a6b-1649-4b7a-8fa4-a79adafe2652", "comment": "Malware payload (SnakeKeylogger)", "value": "e83237f842bbab2c829f8c7c40271322f6227851ca2091733ea477ecd89c7e13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959358, "uuid": "2c8ea936-907b-4f3d-b4b4-34b47a1805dd", "comment": "Malware payload (SnakeKeylogger)", "value": "8a0efce6eec8dd954671d9307fcf494236badcc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959358, "uuid": "3d6d9977-2052-4e12-8a6c-df57cf5c7901", "comment": "Malware payload (SnakeKeylogger)", "value": "f2896e093a801424365697f42c65d8c146fd097f60dae7df831c416482b492d86d60578906de2cf191babd5c0ddf06dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959358, "uuid": "f9403ef4-6bdc-42a4-a3fb-ad0a6f19e46b", "value": "T188D4BEAC3210B6DFC867CD7689686C64EAA174B7631BD203901715EDDA0EADBCF141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959358, "uuid": "e6f33170-deba-4609-9cd9-f511750e2e36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959358, "uuid": "79a8afa6-b9c7-45fa-833b-e664eb94a237", "value": "12288:pjgKA87zfqBNgfNOrwHHA3eo/6yA0RCujD8ZZ3QxX4z6aHazRhV6t5AozVaqqjLO:piAT6gUsHUeoxQwD0ZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697959358, "uuid": "ccee87af-6df6-4cdf-92d7-9eebfa4e259b", "value": 651264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697959358, "uuid": "48086351-320c-4eb6-b9c8-e8567cc4a1de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959358, "uuid": "fc095a06-db80-43d9-ac5a-f0bce0811b6b", "value": "2d66096847c27f7bf622ae8476542ed7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf500b61-7105-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697997999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997999, "uuid": "211caae5-a556-4b22-a38c-06fdb8ea8c51", "comment": "Malware payload", "value": "1f3a1e87f0ae00264d59b3071fc50c4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997999, "uuid": "f4d4bc9b-8954-431e-ac1c-400a813a2e16", "comment": "Malware payload", "value": "e88175232d055153cb8ed4f4d46fc97a612eebe5460063f1c6fd14edbf25cb7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997999, "uuid": "04817e8f-d01f-4884-aaa1-1221c3a4e79a", "comment": "Malware payload", "value": "9823ca025f735b0fd6b85842fdf32ea3327ef0d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697997999, "uuid": "44142aea-d7fe-4829-846a-0930f1dd4181", "comment": "Malware payload", "value": "9966857e2758863394a024b22aedb04ec2c8dbb993796e98f25e45cdbc1284e8664b686042609318865afbaea115698b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997999, "uuid": "5fd3b2df-2210-44c3-a1d5-5624c26507d0", "value": "T1D1E412117B91D072E0672D361971C9901E66BCE3AB2546CB33A93F6E5E316E01FA6F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997999, "uuid": "153c8dae-acc7-4784-8023-fe15be722e18", "value": "77bb604ddb8d2a9df61815c9b5a4d907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997999, "uuid": "eed9f6ac-c86e-4689-baf9-f32784eb5887", "value": "12288:iEq9lhhJyvzVuJrvNJokMdbqzpHOefQZWBh4lWhffcIaalKNjsP0NXat:iEaMvI9lCk1QQIWNE3aQsmKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697997999, "uuid": "1c7447b1-1ab0-4645-9ba6-aa1f4138a6e7", "value": 712192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697997999, "uuid": "4611496b-5e4d-4550-943c-ee1a4725f075", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697997999, "uuid": "3fe12b78-be43-4cae-b149-011604260e58", "value": "1f3a1e87f0ae00264d59b3071fc50c4b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb16718b-7079-11ee-8907-42010a9c0042", "comment": "Malware payload (Vidar)", "timestamp": 1697937862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697937862, "uuid": "3dcfa6bf-ec5a-4608-8f0f-23400e37f88d", "comment": "Malware payload (Vidar)", "value": "7f8fc19d84a03ba3446cb151a41a813c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697937862, "uuid": "bfa64f2f-7e90-433d-bd28-cc307408d5b7", "comment": "Malware payload (Vidar)", "value": "e89d8af6209b99543fd2dcc8a37842d40e4d54ab8f52ce635665c432a152d8d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697937862, "uuid": "eeceebcf-9ae0-4a2b-b9ad-cc233ed4cc6f", "comment": "Malware payload (Vidar)", "value": "55ee487fe46e4a15744d44a5422e149a7afb1265", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697937862, "uuid": "568b9359-e935-48a6-aa98-ef068c41f048", "comment": "Malware payload (Vidar)", "value": "82d77222a20d5e9a87335566c20971c66f90015d3d4672f80040fba8ddcef4d76abe30f71456914b838187bdaab6d153", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697937862, "uuid": "6149357e-378f-43e3-ab8a-3bb9f8f8be0a", "value": "T18B858C09F39405E8D85BC730CA1ADF32D7B4B45A0722DBAB1B66C6871E73AD05F3A611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697937862, "uuid": "4669223d-28ba-42a2-b31d-7671010a8d5c", "value": "8a73a83fdced3fd9c55fbc1b70e551ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697937862, "uuid": "96ed5031-c8ff-4cf2-8761-0a85964bf1bb", "value": "24576:IegXZg/t6PuVzXU0pZABoMj6ZHHy1PoAboHXwM:GXZg16uEgltOLUHXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697937862, "uuid": "4539e647-f696-4f3b-b734-00dbd07670a4", "value": 1797856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697937862, "uuid": "ffb18612-5535-49f3-ba7d-c8b602423007", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697937862, "uuid": "003a1164-404f-41fc-b20c-04009434420b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd417a5-70f4-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1697990802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697990802, "uuid": "21c784ac-d44f-4053-803d-cfc5577fe573", "comment": "Malware payload (Stealc)", "value": "78849e44d5744bc62cf70d63e7798e49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697990802, "uuid": "d0fab02b-660a-4f8e-9b37-3846fa175f84", "comment": "Malware payload (Stealc)", "value": "e8d1c4f4cea682bee4ba4105f14bab0f6bcec51727080e1bc76993fa82f214fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697990802, "uuid": "5d99dc27-51ae-4a78-8229-8abb9b1802c7", "comment": "Malware payload (Stealc)", "value": "2acc897a1362d95e8ca76c06120b357ae700c388", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697990802, "uuid": "c86055ab-a324-46a5-b64e-6274fc82c452", "comment": "Malware payload (Stealc)", "value": "197454963510a0671d468fed93d4db997ac8653c5148ae7b60edc3f64a4cb26222aadec2a66278c42ea57d0ed6fb2d05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697990802, "uuid": "726af634-4011-4a95-99c2-5114a2d1201e", "value": "T17604CF217690D032E46758311970C6A12E3BBDB2AB7981CF37943B3E9E707E05B65B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697990802, "uuid": "7f2541ea-8a53-476a-bfb4-bcd76d2087c5", "value": "d2a54e4207f7fb1f334f58a667aa3417", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697990802, "uuid": "04d6c2ff-3839-48fe-bc17-fab8ca27d283", "value": "3072:yyBNcfOg6AMoKASlflSBoi1dNoqI6WjPauFG1AzfCWUjdjBvJiQX:ZNdAMfASFWdoqIdraoGizXsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697990802, "uuid": "148b4ffa-017b-4438-9142-1f3b36296940", "value": 182784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697990802, "uuid": "df123ae9-5b6f-4c9f-a05a-cce61e9bd6a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697990802, "uuid": "58fd679c-30b7-458a-ab95-9613c66c306e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74799d80-70ef-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697988424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697988424, "uuid": "9db724b2-351c-4eb1-b36d-998060fe8740", "comment": "Malware payload (RedLineStealer)", "value": "1b4ed4549d97c14ef15ade9f64899b8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697988424, "uuid": "63c0039f-4974-4bab-9b5c-c0b0e76dd20d", "comment": "Malware payload (RedLineStealer)", "value": "e8d888e9c378c85effa36cf88d4c27068be318909b1bd702e58b3796bde89a36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697988424, "uuid": "69a840e9-81ac-474f-be3b-f91eafd6469a", "comment": "Malware payload (RedLineStealer)", "value": "6ffa70ea1a88ec213382a3f5d722a7076fcc6503", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697988424, "uuid": "a7e2b65c-53d4-4dfd-baf8-b2c1ae32fee1", "comment": "Malware payload (RedLineStealer)", "value": "621548f2fd7c1ff079548230af66a412a345a43cd6036d75e0545190f6bcdf8411001f8963b0249a286749c88239dc6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697988424, "uuid": "eb421add-4f4d-464f-8afd-cd6251369973", "value": "T179652313FA94A433EDF20B7454F6035719377CA50AB593152B93BDAFAD72091883836B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697988424, "uuid": "dc3bad79-3a95-44d7-bde3-b46be2f9a232", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697988424, "uuid": "9acf2eff-7988-4a81-8d0c-f6bf47ff0fbb", "value": "24576:GyVMc25fMRbk9hccr3c/5pA6u5jI+6NLGzLPsxoWqIamdgyq:VH25fs8xI/7PuTTvsGWqIa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697988424, "uuid": "7dd722ab-28e3-479b-b82d-e6c7a5c3dd2d", "value": 1465344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697988424, "uuid": "7be77078-d745-4b67-b257-9743c32d1f77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697988424, "uuid": "2e3c7209-81cb-4cc6-a188-c32cef0bed15", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34366f2f-707d-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697939354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697939354, "uuid": "9b0f7968-f060-4685-80d6-906c5e8e46f5", "comment": "Malware payload (Amadey)", "value": "6d6cd214f96dc965fa25cb8bc9a48fac", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697939354, "uuid": "f5ccd763-061a-40b5-be8c-3fc2dd154af0", "comment": "Malware payload (Amadey)", "value": "ed2105c5e79ca8d9e899ffd7f9085baf283aa916ee8953e6c6f3189dbbf01070", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697939354, "uuid": "0cbb147f-35e8-492c-b138-0ecd4c5a815a", "comment": "Malware payload (Amadey)", "value": "f56bd5e017330ef931593e5216c961cca6661a6b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697939354, "uuid": "94c25e3b-64b1-4114-8407-470ae3a2fa0c", "comment": "Malware payload (Amadey)", "value": "b6ba75bde1c86017fa0c612c01f2514fa93b853d27453cf388af1a67ee84ec250a39902ffc00d2c58e964388b90c3858", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697939354, "uuid": "421889d2-64f4-4287-bb9f-682ad16266a8", "value": "T17B652306AAEC1857C9F95BB039B503830B34BC6B4A7807451687E99F0EB29D0BD7275F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697939354, "uuid": "85b8b4e4-e9d3-4de3-beea-3492089509c6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697939354, "uuid": "118bb3a8-630d-4f34-ac3c-bd64ed384077", "value": "24576:Vy8sibVjxgFA43MVs9AaNEHyT2D35J66CNG2c8E9eO5B48Ju+nWLMnGHL9tFYep:w8jbfgd3uuBNj9PNGV74+kHnFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697939354, "uuid": "40e55f75-d7d6-4f35-95f5-3b48b72f6afc", "value": 1496064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697939354, "uuid": "64a0adf5-9830-4d77-a982-50ba3c027117", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697939354, "uuid": "4bee6719-1658-415e-bbd2-01953aa667a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b42e2e12-70ab-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697959325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959325, "uuid": "1b494475-2902-4beb-a095-fc0c4c87bb6a", "comment": "Malware payload (Formbook)", "value": "d253cfb14d2a7e9b66d244b0590923d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959325, "uuid": "82b98d97-0044-4deb-ab7a-d8addf5f82c8", "comment": "Malware payload (Formbook)", "value": "ed2a0e70294cc8ad10831275b462e430c5e0cea5525fbbadcf786bd81b11440c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959325, "uuid": "75ed7669-5073-408f-8ead-bd0fd5a6872a", "comment": "Malware payload (Formbook)", "value": "f1bdb8d285513702d8c67196c28423fe95de6419", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959325, "uuid": "2087173e-4a1a-4aed-8993-4e1e101e58d5", "comment": "Malware payload (Formbook)", "value": "82c1bdcc744519be7aa222f3720808a02d212dee0dd785a6c5452e149e26f1dd4bd479f988d09fd312835dd567f37ab0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959325, "uuid": "27403e41-3fe0-41ed-b7ae-a6004482d672", "value": "T104D41278739076BEC817853A5AE40CA4C73034AB532FC65BA4572589DE8DB9B8F102F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959325, "uuid": "ddb2237c-8bf1-4898-925d-2dd22045d9bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959325, "uuid": "ec8c941b-ffa8-4be0-986a-f4d8a7d3364b", "value": "12288:a/jf1WfNuf6W9B847QzNj8Z2kszpf1CFhPk8uaoI5IBTnBzjAPQ:aL2NS6C3IhYsaFhPHpmBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697959325, "uuid": "dae2ea8f-1aae-4d66-bf3b-52b212c4d847", "value": 637440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697959325, "uuid": "fe92db02-d9a0-4c44-a980-51f6a8bfb723", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959325, "uuid": "c906e246-cb6f-4582-a2d7-6bad604ba3af", "value": "OVERDUE