{ "Event": { "published": true, "date": "2023-01-26", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-01-26", "timestamp": 1674777781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "f16ae715-bca9-4456-9b22-06bdc74d9f22", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e860026-9d8b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674745662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674745662, "uuid": "37720bfe-738e-4491-9ab3-f8651054c65c", "comment": "Malware payload", "value": "6a397760dd396a44b3a305b1ea4a1c92", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674745662, "uuid": "0b4a8c82-de53-4485-99a7-7614d9fcfdb2", "comment": "Malware payload", "value": "0055ffc20b32c8641434d7afcbde07beb6741a36b30414f5617ae41390f34ff7", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674745662, "uuid": "62cec2af-1254-4586-ae92-e5f3fea1eb02", "comment": "Malware payload", "value": "46f48c42af43ed8ac528c02035c4224396c15244", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674745662, "uuid": "85a37070-df7d-4b18-8c02-2fb36b500a8e", "comment": "Malware payload", "value": "52f3fc652d172b134df635b9c1e88e7c09f3aed469e21787af7ac1779c13f3f049b93bfc1ce94fee120241568cd45dd0", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674745662, "uuid": "139184ca-c253-4106-9a98-4567efa03c25", "value": "T11EF523C7FC488BB18063F0D58CD31A3A6385EB68BFF31FE2467115892F174A55A2664B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674745662, "uuid": "132fb4c1-ba89-4582-ba75-bd5651d529c8", "value": "49152:H8KqThnCX1BzuUoY5KqEZ8ZHcanYZJFp+TH/JTXe4YbwktGaQrHiNo3ecL:chTWnoaMmVcaYZ5+7JzgbwC+Hu8h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674745662, "uuid": "75fa4ec5-034f-43fd-8cd7-0e8d331b07ee", "value": 3454394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674745662, "uuid": "1737e65c-39e9-41d7-b57c-682e11ac1c7e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674745662, "uuid": "aabb1f1c-d269-494b-a0f5-03389b4d232c", "value": "filesetup_v17.3.4.exe.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce8845d-9d1b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674697636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674697636, "uuid": "7b4427cd-539c-4504-981f-f4ab158ce256", "comment": "Malware payload (GCleaner)", "value": "d8c9743680334947969c42bf4c608947", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674697636, "uuid": "e36cfda9-ffa5-49aa-afb5-5c633742c44b", "comment": "Malware payload (GCleaner)", "value": "007ba488f3248c5a549ba46f5d609b1ab1b71e679032db44f3eebf9160826149", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674697636, "uuid": "e9c9f2f4-d3a2-4c98-bdea-0fd4fbc646cd", "comment": "Malware payload (GCleaner)", "value": "4bd34d85264d1ee018c6da148cf76b99780cecb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674697636, "uuid": "763310e0-806a-43f5-b6d6-84fb2312c792", "comment": "Malware payload (GCleaner)", "value": "1e974e1f59562e6db8e4aee0435060293695a388813004c53749723531d9c7ab5eb8c108c53e1c3e298f2a8e006a0caa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674697636, "uuid": "9a98ee16-b9c1-43ae-b2e4-7356c30874b8", "value": "T16285335A44498539F1964F314A3FC26967F7BF380A70B508364E560E4BDFB62F05AB23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674697636, "uuid": "22dde3d1-0a1d-43d3-9a70-3d746c7f1aba", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674697636, "uuid": "df51e6b8-58e0-4fb4-9650-bd42a1c0f430", "value": "24576:Z3A1BnRaQDUWVoG+FUHeseX184McUms0NjhR6D/hSvBkoo0wSTeHi+PBBzTJZOLV:Z6HD93+/gcv/jiVD0wu0ZOLCgv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674697636, "uuid": "379d73f8-3416-449f-93f5-1f8e3fc8fad9", "value": 1832740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674697636, "uuid": "0f9eea1c-ffa8-47d3-8367-d541388d7e3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674697636, "uuid": "d78aee7b-b7bc-413f-bc50-4027825bf545", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d82e968a-9d8f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674747665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674747665, "uuid": "84631bf7-422d-4f89-8892-a20db96bea36", "comment": "Malware payload (Smoke Loader)", "value": "fb1d682599d7b810f8f5788cffc98a57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674747665, "uuid": "afece5b8-ac8b-456a-a377-4f810ae6e39c", "comment": "Malware payload (Smoke Loader)", "value": "009acae51ca9cbb3b1d0ae8752a157c59ed2a5c0280c2c690eb4f7fae728d65c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674747665, "uuid": "ff24513f-1d2b-4c13-9722-8395f7008b61", "comment": "Malware payload (Smoke Loader)", "value": "08b7916dbc45a13d64c46db268e4c22fc9b70ba2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674747665, "uuid": "439aef48-0e86-43da-98a4-1ec1af13e256", "comment": "Malware payload (Smoke Loader)", "value": "150279e6d614a85ec8264eb10184ac1dff53cae6cc61ec8ac2a396eac3b3cd1299a783bae8cfc136c6ba334fe563da7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674747665, "uuid": "26313c4a-cb3b-4904-bc7e-0bf4ac003873", "value": "T1E214E1263580C472C56511345839EB91AF7BB9320EA588C73BD90ABF9F706E0777638B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674747665, "uuid": "8e26051d-5a03-46fc-a3b3-f32579bfbdad", "value": "0cf7da7ba6041e7b7038cd2e90d72093", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674747665, "uuid": "9532872f-89dd-4ec5-8768-e4b398d0b55e", "value": "3072:PBN2HGwSLmTY7ydfwd5Csl60bDA5ySMAUz2idzE4sT8P:JPLmsWBwyM2/+hE4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674747665, "uuid": "5ef2d852-3584-44ea-9b26-a119c7fc85b1", "value": 203776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674747665, "uuid": "69d4ff0d-9295-4cea-8a95-73afc2317cdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674747665, "uuid": "dd94ee7d-c220-47e7-9173-bf1c4a51fbed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1aa2d30-9d86-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1674743788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674743788, "uuid": "c5fab72a-09fc-418a-aa5a-102c9017717a", "comment": "Malware payload (AsyncRAT)", "value": "a11d374140e3afef8dfb9d01a4b8b254", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674743788, "uuid": "4e5ed0ff-1277-4dba-8c34-9c03acfb88e7", "comment": "Malware payload (AsyncRAT)", "value": "00f832dff9d82b0bc27bec58514839917cd175a11759488be8479e7e690311d3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674743788, "uuid": "280785a2-f669-402f-858f-285c915aeedb", "comment": "Malware payload (AsyncRAT)", "value": "ce20e8f0f7f5f01f9ee28b1d51f8d148b403b814", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674743788, "uuid": "63580854-30c4-417e-b0ea-02a8561317af", "comment": "Malware payload (AsyncRAT)", "value": "e730ffd6be98bae87145c1eb8f78d0646592fa2d29af57d92795025f6ccecfebc19e353606d2076a670e514dce12da6b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674743788, "uuid": "9fadf44b-adb3-4813-8037-4b303b981746", "value": "T17933E117F2863EA5FB2AE1B83102CAA9B5D00A77D6037CCB0FDD5AFB99359474C46085", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674743788, "uuid": "5b96a58e-e6ac-408b-9bd1-7e75affc19f9", "value": "768:ps2wDSBhM2Un7NHuSlX4eJlMqGFJ1T29FABW8i9Vg0dPM7f70Zrd5oCAj:p3wGBhfY7N3VNMJFfgyARdImYCAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674743788, "uuid": "11ce8507-d003-420a-810d-c76e7bb3cb63", "value": 51169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674743788, "uuid": "d32e6311-4524-4668-a0ed-fecb961ff37c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674743788, "uuid": "00b41065-121e-47fe-bc94-dfd385ee763b", "value": "bleh.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f34d518-9d7d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1674739758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674739758, "uuid": "39babb1e-29d7-4e07-8770-d5706b825866", "comment": "Malware payload (Loki)", "value": "68e809fadbe3a668b8cfe500e6cac581", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674739758, "uuid": "3b549435-f85b-4e0e-bcea-d20b78b96f42", "comment": "Malware payload (Loki)", "value": "013e2668c87f03a7641fc215bfaf4f7cb7d547d1d74ce62afb423adb53e3b209", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674739758, "uuid": "294daf6a-0cf0-495f-9a15-c1a31269f1e5", "comment": "Malware payload (Loki)", "value": "17d6ee05b98d9e0049fd67131e83a56c99280db0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674739758, "uuid": "9d88c660-dcf3-4030-8aa7-50b76a4b0cab", "comment": "Malware payload (Loki)", "value": "3e64bffc9f02e7cf194e97d20d9277a5c7e49c4ba69a09e6573b7b2469f1947dda59262f30f304ef2340bb24841964b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674739758, "uuid": "d9af5c57-5fb9-41eb-ac69-02b54fec6a32", "value": "T13164AE22F1D0B858FD164A368D2ADBD4392EB8D28F3C73D732D4AA1F19722E0D536215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674739758, "uuid": "c9421c4f-c3df-4136-962a-e66654a58aaa", "value": "e5f35c047e0fdde323b83e51e689dfb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674739758, "uuid": "d571f0b7-1073-48d9-b09a-a5e2e1f662e4", "value": "6144:2VLsD3FjAwR7rGgov/O9kYCSZLY0+MOKXoReUT:2V41MUovm9kYCSZsWkcUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674739758, "uuid": "12c7c87d-27ee-4949-87e0-e4f255df8896", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674739758, "uuid": "6a7688f5-91d5-4bf0-9873-66d388f9c908", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674739758, "uuid": "cf8b79cc-bde2-4401-8f8a-94996f2e1cdf", "value": "68e809fadbe3a668b8cfe500e6cac581", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83757be1-9da3-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674756112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674756112, "uuid": "bdbb996f-a849-41d2-b783-afe993637623", "comment": "Malware