PAYMENT_USD289.000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13317008-709b-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697952183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697952183, "uuid": "1134479d-d40f-4a68-8292-136d3eea1654", "comment": "Malware payload (Smoke Loader)", "value": "b73c88ec24f765aecb132c9126452b04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697952183, "uuid": "6b42d459-a8e4-45a3-b70e-22d093641de2", "comment": "Malware payload (Smoke Loader)", "value": "ee01f36cc648032ec0cb38d8555bccd0d9d50103101938bb97396f284e231e5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697952183, "uuid": "17afd3bc-2c08-4e78-a97d-70a272c5120d", "comment": "Malware payload (Smoke Loader)", "value": "1b737c61cef9812425d42f8d15e3d805d649c6af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697952183, "uuid": "fb54e420-61b9-44b1-bb12-543f56a35578", "comment": "Malware payload (Smoke Loader)", "value": "4f7eeb6406cf601b114af529018f0749e63ec3499621c284edaa22b3f3d32a4cfc0aef82db2880fafe11f2efa305790c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697952183, "uuid": "7abda59c-b328-48e4-a819-910c53a0f27c", "value": "T17544BF2177919836E56769354830C6A11B2BFCE3EA6581CB37943F2EAE313C19B75B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697952183, "uuid": "30dd4885-dc18-4ced-a03e-3ba8345eec04", "value": "1a993c5a381c8e12968253c74a42dfae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697952183, "uuid": "2d3724e5-280b-4cb9-b3e6-6b641eb7b291", "value": "3072:HE1BNEYJAWmy15PJQIKl0Utu8Cx2xW29UqNiK6UqJEq:a2OAWF15a/lVuUWjGhH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697952183, "uuid": "dec71127-6858-4b3e-999f-c95edbb8442b", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697952183, "uuid": "b46a2433-6a61-44bf-a7fe-f18cfbd98ea1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697952183, "uuid": "c64f8827-f355-4604-9278-999a7771506e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c6a48d-70ee-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697988101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697988101, "uuid": "bfca1e28-ec1f-4243-b643-af9b6e792578", "comment": "Malware payload (Smoke Loader)", "value": "d3ad15d67a9ef9c479b1a6cdc36657dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697988101, "uuid": "99cbb82b-7207-423d-9275-70a79a388d71", "comment": "Malware payload (Smoke Loader)", "value": "eed040d5fba2271fe1ce5afda26ee4812b38660b2215ae16d9a94c4c6e02f6bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697988101, "uuid": "689026a6-8f24-4572-84e6-b959dade18da", "comment": "Malware payload (Smoke Loader)", "value": "cc0fa15aee15606b7ef44f52753fb2260b75bece", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697988101, "uuid": "91756715-7429-46a3-8e2e-5d33ceba9ae9", "comment": "Malware payload (Smoke Loader)", "value": "1cf12eaf8e6c94acc6c129587d361514a17dee8ec74e26d25754dcbdde55212153fe3efc1daba334da4410d64d974860", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697988101, "uuid": "bf7168aa-8ed8-4154-9816-4e09f2b70692", "value": "T15044D012B6A0D432E0A759341830C6A52B3BBC63AA3581CB37983E3E9E717D05F76757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697988101, "uuid": "e4aaaef2-96aa-4678-bebc-ca0de1ca9b05", "value": "d2a54e4207f7fb1f334f58a667aa3417", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697988101, "uuid": "590e0cf5-6fe7-4ddf-aec7-210d188303f3", "value": "3072:syBN7AcxAgGyNp3CzxpKNdtwR3i1JOUCko3RJglUME7:vdA6AglNpSzaNdtwRSfOn4k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697988101, "uuid": "6b277c16-74e2-45bd-88b1-0c1674dd4b2c", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697988101, "uuid": "d5a8b25e-d4e2-4433-a1ea-3138f7d5426a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697988101, "uuid": "f4bbe9ac-eb1f-4485-a49f-a2c5a0e6b9ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76a08427-70f6-11ee-8907-42010a9c0042", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1697991434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697991434, "uuid": "6968118c-72e8-4b6a-a441-3740d28e68c8", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "a3c11e627b5f362ae70343be367590de", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697991434, "uuid": "f44d9043-6bb7-4129-916f-ba5a33ea59fc", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "ef5182e386c1b5e967b1a0453f1438fdd0b0a301a44144ea579da7b6e6b40e05", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697991434, "uuid": "200898d1-aa82-4be7-bf89-5a2381de27e6", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "7a858fd003632d1369cd5ad0b9540d9263e644a9", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697991434, "uuid": "b7ac2a37-ce33-4550-bca3-6404ae5d2841", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "060f4c5b7d04ebb3a99283e3d680c15054b2f7fee50c12000178058fa5e383ecbad7e95b1822bb12af8651ef36e4f635", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697991434, "uuid": "741942fa-4a50-4e40-8dc8-88d2612eda3f", "value": "T1BA8523A1E2D84433D8A04774A8F6179B5F313CA198E5963F73836D990DF22A4793839F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697991434, "uuid": "5b35297c-8f0c-44ba-89f9-d732abbdc820", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697991434, "uuid": "acf23ec0-4572-4b22-a3b9-0e8000193e44", "value": "49152:1qyyS5eqlIz8PH38ed53gNMN9goXJA70XIqLj:nyAnlrPV3COPXfXI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697991434, "uuid": "2baaa50e-d209-4d41-bf6b-86262ea49d85", "value": 1842688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697991434, "uuid": "b04a16e3-cfcf-4ad7-bf2c-c06f70b6d900", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697991434, "uuid": "ea815c54-c197-4626-851e-87a0db18df9a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7486ed5d-70d1-11ee-8907-42010a9c0042", "comment": "Malware payload (Tofsee)", "timestamp": 1697975540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697975540, "uuid": "96a74aa2-a626-496d-bb0b-bb9424aee8f4", "comment": "Malware payload (Tofsee)", "value": "b4ef11d2ec787a8e83a8a302fb18f6e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697975540, "uuid": "553d9966-3abb-4001-9ea9-cb4c287f50c1", "comment": "Malware payload (Tofsee)", "value": "f113ac0fb914059dee4d70d402f52a96369cc423ef63211d91e67c6ef2a3a624", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697975540, "uuid": "94c0918d-e555-4164-af87-9f4a979b2af9", "comment": "Malware payload (Tofsee)", "value": "19d3145e8140a34e41488015a55d4de032764409", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697975540, "uuid": "21865925-1e18-4523-9f5f-7dcbe2e97dad", "comment": "Malware payload (Tofsee)", "value": "1a847346e814f89c7c7b351dad769e93ed2e4ee915e2697cba7a9c5918f1927a5ddc523989375ee418f20e4d731fd0a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697975540, "uuid": "8b2fc5ae-6aed-42d2-8fb0-d181abc4caf9", "value": "T1F544D00076909831E5A759314970C2922A7BBCB2EA3590CB3B543F3E9E707C25F76B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697975540, "uuid": "c9e4dad5-814f-4383-88a6-347380d28bed", "value": "d2a54e4207f7fb1f334f58a667aa3417", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697975540, "uuid": "cd0937ec-5593-42b1-b926-607bc53d9a01", "value": "3072:LyBN7tcxAxGMNz3fJo3FmUjx3ZwDV/2Kkt5rdY0UMgb:6dt6AxLNzvJIFvj8qrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697975540, "uuid": "15e04ffa-6e9d-466e-97ae-1b9105d52187", "value": 260608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697975540, "uuid": "00389198-db3a-44a4-bd03-895dc74eecb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697975540, "uuid": "b897efa9-68db-426d-a3d2-d4ff3309bd32", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36f0b525-7103-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1697996911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697996911, "uuid": "31302eba-485f-4056-b530-f1f9577abc11", "comment": "Malware payload (SnakeKeylogger)", "value": "b43af7f09ef36960ab0f733928eec247", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697996911, "uuid": "cd2fb7fc-c7fe-48c3-bc86-2e0c48e15f3d", "comment": "Malware payload (SnakeKeylogger)", "value": "f2369d2aca3f1900994867c63e9e1c0c9e4ba70285e81ac7df78bb456471637a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697996911, "uuid": "8cc09f19-1684-4323-a642-e0b590044b07", "comment": "Malware payload (SnakeKeylogger)", "value": "d5371fb28c272056e9776333c861c5ff616d5a72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697996911, "uuid": "721442dd-b83c-4d42-a13e-4e79cce221d4", "comment": "Malware payload (SnakeKeylogger)", "value": "5a13b4f4981b892d3485c2040e730ba9790627531fe7217df44406bf769388f65da03050355881c8e5b4c082a1574d65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697996911, "uuid": "1feed3c0-c473-4127-a796-4b2e45405d26", "value": "T167E4121933F44B32C17B973566B553A163B7622D1523FB2E4DADA0E52A33F848A01F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697996911, "uuid": "25b95987-062f-43a7-a714-9c3d6bb9918a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697996911, "uuid": "251068b9-d101-4370-ac3d-366cded91eb4", "value": "12288:kZ/1vjJGGna1/gHGf22TxxboP5uHNHluGWg1vGRrUO4QoJrSS1:kZ/1LJ1na1/gwDEiNc1rUOGrSS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697996911, "uuid": "4968191d-7a99-4db7-a32e-07a870554a08", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697996911, "uuid": "498bc31d-be8f-4a73-9098-11f65c34e93d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697996911, "uuid": "bd1c6b2f-2077-4baf-a33f-4ddb5ac70a5b", "value": "b43af7f09ef36960ab0f733928eec247.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e7aab1-70f0-11ee-8907-42010a9c0042", "comment": "Malware payload (Amadey)", "timestamp": 1697988663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697988663, "uuid": "254111dd-21d2-4ef9-9ab2-d167ddd44a63", "comment": "Malware payload (Amadey)", "value": "130a1d7ce28c8fc0910d99e3744451ce", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697988663, "uuid": "6a1f69e9-afe9-4a8f-a4f4-27da3697e1b6", "comment": "Malware payload (Amadey)", "value": "f32206377808a4a7b2aca295fffa6a03060ffc2f340d82f02ce3e9bfae469b9e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697988663, "uuid": "bf2364cc-fd67-4461-b29f-4cca1a47435a", "comment": "Malware payload (Amadey)", "value": "4a6a26f73485dd1d8c7759f10888988d5550020e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697988663, "uuid": "a64fa8d6-3f45-495d-9576-da0fad1c1692", "comment": "Malware payload (Amadey)", "value": "04bac2c7e1e318e56f1e4edab337c6e65f2dc5055d7abf6c556dbd7c67eeaa9b2850f5a425e757c1be50f154f2b84f6d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697988663, "uuid": "ff9eaeb2-5541-4d8c-9441-1876915556b4", "value": "T1846523AB6EE4A873ED7617B089FD07930F353C619978628B3291A46F0833750D9B4727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697988663, "uuid": "744d070e-2be7-4a0e-9633-d077daeedf9f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697988663, "uuid": "1827fd54-fdb9-4690-8524-60249bd2304a", "value": "24576:8yJQg+cbZkc5Jei7jnXK1H3jSMDAOA6YWs1mUtXmn1QXM2Kl6if6SVXQyMC7dlMV:rJZPZkAnaxjSMDpDY8U4n1QX4F7bWPQC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697988663, "uuid": "3791b463-3225-4043-ace2-6fedbcbefeff", "value": 1467392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697988663, "uuid": "0b4cfea9-bfbb-4147-bc88-be107498fe0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697988663, "uuid": "203badfe-13ba-4ea7-946e-30df33425f14", "value": "130a1d7ce28c8fc0910d99e3744451ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c980abe9-7105-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697998016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998016, "uuid": "7f700765-d842-4449-9d0a-4c31416f0866", "comment": "Malware payload", "value": "cb2aa8e4cea5adf44da9e1b4b35c89cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998016, "uuid": "d2622a34-7194-4005-a20c-0ba4a71caf2f", "comment": "Malware payload", "value": "f32b21f1563e249e5c63e09f631fccbc41392c5788d4d337ad49079260d06dfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998016, "uuid": "c823c184-98b0-4856-b070-b0362db4da67", "comment": "Malware payload", "value": "00df49e618cde5c2fd544cf07bc29107db06df5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998016, "uuid": "73f49ad6-dd20-4013-bfd3-3eaa62115954", "comment": "Malware payload", "value": "65359af96367042b00906fb18e90445541ca414bfb31f2378acdfdb71cd4a4a239b896c654ac9ba404a8e96addcc684d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998016, "uuid": "eb364ea9-a33e-45fd-82fd-24389f226f10", "value": "T144358D2238809031FEE7F0B786ECB56A82ADE0B0071955DF16D917EED7606D27B32593", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998016, "uuid": "8f43872d-a792-47a5-9b19-d6b64d696489", "value": "440e77e14aa712e0e687ae6e10b63f30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998016, "uuid": "d2588012-bcc1-43da-b534-12a3e85cea4d", "value": "24576:Agmtwc+VoLIeNwHHHHHHHHHHHmGVvlrjsvXHa09+y:Ab+VoLIeyHHHHHHHHHHHxlT0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697998016, "uuid": "26acd65c-1a83-4159-95da-3944c2294d16", "value": 1123328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697998016, "uuid": "d7bbc6a8-7bef-429f-9489-e64c3c53f21e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998016, "uuid": "643086a4-d222-4d1d-8e74-90c33413f346", "value": "cb2aa8e4cea5adf44da9e1b4b35c89cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d32ff8f3-7120-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1698009629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1698009629, "uuid": "5807d133-2279-40ba-8af3-1ce682b741e6", "comment": "Malware payload (LummaStealer)", "value": "497df75c6d3c2c18538aa11ca4df6d30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1698009629, "uuid": "bf10be42-09cb-47ad-bb8b-5d4c7faa22ca", "comment": "Malware payload (LummaStealer)", "value": "f33aab472388acfb6bbbb0f6dd212b66a04d55514494a0ca15d41c79ef6ad483", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1698009629, "uuid": "b715805d-5c03-4fb8-be8f-639b9203c57e", "comment": "Malware payload (LummaStealer)", "value": "f81ba0916b583599b7a7309f78c47e4f49b50143", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1698009629, "uuid": "c8730db5-a6a5-43f6-b83f-d015d1638fea", "comment": "Malware payload (LummaStealer)", "value": "7041069b003e4b849738571b1d2a0786735ff6a7a5066b4ddae17f40169ee4f281a9de187fb81a1bb6dd8e34aff4515e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1698009629, "uuid": "a0a2ce0d-4016-4a99-9c99-919ce7838f20", "value": "T164952393E9DE4022FDB18B3549FB02C74A2ABD25EC64814E33516D9B1873DD499F0B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1698009629, "uuid": "e648516b-d3ef-4306-88e8-9433cb8d2ca2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1698009629, "uuid": "865c9a1a-ecfd-441d-bfb3-eeb34baaf115", "value": "49152:7zkYPmdYvOTIo2lm5TppInO9xzAfHmO4ja3QTSqFzcnryFN:/kYPmTUoCeTDIn6hAfHm7jvTTFzcry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1698009629, "uuid": "72ea5ad2-e29b-4ef0-8002-18efebbf3d56", "value": 2017792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1698009629, "uuid": "132c2484-99fe-4cf8-bb2f-e5472a5ca5c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1698009629, "uuid": "84693f0e-8664-4507-a626-2eef8d179cf9", "value": "497DF75C6D3C2C18538AA11CA4DF6D30.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d875bdd9-70ad-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1697960245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960245, "uuid": "70848411-d016-49b5-a0b4-2cbfcf09770e", "comment": "Malware payload (AgentTesla)", "value": "821dbf08e37793abf5eddde09fecb59f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960245, "uuid": "d8713b9a-60e9-4753-815b-81361544eea8", "comment": "Malware payload (AgentTesla)", "value": "f4419a6c5adb1ca81106ebcd82fb3b7cf931f0b9a9188edf8eb16e4c40690a5c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960245, "uuid": "b17a6c18-8f85-48b2-9091-73959c453a74", "comment": "Malware payload (AgentTesla)", "value": "bf64939d29856863d52c26a2549bf65b375f1d8e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697960245, "uuid": "e8034a17-8638-4d67-ae49-7ae2cfcf967a", "comment": "Malware payload (AgentTesla)", "value": "22cdca4828b0c9853224695db952b06eefe150a37382beda558abb4f1d2328c206bc79365ce6c4edfc457a297fc21ddb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960245, "uuid": "0d4faea3-f17e-4891-afbc-fa0eef08bfc1", "value": "T1EBE412113268532BDA7C5BF648354D9617761E666A20FB887DDA32CF0DFBF880322653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960245, "uuid": "15b3b05c-6e5b-460e-b6e6-128efac7b800", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960245, "uuid": "c3122f2c-fa6a-4b6c-ade7-0c1d65729381", "value": "12288:I8zS55mFzAGotK8q5vWzheWe2WSWuiUWKBB1TSeLZkciOj:If55q5ot3q5OldJ/Edi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697960245, "uuid": "68e9c176-c8a0-4320-b833-43cf096df5eb", "value": 665600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697960245, "uuid": "3dfa6792-2707-4b9b-b604-b88527c00d27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697960245, "uuid": "09af7d7d-eedd-4535-8f38-c7f115cbf4fd", "value": "H\u00f3a \u0111\u01a1n Proforma 10042023-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "559fa41d-70ea-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697986225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697986225, "uuid": "bc018958-b36f-4811-ab4d-135248f1341a", "comment": "Malware payload (LummaStealer)", "value": "b44e7374e3b4e50c30f3243a30fe2c2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697986225, "uuid": "b935715b-0643-4d2b-a39e-00013ef89f20", "comment": "Malware payload (LummaStealer)", "value": "f4f28ad8db445a4fcdcb1666a98fb94f05ba1f0b4c2041d419cc81c6259e2246", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697986225, "uuid": "ada76786-8a43-40d4-b01c-f8699914e6ee", "comment": "Malware payload (LummaStealer)", "value": "8ca75225d8cbadb96c059d50ef43be2754d3e8c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697986225, "uuid": "c82e462f-5051-4537-baec-bd5c455217b5", "comment": "Malware payload (LummaStealer)", "value": "63e83ec2ca140ccd3202bf2ebfd0fb6cc21762f73e149cf23d6b2f6f1de113c1ee093e05b7bf23fb8cc1e3b181f8a0ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697986225, "uuid": "045324f8-11bf-44c4-a00a-086d12cc952a", "value": "T1D8D41243ABED8472CDFA67B058FA03830F36BCB18A75466B26975D5A1C731D4A432327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697986225, "uuid": "a1db78dc-7848-40a1-8972-b2f617ea9220", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697986225, "uuid": "450ff547-767c-48ab-aa2a-539772260d8e", "value": "12288:ZMrVy90AP3vYK760vuEhyOosNUfb0BggZ0OJ10XYYTAUJ:kyiK76XEdosumgnO10X7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697986225, "uuid": "479f4c6f-e7ef-4562-800c-137b3a862ee2", "value": 648192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697986225, "uuid": "b3fa8461-dd4d-400a-820c-80a58ab9aaf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697986225, "uuid": "a541e5e3-1bb1-4067-ac54-f2fce55dc5dc", "value": "b44e7374e3b4e50c30f3243a30fe2c2c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c8cee66-70ab-11ee-8907-42010a9c0042", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1697959205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959205, "uuid": "d6081cf2-8f0b-49d2-8ff9-78da3161f708", "comment": "Malware