payload (GCleaner)", "value": "376df506937cb7ae192014028d8b6175", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674756112, "uuid": "7a7078ea-2f9e-42d9-955d-a74d40f3c37c", "comment": "Malware payload (GCleaner)", "value": "01c7f28045f151783533ecac42fc82a9d167d397b5534890edd8b982b303d590", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674756112, "uuid": "80b8f7b3-59c9-4619-921c-640cfeaee6af", "comment": "Malware payload (GCleaner)", "value": "f9592e4436581d4799bb06f3f6c23f15c791b3f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674756112, "uuid": "c70462c1-ac8b-41b6-967a-2987d354b70c", "comment": "Malware payload (GCleaner)", "value": "9d8a3663a6d082061b14ccf35ba0e217b262675277e65630135924b39a954e19d702db74d705e18f23436a817a510f3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674756112, "uuid": "ab094ccf-da50-4af9-9437-9b5a56b55e1a", "value": "T11085334BA402C7BCE9028BB31B316444BBB6FD47307E1889349663DD3D751B05EA57EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674756112, "uuid": "03dfb989-8758-49f1-8c53-ae1f95a554f2", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674756112, "uuid": "5e05af57-a665-4742-bf40-3f8e26499b01", "value": "49152:okug+W78tpyrxHBd4iPaL96Ol3Y4MEMfrM1aGaVh4zVLxmtLCgv2MR:hug+elrxHb4iPaL9ZI4TarM13aY7mxvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674756112, "uuid": "0435dfb0-cae4-471a-bcbe-ffd363824bd1", "value": 1853923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674756112, "uuid": "3672f7b2-e3d3-414d-8822-bb089cc282ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674756112, "uuid": "f70af9fa-67ce-4f69-a92d-88dab7d3eedd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c733e38-9dc9-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1674772234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674772234, "uuid": "72248115-baa3-49cb-8b20-3d8390d01651", "comment": "Malware payload (DCRat)", "value": "b313d25c0fed1c6069e6a72e73a5751f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674772234, "uuid": "1bda0c0f-ee67-4228-9ff8-4b0f30b736ef", "comment": "Malware payload (DCRat)", "value": "01e2946bab81b880ec494a1692a791ced92624246e6aed7a15c725851ede71dd", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674772234, "uuid": "829e9590-4ea7-4e08-bbd0-e033d9569ce0", "comment": "Malware payload (DCRat)", "value": "1717db41053d68f4b6cb0619eaee7d7617a6ebc9", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674772234, "uuid": "a23e5834-19b3-49eb-addc-015df2fe74bc", "comment": "Malware payload (DCRat)", "value": "e10c5c9f5bf322f3284367bc270ef50ce736a00bce69845d242c09b17289dc8694bbb1a12cdedc4844e5e2abe7032f67", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674772234, "uuid": "2afa184c-e8d3-4d8c-b76f-8feba5410bf4", "value": "T1204549017E46CA11F4091233D2EF854487B1A95166E6F32B7DBE376E95223A73C0E9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674772234, "uuid": "ec918961-aa00-44a6-ba46-6c1f8af36b3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674772234, "uuid": "7df7da8d-7324-44dd-bb74-2052a6d7d289", "value": "24576:1oz7PdSo8OhfvG83PxEXY5TZ95f+bYy4HKTtadCK2yseqa+B:1odSo80/GXC9+bl4ewpEe+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674772234, "uuid": "8cb3c69e-e24b-4fe5-b4bf-c4ad087cf41f", "value": 1240576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674772234, "uuid": "88167815-5e43-4650-bbfe-08ca94c30247", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674772234, "uuid": "9d2a5fe5-727b-4916-9c05-647e8fffaf5c", "value": "b313d25c0fed1c6069e6a72e73a5751f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d4fb2a0-9d50-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674720427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720427, "uuid": "e7934b03-673b-4ce2-b27b-3c2918cce628", "comment": "Malware payload (AgentTesla)", "value": "c4144f485ace1895abe7bacf2cde2978", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720427, "uuid": "89adbf50-0f39-4e2b-93a0-8c0f532b5ed1", "comment": "Malware payload (AgentTesla)", "value": "031e9d43bb362aef89deff7c9fbc4d0cf3c4ed7f7eb8869c402a0a0f803feb08", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720427, "uuid": "f57d4824-9427-40d8-8d04-6cc9117f3951", "comment": "Malware payload (AgentTesla)", "value": "27466be4b6a5cf39f0400a82edfd361c2ee666ee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720427, "uuid": "ab1f6205-f3cd-4df6-8892-63c304c28464", "comment": "Malware payload (AgentTesla)", "value": "8f3cadb7cac2bff75211ea28d802cc4d20e757c4e8c07a333f912ad8200e706609287f7a0ab0a9ebd11c462408c307b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720427, "uuid": "68af0399-0bff-4bc3-9bae-1aea7a330e71", "value": "T1ED15BF1023E9DF86F9BD4779C6B4524093B37866B432D7895EE1A0FE1DB3B004A42B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720427, "uuid": "30005d99-021e-4268-b17d-9f6cc24f668b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720427, "uuid": "94782774-ac40-4243-91a6-2e65858c55f8", "value": "12288:qtG7vV5zxPCRgqIYc1OWkXD5FqIGevvc2InWrQCUM+WB3m2jIAW6Yx2zO2WzU34V:Okv0GepcCUMFB2AWNx4OqoqVWZC/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674720427, "uuid": "a09dec4f-bc6f-4dba-b310-df74f5126a05", "value": 957440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674720427, "uuid": "1e3bf4b4-2332-4950-9dc1-a00b88aaf05a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720427, "uuid": "683ccde7-efd0-4c73-afd5-95dcd69742ec", "value": "Bank Details_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59018ddf-9d55-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1674722540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674722540, "uuid": "1c897907-8ecc-444b-a244-47f49cc32f3f", "comment": "Malware payload (RemcosRAT)", "value": "1367e9b33b836587e50124eb9eb2397b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674722540, "uuid": "bba62229-2e16-4f82-a00d-895bc1b081c7", "comment": "Malware payload (RemcosRAT)", "value": "032f8672b774c3a0edd3b84b0f809e1901319a2b0a4a60704e75f92bdac4f7bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674722540, "uuid": "f5a3e497-e922-4ead-9e63-ae448fbb5b18", "comment": "Malware payload (RemcosRAT)", "value": "d7227929468d91e50d3cd8f94ea2015506759c09", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674722540, "uuid": "799cd725-a4f1-4424-a8db-edbafbc1e57f", "comment": "Malware payload (RemcosRAT)", "value": "08f22e76ab1484e2e0eb7487397d09b9662a9f011a8305687d173116456e0a840ed8c40f45989b3e773f9264cb214e34", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674722540, "uuid": "9e6c7f8f-e2bb-4f1c-aa70-71759d14ce6c", "value": "T1C1C590243EFA502AF1B3AFA55FE475979A6FF6733B03A45E1050038A0A13E41DDD163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674722540, "uuid": "68772813-fd5a-4e3e-8866-8d266838ad2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674722540, "uuid": "73c63d8c-da05-4e78-aab1-9c5f17303de0", "value": "24576:LyhWx7lfT+DtXTeUXEkjoDpvOykLPaEbOEh5wwsUHoeDAYOgLpgO9irvO4vx8X8g:bqEkCkTF7OIVAX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674722540, "uuid": "653e8d7c-6733-4ad9-acb6-5a941e4b44dd", "value": 2593792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674722540, "uuid": "d7ad2fb4-c356-480e-88b0-a07c77310a74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674722540, "uuid": "ee224f17-03c6-4618-ac83-ff9351cda38f", "value": "1367e9b33b836587e50124eb9eb2397b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e88df5f7-9d7c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674739532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674739532, "uuid": "e722b608-186c-4037-85c8-1ad3aa7f9944", "comment": "Malware payload (RedLineStealer)", "value": "ad7ad9ea4165831a7da49fca41b53007", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674739532, "uuid": "5467c7a3-073d-43b3-b8ff-cc6e80d4a48b", "comment": "Malware payload (RedLineStealer)", "value": "050c2acd0f467ab6089c32fa9b0921bb1685ef697b6ef2ed7509db4e18eaff9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674739532, "uuid": "6cc2861e-b749-46d9-bb2a-c8ba48f19035", "comment": "Malware payload (RedLineStealer)", "value": "1a5bbe9111903b684ad7d9f34dc87c158eb120cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674739532, "uuid": "5aa12bce-650d-42a0-999d-71229a12320d", "comment": "Malware payload (RedLineStealer)", "value": "ff90c8beb0a5687eb07e2da0ddbc4604cf641d95f5f568c6bec3b4ae8e735a73fb6407b98bec2b0a6353fb5e80f99284", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674739532, "uuid": "42ee4421-a97f-40a5-baf6-f50cfc63ec95", "value": "T166649D837AF4AC52DA31463A8D1BDAFC75ADB8568E18B7372334DA2F1570273C572214", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674739532, "uuid": "df2115a6-dc55-49b8-87ed-3442ccefbbc2", "value": "7973a61531c93981746e35cc3b7b0ae0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674739532, "uuid": "d603473b-de64-4c22-b63a-aea89abdd6d7", "value": "6144:LZLtVZK7qFHA5knDSAwtQK/fu1d0L+TVmTb:LZhVaoUknD6tQKXu1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674739532, "uuid": "f1fd98da-a681-441b-a3b0-23d51c9598d0", "value": 334848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674739532, "uuid": "41cb60f4-d495-4983-8c63-35a42af5ac00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674739532, "uuid": "0145133f-a0f3-4946-ac43-418013418ddd", "value": "ad7ad9ea4165831a7da49fca41b53007.