payload (SnakeKeylogger)", "value": "cd5b6351f000e4622479883aca0fe314", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959205, "uuid": "4ba0de03-7355-4324-b72b-5db3de67faff", "comment": "Malware payload (SnakeKeylogger)", "value": "f4f50ce7cc274f69b17412721fab0ec1cde465a47570e7dad8fd84749feb5478", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959205, "uuid": "dd55dab8-14fd-40fe-809a-0adad19a6b66", "comment": "Malware payload (SnakeKeylogger)", "value": "bc95de037e2ecfff50010a996646dd001aa7f7f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959205, "uuid": "8daf55cb-64c6-44cb-b56b-b88936a0742f", "comment": "Malware payload (SnakeKeylogger)", "value": "4fd26226da72d2fe15695b2b6a3d74dba3be8bced127038f1d681de4af1709080414e5cbadad141f7f8f6ec62f8e0144", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959205, "uuid": "2ced65a5-5400-43f4-a1f3-cc87882dfdc1", "value": "T1E2B412543168826BD63C12B31C324E9507750DBA6822EA4E6DD639DF4EF7BC4C2217DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959205, "uuid": "683cecf1-8b37-4181-b62b-faf6ed25c238", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959205, "uuid": "11fe73b0-06db-45ce-941d-b9826f9e1acb", "value": "12288:j8zS55mFzNgA4e4vS5im+ykiY/+fnUDtK/SsytobQB:jf55qRgA4v8f3fUD86tobQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697959205, "uuid": "3e8b7d71-d0c1-47c5-89e5-f04849b97a0b", "value": 541696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697959205, "uuid": "f2de8444-9db8-48b6-8734-d51887423c03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959205, "uuid": "40710b70-c4ae-456d-970c-2b489c6fd75e", "value": "swift.txt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7eb90dd-70ab-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697959305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959305, "uuid": "6c70d0f6-d7f5-4b86-90fc-49fabf696b47", "comment": "Malware payload (Formbook)", "value": "de957e259418fa386a39e294aeb807a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959305, "uuid": "1d7ca055-2fad-4e1d-b331-1352a31e2e99", "comment": "Malware payload (Formbook)", "value": "f73717ede50c0ae3573c34a1cca093a90b6e52265fd26b8bfbbfee5b84d57273", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959305, "uuid": "d5e84ec6-02dc-4917-9381-494131df0bcd", "comment": "Malware payload (Formbook)", "value": "6d5ad6ec8fa83e650103cd339c8fc979f0073ead", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697959305, "uuid": "b56e8490-3399-4ef9-836c-950c34fb6f18", "comment": "Malware payload (Formbook)", "value": "d3922559ca219bee3e997d523a27c3f34bdf5ffc9150b34f9212395e633996e81bdc06be8248a91d28452cac5226b773", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959305, "uuid": "df23b0ca-499e-4718-ae66-a12acf07e62a", "value": "T193C412293390B0BFC837967A9AA01D60A730147B676FC306945725DD9E4E6A78F01BF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959305, "uuid": "437522db-a872-433f-838a-4fe31f038aa4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959305, "uuid": "17939ab1-357c-45dc-987a-19be0877c6d9", "value": "12288:PzY/jnIt0IByAg84676D7w4l6RyncFiQ5FN/rKs8u:PMLnIOIgALCwlRacFZ5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697959305, "uuid": "0832b1e5-46ae-4af2-abe7-f1c2e9aeab48", "value": 590336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697959305, "uuid": "a27d9d26-7817-47f5-956d-fa181071fbf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697959305, "uuid": "5171498a-8dce-4414-9e12-89e4057b0752", "value": "Purchase Order 14407.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "285201a2-70c1-11ee-8907-42010a9c0042", "comment": "Malware payload (LummaStealer)", "timestamp": 1697968540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697968540, "uuid": "f5fd6930-3f40-472f-8f1c-2beb1f5d63c6", "comment": "Malware payload (LummaStealer)", "value": "ac8435aa5a6a69b792b4b74dfd1934a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697968540, "uuid": "fd36110d-e005-4d0c-afdf-0461d701f878", "comment": "Malware payload (LummaStealer)", "value": "f76a1c58a8cd8f2cb94b0eb5d67d46888d8803dabb6fa8aa9283314e41b73e9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697968540, "uuid": "83ac89da-f40c-4ccf-8dfc-021e432e752c", "comment": "Malware payload (LummaStealer)", "value": "91fcd7b79fc7cac231ac0f3728d6be9436d27202", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697968540, "uuid": "6699ccb4-f24a-4f0a-8769-28b863e668ac", "comment": "Malware payload (LummaStealer)", "value": "18447468b8d69390c45ed7ba92dca283dbd11316383ad7ac5254ad86e9e9b1e0d56397674495be70aa9ae273cd7f3906", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697968540, "uuid": "f28c60b4-386e-4ba2-95db-22425dc1c956", "value": "T158961221B7819526EAA211315A7DDB5AA02CBC710F7190CFE3D8671E2DF09C25732F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697968540, "uuid": "e97ea123-9b80-4211-b9e5-ea1b16eda63b", "value": "413704d931dd90675c12a0afcdbdaa34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697968540, "uuid": "38a6aad7-5765-4a6d-a2b4-89c135639ab8", "value": "196608:zrvhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh9:zYQ1wfHZwqPa2ACYHGZtqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697968540, "uuid": "4ab15634-3077-441b-90ba-1640abd7d5d8", "value": 9064320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697968540, "uuid": "9d96e9da-e62c-4c4c-a13e-106d1a64d5fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697968540, "uuid": "249d1663-a554-499b-a275-98c4b65a1370", "value": "ac8435aa5a6a69b792b4b74dfd1934a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f02990d-70bb-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1697966108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697966108, "uuid": "2b178d79-8f5a-4f73-b41d-45206f35b7e8", "comment": "Malware payload (RedLineStealer)", "value": "e0285951ec10ee6d44f8c76a870bcb7a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697966108, "uuid": "4d5a85de-9e69-45d5-874a-96ee78f1a5b4", "comment": "Malware payload (RedLineStealer)", "value": "f9056423f67ae129475439f61196d0984078f779d819b2af21c33ca45aea3fa9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697966108, "uuid": "7b9aa396-ba73-4cec-aa74-e589f5416388", "comment": "Malware payload (RedLineStealer)", "value": "9683eeb4ae675a9468d217582e5cb7ff5e4a891f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697966108, "uuid": "52154cca-4b14-4231-a83e-2d8ebf01775a", "comment": "Malware payload (RedLineStealer)", "value": "02ff2074931218edf904e2b2b6d4cf109391c92f6817f43d3b60857d4919e6c9acaeb11604db0815eb014170cee616ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697966108, "uuid": "f0ed758b-61da-4dfb-9824-3e8d648a4d13", "value": "T1ECB46A51B0094F2AE3F2087CEACA5CAE4D507EED6F530B8F36C54B8167967D1A93910B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697966108, "uuid": "ad4c041d-b81c-4316-80bb-8d75473d7af4", "value": "d350427820086a321ccf21b695161218", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697966108, "uuid": "f5f9b432-20b2-44cc-a3b0-67dbee6b467b", "value": "12288:k822lVFQB2o97Hr62k3n/+pLsv9+eXUeF6+1L:FlVFQkAr62k3n/+pAv+eHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697966108, "uuid": "5149ef84-ec9f-4f92-b92a-1a1af36d9c5a", "value": 508488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697966108, "uuid": "3a151236-a0b7-453e-88e0-6012e66f937a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697966108, "uuid": "6379239f-edce-447c-af8f-73eed5c49e28", "value": "e0285951ec10ee6d44f8c76a870bcb7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d884e098-70aa-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697958957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958957, "uuid": "2b11375e-5791-429f-bc62-aeb7f53b41d0", "comment": "Malware payload (Formbook)", "value": "0d92c4776d31205c7b2275d1a78b4085", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958957, "uuid": "cd202478-4cbb-4163-afe6-24224cff0661", "comment": "Malware payload (Formbook)", "value": "f98b2fefbfa54e17d684f60629172f5f160259a6041b671f423eefbf0e51f949", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958957, "uuid": "8dda597e-97b9-4824-ae86-8a5e75706fe8", "comment": "Malware payload (Formbook)", "value": "985fba4c665f1f1250df0a85c3169bc631d9e0a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958957, "uuid": "749073dd-c94a-4401-9564-e1dff5f011cc", "comment": "Malware payload (Formbook)", "value": "02f3336020b24c03edb268faf2d7d468f1c34af25f5a6971e4240399f1e0e8fda0c7031ae1aa3a64f4f95603b5f7e886", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958957, "uuid": "cdc28f30-7304-40a6-ab8e-2ba07b1aa57a", "value": "T11CD41202A2A84833CF369FF5ADB62050A3F15E557961C2CBCEC425CA06DEF35A524BD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958957, "uuid": "54219726-6f30-4b2c-a33b-b644f5e3dc75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958957, "uuid": "49ee32ca-e328-45c1-84fb-f26c9fa4f7cc", "value": "12288:Noj7s93wIxbzM1k19Rvt7l+SAd+GSJnhY5RgzTaz6uiczg:Oj7s93nfxfha7SJCuOz9k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697958957, "uuid": "4493e803-15c0-4bdf-b975-51c0ef4da9a2", "value": 650240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697958957, "uuid": "45b74c85-0231-4bf1-b543-fd32ada4e39e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958957, "uuid": "ee4ff1bf-f060-459a-a344-c04f48161105", "value": "doc_Quanon_62_10-6_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a72a478f-70ff-11ee-8907-42010a9c0042", "comment": "Malware payload (Smoke Loader)", "timestamp": 1697995381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697995381, "uuid": "619daf19-d45a-411c-bd68-2074f74cd645", "comment": "Malware payload (Smoke Loader)", "value": "f9ec417a3ddb99e63120b4be1f60b4c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697995381, "uuid": "d68bf5a8-32d1-4dee-bd1c-a64107d1ab55", "comment": "Malware payload (Smoke Loader)", "value": "fafdd927e290600655f23742df6487103ebdfb8ab2038d7a6f2d12db2483710b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697995381, "uuid": "710e5187-9509-4a91-9d13-5afcc411ace6", "comment": "Malware payload (Smoke Loader)", "value": "4f5fe50b0703a57042fe2225a353e90592ebad33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697995381, "uuid": "d55e5f2a-4a8a-48ec-abf9-0b733116fa96", "comment": "Malware payload (Smoke Loader)", "value": "bf69011730f3f59c411c557a5aaffc69bf24afd04edcd743249efc740c31ff6f0084a2cf2df3468861352e2885c49bc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697995381, "uuid": "70936512-f530-4807-91bf-e8f7abcd7998", "value": "T11204BF11B6E0C032E0B755341974C6A51A7BBC62AB7140CF37683A3EAE716E09F76793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697995381, "uuid": "1668133e-4169-4296-900d-223447d8bc64", "value": "6ae03e1897875cb6ffee8a530dc88389", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697995381, "uuid": "a693942c-1ffd-41b9-a22b-0235d6ae0cd6", "value": "3072:fyBN6fgr6A7s8rTxvqqUCkyu/eO4Cu7wRTLsNWBalMQX:Ol+A71rT9qQ6mO4CQGTLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697995381, "uuid": "b1556f82-5f68-4cb5-85bb-efed73f847f8", "value": 183808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697995381, "uuid": "f0b3a7d2-98d5-4301-9433-a7e34d46a639", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697995381, "uuid": "3a175629-8595-4d5f-ab7a-9451e397583d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf061bd1-7105-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1697998025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998025, "uuid": "8eb2a5d7-18da-4d08-a964-46dd945dfd88", "comment": "Malware payload", "value": "b4cba829bb1dd386eef940e873fb1868", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998025, "uuid": "fa385b76-278c-4fa4-a391-57ebc71020dd", "comment": "Malware payload", "value": "fb05bb51cff2c073869c81d78a084650c62f061f0aad33138c862b36271a4054", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998025, "uuid": "c8bd8575-f33d-4da3-8179-2448b7fd2314", "comment": "Malware payload", "value": "114b03a5e3a68de5f875998d90aeb81121124a09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697998025, "uuid": "6c8b0157-35a4-408b-81ca-4140670ae503", "comment": "Malware payload", "value": "357d28f42117a853774b25afd439c7d7e6adac9581142f449e4d3807ee9592fb44e6a2ce4ed4fc0523385792ec415fbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998025, "uuid": "84222c49-a88d-4218-a15d-7cccb254076f", "value": "T1DCA622A2B7E82493B6BB2B613C6D3759D9D732244F96126BE31392401F32F39D03951E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998025, "uuid": "34d3a6ff-6ce3-496e-8eb3-f1c857c87460", "value": "196608:RduakRpFaUd+NYQdfrofYxotvuhGTF3tbw31e/NVMjVjmovDm:Rd1gaoQYQdfM3t24Tbw3MFWj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697998025, "uuid": "66d551d9-d5a4-46ec-bbfe-127431af7451", "value": 10231602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697998025, "uuid": "50fe1102-fa6e-4399-92f1-ba50bfa35a2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697998025, "uuid": "8647bfa4-b878-41d8-b6ce-e09f5b53c5fe", "value": "b4cba829bb1dd386eef940e873fb1868.