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac3cad0c-9d52-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674721392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674721392, "uuid": "376572da-2e70-4f6a-b999-bdc7df6ff740", "comment": "Malware payload (AgentTesla)", "value": "9f22cd95e29ed32794256d7407813a56", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674721392, "uuid": "4dfe2a58-3055-4e4a-a482-4dc0beb516f6", "comment": "Malware payload (AgentTesla)", "value": "05137a6919c22bdd55e700d7b075b1a279793bf722b55aebde75843b5e4b5a8c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674721392, "uuid": "f69bca52-47f5-4273-9bec-517d89465da9", "comment": "Malware payload (AgentTesla)", "value": "6fe8fcdc20db215b831037b8369abd6ddeec20ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674721392, "uuid": "56c11ee2-33dc-4647-ba45-260a5981a4eb", "comment": "Malware payload (AgentTesla)", "value": "a63cd21cd1038c92f66d45666a388790c138788711b411fdaba9bb0ae313b3afadf29111c92d4999d3353942f46e6af4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674721392, "uuid": "f89bf93b-ca70-4f35-b24c-bf234d2600a7", "value": "T1FE54F19D3210B5EFC867D872CE642CA5EE20B4BB834F4613912321E9EA5D987DF141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674721392, "uuid": "31277080-1b8b-41af-8527-6a92bf6e6504", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674721392, "uuid": "4a161b21-00e5-4af9-86be-cc8e15462281", "value": "6144:VML7CNgCISJiuHs9jvo9MItevnkwQJ9y/v/5PgqGpVrbCo:yL72DkCOs9evnwJMfABbCo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674721392, "uuid": "e8543d1b-6146-42e0-91b1-830177995fe9", "value": 286208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674721392, "uuid": "ee36d3c2-441a-40c2-9763-8044f8f00004", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674721392, "uuid": "1a70f099-a48a-401d-b1da-7ffed1a20dfe", "value": "HgGgGg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4225cf4b-9d51-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674720784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720784, "uuid": "2c9e3c9e-d1f3-4fbb-b1a5-e443e4e56512", "comment": "Malware payload", "value": "67f1e6afd3d062cf9f0e164854436842", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720784, "uuid": "61e0454e-09e5-4921-b37c-d0eb7c04bca4", "comment": "Malware payload", "value": "0658f292b9f28f206ee927aec106274b8449b33688cdbcbb08a581334d4a8374", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720784, "uuid": "155fc820-74e6-4e9e-922a-c7dc0cab84d4", "comment": "Malware payload", "value": "9feeb92534c066ec5f7275699ce48a2b41b9a4bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720784, "uuid": "8fd8c34d-ba29-42e3-a197-cfeedbe61b9a", "comment": "Malware payload", "value": "7f9ca93cd30399c56a630dbbedc75c066fef312fae80545869440830277b0fb0ec5474dcb0527fd8a56d59de32cd8ae3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720784, "uuid": "3e327b7b-9791-4fa0-a7a6-c7a7d80763e3", "value": "T166524C45B8B288F7E2F7473D0CA6DA455A27F47627F1800A1D6D019ECB677A4893B30B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720784, "uuid": "ba94642c-57a8-42fa-aa4c-4007d33c90c6", "value": "192:giZBxoXXc4IW1UduLbb23hN5pbliVLp/KRInX8cnnnnnnnnnnLu:3bxoXM4INduLbbOxiVLd6Dwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674720784, "uuid": "8aa01ae7-504d-4651-9d3b-9c0fc69542d6", "value": 13888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674720784, "uuid": "b930df9f-8856-4844-988b-ac0611e71aa5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720784, "uuid": "ad45d44f-e131-4d0b-bbbe-54d120718c60", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37ea763d-9d50-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674720337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720337, "uuid": "c2bd1f5c-5f7c-4890-b297-e5b71b227034", "comment": "Malware payload", "value": "d5bee000a22d782e104411d75fe3e28c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720337, "uuid": "80bdd283-d3ed-4975-b6a1-7054be2f3f97", "comment": "Malware payload", "value": "06630b72856d6b26d2b595fd3f578b3f0f50bc0a259e38818ad3cfb4639ce7c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720337, "uuid": "a33f38a2-ef06-4aa0-86a8-3fb9acfe353b", "comment": "Malware payload", "value": "45b6513c6ef4e2945393332a888ccddfd519f102", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720337, "uuid": "c5a12b15-a589-4967-aff0-297bf4e1f90f", "comment": "Malware payload", "value": "cbdcb35e7c2f400ca809f0b77aa522749c9c9cd1fb9de46cc8f329451f177a77bf90ee44b048ed6f5843319801df0177", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720337, "uuid": "2d9bf158-ecec-40ac-bf99-7b115af3a1c6", "value": "T174D26C1473FC027BEBAF577D683512920B3176276816EF9E79D801CD1BA27448222B77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720337, "uuid": "fec71993-acd9-46ff-994d-b9afd6462198", "value": "768:sh8M7JYz+cWkwNkuyi5SbBnfuhz4lqy4wkAmZbIkr05tIevQ:sFJY6cWkwNkuvkICEyHxEIk2vQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674720337, "uuid": "f40ca71a-1914-4613-9345-7d963c892e61", "value": 29696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674720337, "uuid": "6f9ab59f-d0e9-42d5-b1e1-7dec16dddcb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720337, "uuid": "915850d9-d481-4c72-8048-d1736fbaafa9", "value": "NEW INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1517a60-9d1e-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1674699039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674699039, "uuid": "67d5600a-21db-400a-8ba5-92fc4522793a", "comment": "Malware payload (njrat)", "value": "c1f360f8105c691779a46d50919ad955", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674699039, "uuid": "ca3dee09-c3b6-4c81-97f3-e437373a697f", "comment": "Malware payload (njrat)", "value": "074cca586090b96b558ed8fef4e1a82144fb023963f8956afe5395426fb37c7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674699039, "uuid": "ff0f2872-b0a6-48e9-9295-ada0ad6207f7", "comment": "Malware payload (njrat)", "value": "b9572b08aba09ec6a1dcd4315f97caf13c1f94bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674699039, "uuid": "e3bad62d-2a63-4ed4-97b7-d91af65ec177", "comment": "Malware payload (njrat)", "value": "3317f2163155a6821d7c66b5f50eeeea7edc2d763851a5c690e6260512d093bce3dd3997cffd143461d361f01417617b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674699039, "uuid": "bc8d3ccc-1b82-4dee-bacd-081a1b9a015e", "value": "T13A448C037B44DA0BC63D3B3950B4E33105745F82B512DA4996FABCE3FA11B865E186FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674699039, "uuid": "2c2e6b51-e323-451c-9a51-b0875bf601c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674699039, "uuid": "ac16f810-3f06-4180-9e28-667452cd3695", "value": "6144:NAoO4vMbsb9NWVMFnA3UTJFpb4Zoiw61zPw7iAiRV:NATpSnyCb4iQrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674699039, "uuid": "9b705223-923b-4ff0-b048-8ae17d28a1d2", "value": 266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674699039, "uuid": "5c45b206-986c-4ff9-b0a3-cada9ad3cca3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674699039, "uuid": "69bb30aa-3273-4099-88f6-e675621e6d31", "value": "c1f360f8105c691779a46d50919ad955.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b6b10e-9da5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674757009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674757009, "uuid": "9e8bb2df-6073-4787-8f16-56eeeed2a26d", "comment": "Malware payload (Smoke Loader)", "value": "4dd62cab09af9ee6a6ef2a7df0ce7b78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674757009, "uuid": "716c9e48-3a97-4ab4-9fd2-61f1b5e5d145", "comment": "Malware payload (Smoke Loader)", "value": "076d85132ab0196bea160ab6a225ec575d2e0c2a4337da2006405330a174855f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674757009, "uuid": "926c63f3-84a1-46bd-8b3a-05fe0280775f", "comment": "Malware payload (Smoke Loader)", "value": "09d24042bd7c15634207df93b710821dce296fe8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674757009, "uuid": "f51fa576-35ee-4714-a77f-a03a1cfe6258", "comment": "Malware payload (Smoke Loader)", "value": "f59467d418b17e15f3cc7b344bafb4b2f0c1e3d822279f8c269cec6154716df59900ed79ab7ad0f44a5923c332f3cc1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674757009, "uuid": "702b75d3-cef8-4167-8756-ce16eca4d07d", "value": "T1AD14E1213940D472C4A2413C5C29D7946FBBFA3207AD988B7B640A7F6F712E1673A35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674757009, "uuid": "00599d6d-7ce2-4504-ab1f-5226e6b2d8d4", "value": "4dfa6309511cb75d1093a1ac55cf0bae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674757009, "uuid": "1a148090-010b-4cfd-965f-948b0979f224", "value": "3072:iBN27ooZKLyLQIZrKkHruU5g8F1jF+jOVhTg7lQ6u6E0kDB9kA0hAGwn:W/+LQPkHru783hlNg7ljuDBDB9kXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674757009, "uuid": "5548faaf-059d-4c05-919d-7d3717f91e07", "value": 203264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674757009, "uuid": "acc250d2-03f2-464e-a779-75cef4214603", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674757009, "uuid": "18ee2874-083f-44d6-89ab-bf655cf803ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80cfd60d-9dd0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674775435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775435, "uuid": "b56e83fb-d238-4ecd-a3ca-c3ede5d3fecd", "comment": "Malware payload", "value": "6d50dde0e1db920c4cfbc31804f93e23", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775435, "uuid": "9a0bafd7-240b-4d04-8795-21ced4c78645", "comment": "Malware payload", "value": "07b155027c69a6b22e428829dac829881432793c1f17dfa2fedc163a84af5f39", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775435, "uuid": "4fd45aba-dbd7-4f3d-8448-6898aa867b6f", "comment": "Malware payload", "value": "7426cdc04b2889142f81609b5cfa42a3ca292b4f", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775435, "uuid": "37dbc8ce-9f27-4fc1-9ea8-70146912aede", "comment": "Malware payload", "value": "b9275998eaed4937896fb46542e697f14327d8bef4c105a00eceea7984298d04866fe004542a6d5d9c82b8bcb62e3dbe", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775435, "uuid": "d47141ca-18db-49b3-9f98-9a02f0f46cbf", "value": "T1DE0121045E961726F5F3CFBA54EDB717C9693842ED875D1D01405B8C3464500F5B5D1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775435, "uuid": "14865fac-f39b-46ad-90cd-a0b6152b5779", "value": "12:8Y5Y0m/3BVSXzZURpiqbHsbLLNMlDmo0IKiN37+lbY7G7lmcr:8Y6J/ByU6qb+LS4o0arabP7lrr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674775435, "uuid": "7492ce3f-185a-4b61-9e87-80fcaf945523", "value": 808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674775435, "uuid": "ec0ef919-d0ba-4d06-83b7-420318f6002f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775435, "uuid": "92e7daa3-7f5c-477e-8685-7632e8964550", "value": "7426cdc04b2889142f81609b5cfa42a3ca292b4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe40d11-9dc9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674772266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674772266, "uuid": "6501bd98-c2d1-4b51-ba91-64babd9ea63e", "comment": "Malware payload", "value": "2b5cb9e78a4e60fae39b52aad02fef38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674772266, "uuid": "2cf81898-5c99-40d6-80f5-79160ac4afe8", "comment": "Malware payload", "value": "07c48fe9c7fec5c7ce56c5fe9fc33b9d21fc3f1ef79ccb9c7f18eefc194895d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674772266, "uuid": "1c833c07-4c98-459b-b015-fe00cd2cb94d", "comment": "Malware payload", "value": "f83b158984187f58e6e3f5189f36ff5fa3ad2ab5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674772266, "uuid": "7cf411bf-4393-423b-aa9f-7883fa6cb37f", "comment": "Malware payload", "value": "d5a156ed008c3fe1903cb66cd73a900f0ec4108bb0b99f7f1e2d9837818a75d2f1cde6501f448b45dd08bdc25a24a145", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674772266, "uuid": "68ec99ca-f5e8-460c-ae8a-863d51ffd30c", "value": "T1FC763352B8C6DDB9D2024D35CFAC1F90D1CFD5680D35897B2BEE192E0E3854A81B6A37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674772266, "uuid": "c10c9d1a-a244-4720-aaee-28bc36e0e595", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674772266, "uuid": "45e417eb-a33c-4aaa-bdc3-9a12197f0a3c", "value": "196608:91OPcwR3kozLqn+8K7qs0HZEjhvz9A7ozCJ3krczs1x0QZp:3Oz5pyUqzohOp3krcz2p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674772266, "uuid": "cfcf2c73-864b-4756-b8f8-4f3e0894ea81", "value": 7636796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674772266, "uuid": "f1e885ec-cbc6-4c35-bb13-948423c86603", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674772266, "uuid": "d0fb39f0-d9db-4f9c-af6d-38b520ab32a1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c19bb590-9d7e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674740325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740325, "uuid": "a789d7e2-8d6a-4c3f-a0db-cb523f5d2a0e", "comment": "Malware payload", "value": "ac812b02405ef7fc380a1d89d6c28bb6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740325, "uuid": "421db4af-1bd1-479e-9962-da93e4f617c2", "comment": "Malware payload", "value": "08073d744cdd0001903c5b8e0ba6f2d7ff09244eb66d8f8695534f48d5ba0f7c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740325, "uuid": "db163f02-e898-4307-a678-9565b31169e4", "comment": "Malware payload", "value": "ab9471d31fc1c84cea530028bbe78757c3a4afe7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740325, "uuid": "f7b6facb-e135-47c0-82de-76b91ec81963", "comment": "Malware payload", "value": "b089ef7f04f9dc74795334cbae5d28073001a4ed27c3b3f7652369330e6300b1343dfb0518b5bb00d874ac5d38b46b77", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740325, "uuid": "c69d100f-45cd-472a-ac42-2814329019d7", "value": "T13255AFF875047DE6266F536BDE96ACEC03B616639ACBA4CD80A477C305A3375FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740325, "uuid": "e2a85210-2e19-40e8-a520-eab14072395e", "value": "24576:ojo/ZT4PMMls9NE1z1teF8HlYa5AxtP9onNmwQJQw4PUPE01XBUmJmCnvUxJQ:v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674740325, "uuid": "7b0915b3-2370-49fb-b340-38333f1c69e9", "value": 1312497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674740325, "uuid": "d9e661c5-a123-40cd-bd8b-a2835d7050ea", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740325, "uuid": "9421131c-1511-43e5-8655-58b7f3f4d438", "value": "(RFQ) No. EXE-0804.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "675ceeaa-9db4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674763367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674763367, "uuid": "3b18ac97-2024-4a54-9169-8fca5f7da4ff", "comment": "Malware payload (Smoke Loader)", "value": "8e9353d5c6cbc1b01645ffb2f49eeb1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674763367, "uuid": "036de8cd-056b-4075-a7c8-89f62deb4eeb", "comment": "Malware payload (Smoke Loader)", "value": "08324e1945bdb9019a31bcef696f66773cc67030fd314ab2663755207b61d9bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674763367, "uuid": "aedf0238-b830-43ec-b4c9-57db82dc95b0", "comment": "Malware payload (Smoke Loader)", "value": "bf3a1dfb874abb168f1ae77c478c90dc05c89a2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674763367, "uuid": "99f7a444-b83d-4e0a-aff1-0f057dbfd77d", "comment": "Malware payload (Smoke Loader)", "value": "34971d80c141cc90ec36fd6b7bfbd0e0a87103616340eade938d0e9d48942440cd2b62129d5b5215702aaa4374eff34a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674763367, "uuid": "6bbbf4ae-ca99-4295-9495-5419d3af2d81", "value": "T11D14E0217CD0C032C4A261394C28D7517E7EF9316AA9988B7B581BBE5F313E1667634F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674763367, "uuid": "d09d8e29-7744-4a46-8262-2e13583c8d51", "value": "4dfa6309511cb75d1093a1ac55cf0bae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674763367, "uuid": "19de3de4-bdf0-4fe9-b153-38c054483f39", "value": "3072:QBN2zdYzlbfuL5bTxr+xHV8wp5bBcLZdJQOzydlEc/sOUe7sCa8riDG6mA:4bJaL9iHV8wh0XJNydxUe7sCBr8G6mA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674763367, "uuid": "0b1bed23-2210-461c-a101-22d1b521e95d", "value": 203776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674763367, "uuid": "b12185b1-8a95-41ea-b354-29e10ef28319", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674763367, "uuid": "542726ff-8bac-4270-9a67-ccbba8fbd5a2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0dd6ddd-9dba-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674766040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674766040, "uuid": "d7d8bdb0-c43c-43f8-8149-6b9eca758d9d", "comment": "Malware payload", "value": "c5e887e43d3424be4022aa140e2938de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674766040, "uuid": "97a11d35-fa57-457d-8358-4edaa063066b", "comment": "Malware payload", "value": "0ac0dc431f5628d62ba1659f95250b2eea873e24fe08fa4944c75c56b9e63828", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674766040, "uuid": "00aa10e3-d39d-49be-ba43-89efb030dde1", "comment": "Malware payload", "value": "a0d80f867260f3c1d7461311ad89651dcd6c2f16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674766040, "uuid": "45fc0fa9-4cab-4c2e-9a6d-c3f6c45b5a2a", "comment": "Malware payload", "value": "2ced5ea1ed48e3fd00e6d135caa53d2cf48aa495b5d457643d87b273733239931c125cfdedbe25be03aa6a1c32646b21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674766040, "uuid": "0c5f5770-e048-473e-abbf-e87565e1238d", "value": "T13A7633A135D1D0B8C14124FBEC3269E0F6FEC6206912456707D9DBDCAEBD344A70AB6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674766040, "uuid": "c6647b9c-a75f-4cbb-908b-e23b67aed8f1", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674766040, "uuid": "a9ff17a3-c495-4afa-b25c-31827de0ea4e", "value": "196608:91OojT+SWHrJj2NqymVkE4wWwUd0fERvwec9G1z0Fgch7Wchxk7+:3OojySS1jQmVkK+2fERvweO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674766040, "uuid": "f29441d5-580c-419f-8187-8fbaad38a979", "value": 7608046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674766040, "uuid": "31108b1a-0bd5-4c9c-ae8a-d950462fbd92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674766040, "uuid": "f90a27c7-a5ce-40aa-a745-94a5afe20ec9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe10920-9dd3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674776642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776642, "uuid": "735e2c61-8c70-47a2-bee3-e7ccefe71bb1", "comment": "Malware payload", "value": "2db2698bd4c922a04db0839e6fc1146b", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776642, "uuid": "cab75596-709c-48f6-bbc2-69bb05fe9669", "comment": "Malware payload", "value": "0ac93ddc58e7666eae677812d3be93fe8f922ffc32baeee0f803109341dc1ea7", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776642, "uuid": "10ad2a0a-1048-4d83-92cb-9d57905d49ce", "comment": "Malware payload", "value": "f05b9a7f148f3e90d2c20bdb649571d138f680f8", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776642, "uuid": "588d6def-e499-4586-be4f-18cd77e48dc2", "comment": "Malware payload", "value": "9a2ca31c1dacf7ef5be3c5c820d8972502413808aa69e7af44c970b0511331c335b6b442e88c3b1f1ccb25765d9eeeda", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776642, "uuid": "4f5c27a5-77a6-4345-b7d8-4494daf524d7", "value": "T1025100162F6B4295F7F3C63581B6A611CA36F9E5E5738E5DC0A00298AE70510AC52F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776642, "uuid": "a6c30c09-de41-4f6d-a90c-a44b1f9f217a", "value": "48:8En+9aJycIVsUFJeJKEfREdPEfRESfa6lalHXv3y8PYk:8E+ayDyKEJENEJESy6lal3v5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674776642, "uuid": "5a6a0ff1-9f2e-48f7-a4bf-401b28e4ecc5", "value": 2735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674776642, "uuid": "cadf318a-b073-45cb-be5c-898739d52ec8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776642, "uuid": "ba4fd39c-d05d-4a0a-a245-93f3c55665e9", "value": "Summary MSs reporting - recommendationl.doc.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d762fe55-9d7e-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1674740362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740362, "uuid": "73a51b59-db8e-42d1-ac2d-bbc77c91d6be", "comment": "Malware payload (GuLoader)", "value": "432af77ddd65c8e5dabd50a595031c12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740362, "uuid": "268cba76-5605-452d-8878-85d31b311e8c", "comment": "Malware payload (GuLoader)", "value": "0b7cbaf64d3157f01a905e8a8afe7a130337c2745cb7730a8869a7e15784cd01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740362, "uuid": "f11b7dd3-9406-4a91-95dd-8d8ba8ff91ef", "comment": "Malware payload (GuLoader)", "value": "6a5aa38b90f9f20a3cf03252b4c9933b85301513", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740362, "uuid": "96e5c2a2-89e7-41c3-8724-18dcff13e4e4", "comment": "Malware payload (GuLoader)", "value": "744cd3e6ba5721a9c9b0fc8270fb905045f167f5e463c1f3a7fc81275b5ca95f6ec5d4b76a876b0a8e5371a050c11630", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740362, "uuid": "4de6a04f-678d-4957-bf0c-b6a002cc4a76", "value": "T1F4D45A4230809A52FC2BC97A453F656F05573FB96774063F21A473FAB7B30618E86E29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740362, "uuid": "2b957c06-1f05-4a54-9d59-8debecd241a3", "value": "7192d3773f389d45ebac3cc67d054a8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740362, "uuid": "7744ae1e-eecd-4706-ac36-295ae59379be", "value": "6144:VGYgXWlQw/LOvqf+fNuZqaxIFsFRAYIGY1XDd6Ww3LLUQFeu9FMaf+k2uCQJ:ADGz0I+MZx9/4Dd6WwbLUQFeu9FMaIQJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674740362, "uuid": "1bcbe9a9-c2ad-4068-b8a8-059c9ae06042", "value": 635724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674740362, "uuid": "ea210b36-7977-41a0-a6f8-92e998f84e7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740362, "uuid": "12192bd9-b065-4c49-8cd6-6a41a1b79f02", "value": "SC_TR11670000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0462ca99-9d4e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674719392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719392, "uuid": "303b8fa6-9345-4199-b09c-d21592958294", "comment": "Malware payload (Formbook)", "value": "f5ad78ad2155990e6272a5305234593f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719392, "uuid": "8fdb4a7f-8f79-45e6-9910-509e12534078", "comment": "Malware payload (Formbook)", "value": "0be060c4fa67e91e7006aaef56a4a5203f86af720a03bff6558b5f334740b2d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719392, "uuid": "b58b3901-2ba6-4c35-a1d4-7ae56612e6c1", "comment": "Malware payload (Formbook)", "value": "475c7356a45323fea505d6955b38d79eb2ac1869", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719392, "uuid": "a51e1271-5ec4-4a7e-b24e-428175856daa", "comment": "Malware payload (Formbook)", "value": "e92d20438c9c3a6c29b4b398f65eb320fc9d16840673d4aed3dae98c6fdec98f4cd6a846cdefa82bab419f17a7c62b47", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719392, "uuid": "cbb28a0c-6c10-4873-ae70-d4d6025c8a0a", "value": "T1F615E040B2B8EB02EEA88FF9101155654BB22E1BEF24F3645D86B1E71A73BD03E50D57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719392, "uuid": "d0a49732-835a-4e14-be57-28316f8433c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719392, "uuid": "21194d8a-2cf6-42d6-85c3-3f0eccc80ba0", "value": "24576:n8kyGyOPQzlGI6AAgZ3jLUpsyVG7rOTu0DXNi:n8kypOPjI6A7jwpv77X0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674719392, "uuid": "5a7d65de-d29e-41f0-9516-3484b1019005", "value": 901120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674719392, "uuid": "bbb993af-66c4-4c5d-bb51-315d4f95f127", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719392, "uuid": "94bb35e3-3770-420c-988f-8d83f62119af", "value": "f5ad78ad2155990e6272a5305234593f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49b0525c-9dd3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674776631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776631, "uuid": "6b0f55d8-63e1-4938-bd4e-50568e0e5e16", "comment": "Malware payload", "value": "2a690f6da4119d927b4c74e381351b0f", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776631, "uuid": "05561372-4d42-4793-87b0-ab47cae90a6f", "comment": "Malware payload", "value": "0c0624a65c5133a7b6027dee2a20550ba4a4d1e6b93d857e32544971150f35a7", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776631, "uuid": "7c0a6a41-d707-4565-91e3-c94530d12ccc", "comment": "Malware payload", "value": "feb1e1c9d8ee1f20fe6bf4ab287d6e44d0c41eb1", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776631, "uuid": "a1295718-2178-4b5b-849b-c6ea4dd70a60", "comment": "Malware payload", "value": "49af447738f4ff262516b307f0bae3551e903f4bb96c51201cad13fe4bfac3ae7a9276be96ee56283d9f2a2aba4bf9df", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776631, "uuid": "88a6d514-7214-47dd-b2d2-6a05f46f45eb", "value": "T1E141BE286AE5571CE6F78F76D4B5620046367C06F936CF4C424491DC0495A00AB35F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776631, "uuid": "05a5b27f-b62d-4e72-a0e7-459763cbc31f", "value": "24:85MJ266r8LiACAOuER1KiOCqhSiQnS1+/vq9Ce2vREr4o0c6p4o0JQtvqOum+R:8WU7QBBOJDKiOfxAV/iUo82oftvsv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674776631, "uuid": "7bdb8d0e-db16-4b56-9883-c0d3adf7f074", "value": 2405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674776631, "uuid": "785d5f21-68af-44ca-86c0-2c3bddab6ad8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776631, "uuid": "7616e9a6-44be-44ac-b73b-be317d4406e0", "value": "FT1039.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd9ce3f3-9d73-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674735621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674735621, "uuid": "fbd6e5c9-8a73-4d89-a4e8-75fb42814bc3", "comment": "Malware payload (Formbook)", "value": "ad62baeb7c830274dace03070ee50cac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674735621, "uuid": "71366fb7-f2dd-4e47-99c5-7e2c65e4ae43", "comment": "Malware payload (Formbook)", "value": "0c2bfa1c8975deb05bc6fe48971ddf533e6649f27a34c34b4f42637e4ec8bc5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674735621, "uuid": "7925b6ac-c002-441b-82c5-85801dd14678", "comment": "Malware payload (Formbook)", "value": "e602215cddc5c479e59fbf92f915e7fb26153ed0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674735621, "uuid": "b7531295-a3d5-45b8-8396-1c16ce2a9cfb", "comment": "Malware payload (Formbook)", "value": "4c70b98feca7e66296f9ca92d1f66295f3a1d357c6f6e617ec502a166a86e2a62a62cb330832bb8b5db9e5db1173f10e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674735621, "uuid": "927f433f-8137-4396-938d-6b89d205fe82", "value": "T19515BE1023E9DF82F9BD4775C2B5528093F37865A532D7885EE1A0FE1DB3B008A42B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674735621, "uuid": "f37686a7-c853-4788-93db-9a3aa428eb1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674735621, "uuid": "311056ea-ac61-44e6-944f-3bc0e7753bb9", "value": "12288:utG7vV5zxPCRgfrWLXDBFqIGC4nqU4/WRFF3Aba9q2ovhuojV2rCG6e9mgAIZJsw:SZGdqVWRFFya98NaH6e9m1IsREmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674735621, "uuid": "50828bbc-5c3e-4c63-90bb-b8ee6118be8b", "value": 930816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674735621, "uuid": "e6c0e52a-0d71-494d-b0ab-c914e0f00f22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674735621, "uuid": "ad89de93-450f-4a5f-9d49-3aa27bfed103", "value": "WKotexAFDK4sNDH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8321212f-9d4d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674719175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719175, "uuid": "8caf1aec-8f7e-4e2d-9d3e-1958f9b48b20", "comment": "Malware payload (AgentTesla)", "value": "643271960b7bba0d5f2b106df7e89cbf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719175, "uuid": "4ecef953-6517-4eba-a1ba-ebbaf8508f37", "comment": "Malware payload (AgentTesla)", "value": "0cd43e8243b736228d29f850dcb224dcde06b20eb7b018bd34934eafc4dddbbb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719175, "uuid": "9eb8142c-b947-4a3b-b25b-65527f62bc83", "comment": "Malware payload (AgentTesla)", "value": "aea3f424595c2ab4e27a73c6321a510da31123d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719175, "uuid": "9471d0cf-b86d-4b12-b191-9f4073b489af", "comment": "Malware payload (AgentTesla)", "value": "d17e6066491470d20159dedde86632b819ecc4f14de6044b87c4f88804ce17e5ec54b3f7a53c475c8eae5accc8925491", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719175, "uuid": "a46ec74b-2274-48d3-b78c-40dd16532541", "value": "T198F4AD5023EC9F40F6BA4B789679109103B7BC967673E21D8ED120DE4EB2B14EB45B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719175, "uuid": "753b3988-38c1-4fae-ab6d-be5d847cccde", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719175, "uuid": "8a1576d8-9508-4fac-a931-b0b679a0733c", "value": "12288:MSkOvbnR8ey/ZhgxXDdzFqIGiAJZFzdKCVlUiX4Agn6HvBEhTyOTJpy8wvgPYcv2:Wvg3XGiAJZFJKIUqWnnTe2PYG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674719175, "uuid": "3533da62-5665-4d37-b2d4-9be32abd80e2", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674719175, "uuid": "05ae3fa2-616c-40a9-a6a0-ae1424cb9c14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719175, "uuid": "1e22d1e7-24b5-4faf-b302-1562e9581880", "value": "FedEx Shipping Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a94114-9db7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674764572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674764572, "uuid": "da5917df-fef3-4dd5-afd6-bb60bbedea8b", "comment": "Malware payload", "value": "89eb316a4a235f8f59106df363babeae", "object_relation": "md5", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "bomes.ru", "colour": "#3AD5F4", "exportable": true, "hide_tag": false }, { "name": "pw - 123456", "colour": "#F6B41D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674764572, "uuid": "13634437-2094-44df-8590-2a25580f0104", "comment": "Malware payload", "value": "0d077ce11ffb799e00e54ff521f0faefd98d32d7e89e18ad1a13733ed2463989", "object_relation": "sha256", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "bomes.ru", "colour": "#3AD5F4", "exportable": true, "hide_tag": false }, { "name": "pw - 123456", "colour": "#F6B41D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674764572, "uuid": "cd348ad4-9a67-444a-b664-33a90d9a108a", "comment": "Malware payload", "value": "3af8bb3ac9da289f5816bd026dbb0ff76416a909", "object_relation": "sha1", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "bomes.ru", "colour": "#3AD5F4", "exportable": true, "hide_tag": false }, { "name": "pw - 123456", "colour": "#F6B41D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674764572, "uuid": "b6a9a854-c7f0-42a1-9de1-0a42388b5151", "comment": "Malware payload", "value": "87333822f8a5ad6fc4493a8fb166eebe06bd54dfc8ccc4b2780cfc74b10215ce5e7d615349d5fe674ee78647795c488a", "object_relation": "sha3-384", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "bomes.ru", "colour": "#3AD5F4", "exportable": true, "hide_tag": false }, { "name": "pw - 123456", "colour": "#F6B41D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674764572, "uuid": "ea83d890-6334-49df-af0c-5cca951c92ab", "value": "T115953375FD8472B3F0F720AD49C009597A1CADFBB34B0ABA5F45328289484A5FC963B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674764572, "uuid": "75f528a8-410b-4d9e-b540-100097a00c19", "value": "49152:DiraV/0T6inhC/Y47YrCG9Q0MTJ9h/MDahY:Dv66hY4SmLl91y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674764572, "uuid": "c709a7d0-b5bc-4e2f-bbb5-10da3533fc61", "value": 2033614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674764572, "uuid": "f7a3d7c1-99b3-4464-908e-bad90d3c9fef", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674764572, "uuid": "37344c5c-0a68-44e9-a2a1-e63a5513a1cb", "value": "Confirmar Transferencia lista.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ff6dd40-9dbd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674767112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674767112, "uuid": "c8b3010f-be8e-4f65-9fc3-fa99d66379f1", "comment": "Malware payload", "value": "48edc49802b05c865e95f9af72086dca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674767112, "uuid": "45d14261-f537-4e85-b407-c7ac695668bc", "comment": "Malware payload", "value": "0d40d44dc84a78702b1d7b0cda3b7fba5d90d58a4af02a0787cbf227a49632f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674767112, "uuid": "420f9dfd-819d-4a66-a94e-afff563d9e52", "comment": "Malware payload", "value": "a0ac05b729f991b486a86324125ff7dcce88bbc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674767112, "uuid": "babb5da6-d549-4697-a552-44561ab9cd63", "comment": "Malware payload", "value": "c83f333f57ac751952b01bf52d4225add4139809c5f96c181f36c323ce7b201eebf7bacebff6631570d18cfe8fa52be5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674767112, "uuid": "f1b1050f-674e-4d5e-a91c-ae1b76c9eeba", "value": "T180D416A52CC170EAC011C97F6693F668C729E0B00DA1799E9A98D1D54BB3B4E4F3327D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674767112, "uuid": "7d8c96d9-451c-42ca-839e-eb6bd8c7def9", "value": "1685e1bb93ad26c47f9ec7a0ccbf5e1b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674767112, "uuid": "ed8ddb64-952f-4c80-b6c5-f94af8b591be", "value": "12288:m6Fzs7nRgL5QZOUZZEQqnzTttVbxXfay8M7+8:m6Fzs7RgL5QZOUGzTtjbJay8u+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674767112, "uuid": "08556179-b7e6-4a9a-8ee5-7786bfb01b4e", "value": 623120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674767112, "uuid": "e33a29a3-ab74-408c-a875-29556fa99941", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674767112, "uuid": "ca5575f6-446a-4537-a3b8-63a5ececfe04", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "804656db-9dbd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674767274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674767274, "uuid": "03108a18-d453-4528-be74-48201f44a939", "comment": "Malware payload", "value": "642b210cce1c89ac83f1f9ba777f49a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674767274, "uuid": "c65a59d3-6c4e-4f47-a81c-f636d489c023", "comment": "Malware payload", "value": "0d8d30ee7f056dfc450a881e589f4e964c0c956c77f3fb4d96eaf0ad8d89353e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674767274, "uuid": "2bb63761-a277-48a6-9fc9-6fbe72544b72", "comment": "Malware payload", "value": "bd5b60a4ff9443b6551028d939a60085942f8907", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674767274, "uuid": "02e0d3b6-7598-40c5-a935-ca1085525ed5", "comment": "Malware payload", "value": "852fbdab746d293db90b00e10fbc98856339c6a5e110feb0ad29115775b65f6ff97e7b18f9d8acd1ce37f94da58b72ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674767274, "uuid": "e8533b72-ee20-413d-845c-29764a75ad30", "value": "T15214E0123A80D0F1C4A650301C75EAA43FFAB5324765884BBBA41BEF5F616D0AA7D35F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674767274, "uuid": "cb4af7b1-5005-417b-ab08-78b4bb2df580", "value": "8112aba4cbddc2cc0c799fee8b497e25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674767274, "uuid": "437ce248-b116-47f2-b5f4-af936370f589", "value": "6144:EWw5ALCyyJcYccctO/lTfTOVMnSVRqx/H1:xwuePJEnUd7OVMSVRQ/H1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674767274, "uuid": "18074203-06d8-4810-ac8b-dd1deab18591", "value": 206336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674767274, "uuid": "d2ec8918-73c3-446c-8e40-53e16f9b6cdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674767274, "uuid": "3772711b-5a42-4dec-af20-474224194967", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6b1761b-9d2a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674704202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674704202, "uuid": "52850d84-5a9a-4418-8cb2-41fd235203de", "comment": "Malware payload", "value": "b86b8f21819df5e157898725998db0ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674704202, "uuid": "7d7075f8-c9b9-4bfb-850f-2dacc88f94d2", "comment": "Malware payload", "value": "0e0714deb7305d416418aa163ab054f48b09f3ed6f6a8cedfac01ffa55cab1ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674704202, "uuid": "ca834535-f392-48b7-852f-278bf9219bd6", "comment": "Malware payload", "value": "134d80ea3416dec9706f40eaba439693d6c54746", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674704202, "uuid": "97c5145d-5044-45ae-8730-52beeecee4e0", "comment": "Malware payload", "value": "ed705cc8102b4192de3fe569b7e61a20add00fd48bd1b0b9bd745f4d8127c33445cf8a0d3f792a8c3ce81d197b7a08d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674704202, "uuid": "fcc23c8d-c387-458d-919c-770356d4a933", "value": "T1B1C4230C6FB2C167C09347312F36406FE9E46D27A8A8914B9B60735D2D9E3E6D71E3A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674704202, "uuid": "c7e9cefc-0571-42e5-b353-34b4d13d2595", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674704202, "uuid": "07a86829-2890-4d45-a79f-c23c5aab2e67", "value": "6144:/Ya6wisg07HVgDZ2jIcd4T/PmSVUUXJMHWFoLnt+CDMWe8KuyP2uPQleBv9SpyEc:/YW/Vg1AdSmSWUXuWFo7tI8U+sv9lE8h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674704202, "uuid": "2377e9c5-41a4-41f0-b335-8134dce3f663", "value": 549055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674704202, "uuid": "eaeb311b-c994-4d23-99f4-895ab8df93d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674704202, "uuid": "9df9c435-60c8-4ede-a8a9-7eef3e7eeacd", "value": "S O A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75cd9830-9d9b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674752654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752654, "uuid": "90a93b0a-8655-4ce9-a6ed-007415d185c9", "comment": "Malware payload", "value": "c423b2a38d2493e430bbddcf282d07fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752654, "uuid": "cfe21726-aae2-4f8d-bed1-92cfe644d267", "comment": "Malware payload", "value": "0eb2e5fcf4c969dff84f19999e62b3b3ee9c42f42eb06e6b961ed093071ab2c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752654, "uuid": "8d69fd0f-61b0-472d-ac13-c967af796055", "comment": "Malware payload", "value": "7ce78de4ac1e0a1f470905d2511455ec86471668", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752654, "uuid": "29d30ea2-f0f4-4e19-87c4-456a8e4be629", "comment": "Malware payload", "value": "42c57225ffa8ceefa06b2cf8b0d499d7ee92771fa89c583c67ba92340a727999007b963a89734bf22e17ee0b4fddb2c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752654, "uuid": "6f374904-f0ed-43ac-8094-6af52e02dfc5", "value": "T147C57C58DA4390BEE82704F0057BF7FF9520563548A08C5BEA8CDEB4AE72DA2531971F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752654, "uuid": "1d704623-ae66-469d-8649-9f32c357b592", "value": "0e504ec9659601103bf3eb149ebb6cf2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752654, "uuid": "133340de-4ea0-471d-907b-16316af48be4", "value": "49152:XR60kSiIbh+N6WL+HkwqlmadOmxEbn5E8E208VcwsI8MrHdiiIOZx4O+g20cs908:h60kSiIdY6uWkw8dOmxEbn5E8E20ucwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674752654, "uuid": "0bb88113-d34e-4bae-bb4a-1926e4e33016", "value": 2662616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674752654, "uuid": "54bef3a6-c3d4-41ac-9d4c-ab990e41f61e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752654, "uuid": "57826ff6-6ac3-421e-b86e-ab91e4e55b71", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a41c3c8-9d7e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674740152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740152, "uuid": "8d786502-dad2-49c4-9c66-923734254649", "comment": "Malware payload (Formbook)", "value": "e1668320cc4cade25d81b798190725c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740152, "uuid": "138e7e14-0fbc-48e0-9b1e-c2cfa5dfea21", "comment": "Malware payload (Formbook)", "value": "0ef43bfbcf7566727359acd6ab88590c1cbcdd25c913e2ea8c111118493f8e7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740152, "uuid": "74e9630e-04dc-4cb2-aef5-e85537c2080f", "comment": "Malware payload (Formbook)", "value": "2e260a1b3f1bcd26f00d8d6e850812c740b11d3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740152, "uuid": "3793c0a3-0c89-467f-8401-6f39786a9385", "comment": "Malware payload (Formbook)", "value": "0fd5bfd103e0da932ecf0bb0acff68bd94a99d0ecd52d30a1fc0f7f75de0a726850718b5f7645597d37606677135bf9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740152, "uuid": "d14f8027-9f32-431e-be20-fd08d4d10a42", "value": "T11C163301D3266EC7F8677C3478E611D84DEF72407AFE967A42AFEDC68478718342A522", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740152, "uuid": "8d54a7f7-8dfc-4698-b6d0-09e06fb87343", "value": "98304:yAgqXSO7ZI0UxEcxtGya6JfjUV+2E3Szfj4bCBj4:yVqXTWxV7Jf6DbzrpB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674740152, "uuid": "cccd7bd4-b396-4c39-81df-9fddceae2222", "value": 4277248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674740152, "uuid": "b5aba160-693c-40d6-a840-6ee29b03b396", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740152, "uuid": "9183e0ba-4bc7-4f05-8ef1-58021f2b7120", "value": "ben.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88411fa3-9db6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674764281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674764281, "uuid": "b0723e41-bd9f-4a9d-9805-ae0e78c41561", "comment": "Malware payload (RedLineStealer)", "value": "2554ddbdd99382c48cf8bfea41b68b50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674764281, "uuid": "73d621d0-ffbc-4f81-811c-aa236d1a08c9", "comment": "Malware payload (RedLineStealer)", "value": "0ef7b8cc63d0c37976242e1e0ec9f17e343694e44f3743a2bbedff169669dc44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674764281, "uuid": "98593314-368b-48d7-9053-d9fe6eea5521", "comment": "Malware payload (RedLineStealer)", "value": "566fb0caaff5c20bddd8d14b79aa61009a9b4b57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674764281, "uuid": "bb9b680e-a37c-48a6-9bb5-086804c73c07", "comment": "Malware payload (RedLineStealer)", "value": "c255c6edada5aa889295d6976eed88afb56171a34cdc0f8d719fad9631560f7d9ab7c19e30da35f9f6c8f43625a77854", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674764281, "uuid": "1afe36a7-6cfd-44ff-80bf-ba35f76c25ca", "value": "T1A114E1217580C47FC05524349C60C7A2BE7EBD3356A99D8BBBA50ABE1F703D0677A34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674764281, "uuid": "891a0651-8cae-4fef-a48f-ce62e99cf2c3", "value": "4dfa6309511cb75d1093a1ac55cf0bae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674764281, "uuid": "ec689a8a-7155-49f1-8473-e515f559e223", "value": "3072:fBN2Khf7bWGGL6YTrvptJw5pAFkhdIH/E8DUvdI2XI+jD4hQuYp:ZzbWnL6wptJ2igdIfE8YvXd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674764281, "uuid": "3d816118-6275-435b-bcf0-48c53771947d", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674764281, "uuid": "7640f63a-c9cf-436e-985c-bd7020b1eb7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674764281, "uuid": "de48c6b9-722f-444b-b502-a8ea43b2b0ed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00db6dba-9d62-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674727976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674727976, "uuid": "c7ed5217-7030-4267-9e15-e4da419722fe", "comment": "Malware payload (Mirai)", "value": "a78325b5d8618b7b010c630af365be0d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674727976, "uuid": "ddba4c9a-ea9a-4d98-a7f6-0bca5f2751b6", "comment": "Malware payload (Mirai)", "value": "0f9bc83dd0f4e18c67ab13d5def879941f50d97be6a78f04e36d4e6710147981", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674727976, "uuid": "fba1b07e-3ea0-4f7f-9f86-96257cf4b47d", "comment": "Malware payload (Mirai)", "value": "f5e54d46dbcae8a04cdc3c27bc07806fe92d751f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674727976, "uuid": "d3468e45-3357-48b3-8ed9-d39b7a5545ed", "comment": "Malware payload (Mirai)", "value": "d10e84dcc45171858dd2c8d889569446764336c97e02d1e3fdb01b2ca3f0958c6d1db5b46aa9afe46c60510098b7144e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674727976, "uuid": "2a3631d4-7a12-4ef2-92cc-7dc71077229c", "value": "T1E78329B80995B73CF9F250B5F45320DA28A10A1C379CE1E3B9936476FFB4708B269D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674727976, "uuid": "d96214cf-937c-4f4b-a277-ac2e1fae7346", "value": "1536:RFsqdPA6xChpzOWYbgABe2Gx7v1/WGQlhyc4po3s:Xdo6xIz7+Be2g1/WPycCo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674727976, "uuid": "d109b9c2-7df3-4f6f-bf56-da4d7bd47f2d", "value": 83396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674727976, "uuid": "4bd1ceca-e2d1-4d61-a544-c94700005a15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674727976, "uuid": "fd086707-e856-4994-a2c5-ad1b4bd2c807", "value": "a78325b5d8618b7b010c630af365be0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "198051cb-9db3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674762807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674762807, "uuid": "fe678493-3009-45ab-8a57-8f107dbb3bcd", "comment": "Malware payload", "value": "8463849a48326c8b46c38717c30a7acc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674762807, "uuid": "12b2a519-c5e1-4ac2-b508-50b52786b31d", "comment": "Malware payload", "value": "101387858898c5dc0102bfd2b57fe50707dd002c093a4dc596bf3e7e854f6880", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674762807, "uuid": "8a2b14ae-5020-4667-8693-2f89952f0d52", "comment": "Malware payload", "value": "5c81ea3b2a013b8736872f2d667ba4bc42f4544e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674762807, "uuid": "6803d0fd-e82d-460d-a81c-5ba2714320b2", "comment": "Malware payload", "value": "2b8c47d998cbacc970e0eca04348230d8adbb1ba4253849d1cd62e2c280d650c1a40689e34ef5a3e762a2883c0611c40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674762807, "uuid": "fca6a07e-aa08-4c3d-9ed6-cd050742d8c5", "value": "T192245CC2329C8293F97D96F592B39D7107B23E294EA9EBC92CD635D221F37504019D2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674762807, "uuid": "f5ab7cb2-ba0c-4b5d-9136-d59e20559a74", "value": "3072:vLQ3jFFRmQukKxwumnIU2bQ3/Ksg+O/J/Ksg+O/XWf+/Ksg+O/Ti:XQukK6hn3/Ksgz/KsgE+/Ksgk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674762807, "uuid": "be4cf497-c354-4942-92e5-b2ec44ceb635", "value": 226168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674762807, "uuid": "894f084b-2de3-46eb-8498-4f1a87af9560", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674762807, "uuid": "fc1826ea-d847-4ea9-ad9e-84bd45ae8859", "value": "8463849a48326c8b46c38717c30a7acc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e2f1b49-9d11-11ed-88f6-42010a9c006e", "comment": "Malware payload (SilentBuilder)", "timestamp": 1674693209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674693209, "uuid": "4b69bd10-dadb-4ee4-8005-d6909e0cf3d2", "comment": "Malware payload (SilentBuilder)", "value": "1596dc98f96feae955a680a87024dd2d", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674693209, "uuid": "1aee4aff-d490-41f2-ba97-756a129a6b13", "comment": "Malware payload (SilentBuilder)", "value": "10d3ebe25e0249c65fe82295865e2730021876ed8d3bccc3e88242e452d4c2cb", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674693209, "uuid": "009e1ca8-2d1f-4d53-830d-2869dd9ab92a", "comment": "Malware payload (SilentBuilder)", "value": "c61de22e6d9ff5555016b8259ed0d0421893ca10", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674693209, "uuid": "a8302849-0cc5-4917-9002-cde32ce216bf", "comment": "Malware payload (SilentBuilder)", "value": "78788edc85b78f03cf4847ab4aa031b93db38f0c152e0b807366f6d2a641a9f317d90403bcd86d039aeacb7537ff686c", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674693209, "uuid": "b271e072-3c43-4e39-a0b6-3a5b87f5e664", "value": "T156E382817D12C429F3AA8AB68467426C1FE1DC426BC0A4DF332A7B595F702897ED3D53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674693209, "uuid": "81437a34-7b88-478d-8a07-e239ded95dd1", "value": "3072:GcPiTQAVW/89BQnmlcGvgZ6Gr3J8YUOMRt/BI/s/C/i/R/7/3/UQ/OhP/2/a/1/V:GcPiTQAVW/89BQnmlcGvgZ7r3J8YUOMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674693209, "uuid": "79d5c201-ad49-44e0-9d70-1994759c32ef", "value": 145920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674693209, "uuid": "899f9efb-14e1-4acc-acca-0ad0496b262a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674693209, "uuid": "602427c4-ebfc-4b4d-884b-538987be1caf", "value": "Complaint-922836043-02182021.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "936a816a-9dba-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674766018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674766018, "uuid": "8867df05-95b0-41c2-a2f5-f090b016c095", "comment": "Malware payload", "value": "cabdd90385c0d07a64a0722bab2833c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674766018, "uuid": "d2d10aee-c120-452c-9a5c-69edfbeea620", "comment": "Malware payload", "value": "113e759f12c8b99e9d78eebca6ab08a5df1b76c5855dbbd47e34db49f80dc44a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674766018, "uuid": "94f5bd08-07d2-4cd6-9c09-e588290301ad", "comment": "Malware payload", "value": "78b116aac6939bf28fed3e98b6033856066e87f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674766018, "uuid": "3d80a207-663d-4a32-9031-545f6fdc84d9", "comment": "Malware payload", "value": "60e14a071c95019ede89fa1ee2d62ae288e2c91f802ba4a3b9fcb58918eb83500339e1d0b6408624887d4b1700eb1f74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674766018, "uuid": "29adb247-11e0-456d-ac6a-916da6073497", "value": "T15114D0363680D072C4BA21301C75EB612BBEA4324775858F7BA91AAE9F307D1977634F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674766018, "uuid": "6db0585b-d288-43d6-9188-59c9f458fe03", "value": "8112aba4cbddc2cc0c799fee8b497e25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674766018, "uuid": "73f1f0c3-ff6d-430c-ba91-c20a5d94fee4", "value": "3072:ATBN3T3qSYi4OLk1I0bbJ5kav962dXy3jGjZ4pVYz72EyH:AwOLkO0bbXE2A3jlV4CH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674766018, "uuid": "74284b60-15d4-4770-8a98-66d1b1653bb8", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674766018, "uuid": "75fd399e-1dad-4c50-a4d6-f5446bd9628b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674766018, "uuid": "7865fafb-f7a3-4005-b02e-d0fd462f5689", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "097d3640-9d97-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674750754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674750754, "uuid": "4d32cb26-b53d-416b-9a4e-609892c6746d", "comment": "Malware payload (RedLineStealer)", "value": "9ea4f8811d333a11401a102e8bc84c78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674750754, "uuid": "28f15ff5-c2cb-4276-8d82-85a71ba6c9cd", "comment": "Malware payload (RedLineStealer)", "value": "11cfdbbc084ac11d38891767f59dbbeab77d0fdfd7eb1dedfd4297b64979a0fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674750754, "uuid": "38e5c650-ddab-4e56-9216-c4a5db479968", "comment": "Malware payload (RedLineStealer)", "value": "b246b1aa87de2a8fa7770371ff53ee3e0e4f449d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674750754, "uuid": "4209fe02-b3d8-4129-9f80-da1e6fd2aa2d", "comment": "Malware payload (RedLineStealer)", "value": "b789f9c84224ca3a59c6b1a7a32ea697a13fc147fb1fc171d7e243aca7fb1c90a65c01053bfc20e778098556e45019b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674750754, "uuid": "37df89f5-710f-46e4-b845-49bb498b057a", "value": "T1E414E0217490D032C36645754820D7E12FFFE93266A99D4BBB980B6E5F603E1A77334B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674750754, "uuid": "197ccc0d-f24b-4d31-9ac2-f34ce11d1056", "value": "3441d27f999e45e989c5f0204be01528", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674750754, "uuid": "e435d0ad-eb9f-4a0f-9cd9-3536db97c6cb", "value": "3072:uBN2sWuedtLK67kbSZsV+5h544ZD1BBTynmjg0JEX5+5Wd6UKB:C2LK65ZsVZ4p1vWnmc0KIWdT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674750754, "uuid": "4f2cfd0c-3c32-48f2-995f-aed3e6b7a549", "value": 203264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674750754, "uuid": "64c0c64a-c93f-4670-bdb5-04b752abcdec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674750754, "uuid": "e9aa9f5a-5b84-454a-96b1-db3da4643b8e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b0cdbdd-9d41-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1674713927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713927, "uuid": "417f9005-75a2-4d62-aeaf-5b329b088b8b", "comment": "Malware payload (Gafgyt)", "value": "143c99858de529356ddb8e07e8691bc8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713927, "uuid": "67912ddf-bc30-40e9-a31c-080b0ef554e4", "comment": "Malware payload (Gafgyt)", "value": "1258bcdf34d4c20531b0498ba3a6f8a9653224c734978fa067c527bfdb037e92", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713927, "uuid": "43c81578-ea94-4d28-a91c-ff40940fcb5a", "comment": "Malware payload (Gafgyt)", "value": "9165810ff519329206fbc88b2d376bf038f4b6b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713927, "uuid": "1eed442d-fe1f-4752-bc94-9978f62686da", "comment": "Malware payload (Gafgyt)", "value": "271aa2031c68899893277dc3ef2a79c407a61f321628c0eefdcef5593c7c5123536a6eb48ba1a843a649c44bed837023", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674713927, "uuid": "0a4744b3-3d61-4f16-92f2-28b6c470044e", "value": "T1C6F3E803E5054667C2A316F2625B23887B26537F87DB3343F9295DB07FC1A5A1A3AED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674713927, "uuid": "1396c969-e70e-4dc8-803b-03e9fb639504", "value": "3072:VxXuDviuPUOOKIlRjk/P9E+mSq1mefQQxZy5XHcj:VivpUOKl1k/kvmefQQxZy5XHcj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674713927, "uuid": "f762bc18-690e-4ff2-8291-23dc4a9f18d4", "value": 169103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674713927, "uuid": "16b0eb0a-b4ac-428f-86ba-d27bc6e4695d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674713927, "uuid": "336a9f30-212e-4665-8d85-c1566d1f07cd", "value": "143c99858de529356ddb8e07e8691bc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd63944-9d42-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674714628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674714628, "uuid": "06d14d8f-ad75-4c73-8136-0708fb3f6ef7", "comment": "Malware payload (GCleaner)", "value": "b1b5b666e1a9a619c244c7782b9351e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674714628, "uuid": "a5119ef4-f03f-4513-b1c2-56b4fa236c36", "comment": "Malware payload (GCleaner)", "value": "1302fdbee513a7261eeec7b128374d0f938af40698e0675f8f6cf33a54385108", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674714628, "uuid": "dc7c7ed1-82d3-467b-9b96-536fbb384a1d", "comment": "Malware payload (GCleaner)", "value": "a8beb50f22a34a492bf3cc9fc336b8267edc6afc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674714628, "uuid": "533b9128-d70d-4690-a8d1-b7dac4a09fb9", "comment": "Malware payload (GCleaner)", "value": "2de586e38ed888a97f78043fb3def8ce608a833201cfbdeeedcb35d2badc3eef3fd9e307a8f823f3f837592a8965fe35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674714628, "uuid": "b26ccd90-7cb0-41b8-8209-ea885bf5051d", "value": "T17D9523437182D5BCDEA38B7B3D32E1409B13FD8B207C2519735EA3CD2E2B6615872696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674714628, "uuid": "373f13c1-b4db-4753-828a-430ee0d637d0", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674714628, "uuid": "017f9278-b758-42a2-811d-d234d2807e37", "value": "49152:okug+U2JRuRkCuX78iSuct0gqf6vJNV4EbtLCgv2MR:hug+3fuRk1IuwFLv5zbxv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674714628, "uuid": "efbf3d54-f6af-444b-9c2f-630d013cd443", "value": 1900587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674714628, "uuid": "78a063bb-cd16-4e38-a0c8-b371707214f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674714628, "uuid": "71cf3b10-2032-40f7-a398-eaca060d0e87", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "224c8e60-9db9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674765398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674765398, "uuid": "a374d3e2-8382-478f-8713-551b37c985dd", "comment": "Malware payload", "value": "9893de16867126eeb989265cd99fd201", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674765398, "uuid": "1645959d-ecf9-4ac4-9b3f-dd5a7bacfc53", "comment": "Malware payload", "value": "13933403b4b5d79da1decbc41867c842e3577bcba8ce3859f7d9b881348ad377", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674765398, "uuid": "fe8a3345-34e4-4b3c-9799-ca76b69bdf14", "comment": "Malware payload", "value": "71e0c3ee67daffada30a0bcd3abafaf59cfa8b5d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674765398, "uuid": "318b5db4-ef71-4b77-818d-7eeeac4dd16c", "comment": "Malware payload", "value": "c146481d521580470823eaf9024b38ca4e06c0f26f67ee09009aac85e7b6ca4c9d422bd4009419991bb8c135a99a06d9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674765398, "uuid": "7d66a5f8-8179-4c92-bfb7-a3a583dc330c", "value": "T14FD49E3A66E79E61F3B79BBD99B042308B32BD56D736D71D339004C50E31A50EE123A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674765398, "uuid": "150bbdf7-4023-4539-8aa4-980991d50e36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674765398, "uuid": "83b3304b-f7be-4f1a-a999-b089a6fe31d0", "value": "12288:o6pGFv42oseLA5Gt/arlTT6zncVUJ7vnK6U:o6pEA25WQm/cTT6DNK6U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674765398, "uuid": "793653a2-3aa0-49b4-88aa-