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e890028c-70aa-11ee-8907-42010a9c0042", "comment": "Malware payload (404Keylogger)", "timestamp": 1697958984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958984, "uuid": "cb685025-987d-4cee-8e28-314a49309c20", "comment": "Malware payload (404Keylogger)", "value": "167bd3a00246059d85552fd4f1a7a783", "object_relation": "md5", "Tag": [ { "name": "404Keylogger", "colour": "#252FF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958984, "uuid": "0aac279c-75bc-43f2-b65f-bed2e1b2ef92", "comment": "Malware payload (404Keylogger)", "value": "fb97c88c012f84bf51909e95a82eb79556242ce77ed63b416eeb33e5c1981e57", "object_relation": "sha256", "Tag": [ { "name": "404Keylogger", "colour": "#252FF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958984, "uuid": "81961241-06ea-47b7-be55-c52932091b2a", "comment": "Malware payload (404Keylogger)", "value": "892cb3dbe78bae4cabe81fa1f944c7f5b7ee0628", "object_relation": "sha1", "Tag": [ { "name": "404Keylogger", "colour": "#252FF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958984, "uuid": "6f9c7c02-0727-473b-81e7-b23252601155", "comment": "Malware payload (404Keylogger)", "value": "7affebc4358f94a5f4b3d04dd99efae980b1ea85a0ead34751ec9db81f6c6da53ea283433ddf38654ebb0ff02d396cb9", "object_relation": "sha3-384", "Tag": [ { "name": "404Keylogger", "colour": "#252FF9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958984, "uuid": "27075a48-2d18-4d3f-b231-c3cab664533f", "value": "T1EFE4023077AA0B3AE9BA53F91230A14007B2BA6FE939DA4C1DD570DF5A71F464660F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958984, "uuid": "2e199885-6f6a-44e4-9501-2b83bb7e8a2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958984, "uuid": "172f6154-fbc1-439b-a92c-c9de0cda67f1", "value": "12288:ZiMk/jQfMSJCJd/IxyqMOtHKkfpyRadTXbMn4EPi685Z+TbalhwMvdL508cgWi:4LQkNJdQxDMOtvByRadcBmITbalhwMve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697958984, "uuid": "5a40e7bc-8ebb-4318-821c-d69c78405fbb", "value": 674816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697958984, "uuid": "f04b3271-c64a-4f39-8a76-4180706afa1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958984, "uuid": "0002a50d-b051-4590-9543-bcdc6db859f5", "value": "report for 4-October-2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e514c97-70bb-11ee-8907-42010a9c0042", "comment": "Malware payload (CoinMiner)", "timestamp": 1697965973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697965973, "uuid": "76860d82-011d-4efd-88e2-aa834455b52f", "comment": "Malware payload (CoinMiner)", "value": "5c2f3b3255120160ce547823803f0a8f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697965973, "uuid": "2e86176e-3a73-42d9-81bf-e80be34fd27c", "comment": "Malware payload (CoinMiner)", "value": "fc6eb8b3e6b905dda840a241b188551ab9fe73ea59bd37869b1cf20d11f43008", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697965973, "uuid": "05cdefaf-2c11-42aa-bf46-90e2821d1ad7", "comment": "Malware payload (CoinMiner)", "value": "b597713cc03da8cb7bc24dfc84781ac4f632359b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697965973, "uuid": "744f3261-7458-4bdd-a4a7-8d0668ec5fc4", "comment": "Malware payload (CoinMiner)", "value": "4cc520e7ffcee3baa4b22fffc0cdd1226b11e47237373dbd886179698a2ae54e21b91f7517339bdc90c4c3b33597f951", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697965973, "uuid": "b8f74be8-2d3e-404a-9922-463b408f986d", "value": "T10344D02176A1D832E49395345831C6A52E7BBC729A3181CB33683F3EAE706D19F36753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697965973, "uuid": "dbedb254-8255-41f2-a197-d4e082e328f1", "value": "fc20e897770322541e2213674466dedd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697965973, "uuid": "a9dfcc93-d1dc-4c39-aa0e-15b6de351185", "value": "3072:Hy1BNaeJAdmFCZP7VxJAer8L9VUeUKhemWnuB834hsPF:o0oAdyCZzfqeovpYmWum", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697965973, "uuid": "b6e18875-ef4a-4d19-a93f-c24f3806c9ea", "value": 259584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697965973, "uuid": "86ddc7d0-c204-4fd2-991f-0975060e060c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697965973, "uuid": "c8a69877-c4a7-445d-b311-15d9830ec94b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d383151e-70aa-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1697958949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958949, "uuid": "5e65ffd9-013b-49a9-b4e8-95f26be3acf3", "comment": "Malware payload (Formbook)", "value": "338813a058a8a13c04afe5a9b7db531b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958949, "uuid": "650ec10f-ae71-4b41-94b3-6897c981eac1", "comment": "Malware payload (Formbook)", "value": "fd8ec7e66dab730de6d7a96168974b95f2e9ba43c0c05b5fac55b3abc8a52d73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958949, "uuid": "8ab8f062-8e6b-40d5-a027-be6a86b4e2d8", "comment": "Malware payload (Formbook)", "value": "5854ef67aad79a7d9cbe7111d334dd062ca6e09c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1697958949, "uuid": "7cc9f620-7592-4bdd-9ec3-f1b18680b731", "comment": "Malware payload (Formbook)", "value": "714ae2202db31f0d0dcfc57ce117553245805f8c6dfbfb1e634c2e7dceb27b5aba695cb8026206022dec236ff43f4533", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958949, "uuid": "c1b6c1ae-2438-4325-9c3f-c0c5748c153a", "value": "T1D9D4120271DC8913CB650F7DAD562200E7F268296D27C28BDDC922CE669FF754221BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958949, "uuid": "149a5cf5-9c8a-47ac-a0b9-2b53258de278", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958949, "uuid": "46dfb76b-c94a-4c0f-82d9-bcd3fb2d4b4c", "value": "12288:AT7s92gnd0vY0nnmc2G0oxZTYAx8Te2F5LBRXa8lv1JcTcwn:AT7s99dEY0/0oxZUT3Ha8dLcQg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1697958949, "uuid": "5cb5bb96-2b2a-4e8d-b606-58dabf8a0f7a", "value": 650752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1697958949, "uuid": "187b4273-869b-4feb-9502-21d782179576", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1697958949, "uuid": "c09ef93c-6eda-4c0f-a3e7-2b4191de97ed", "value": "SWIFT LETTER_A1OzGLOB0NH2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }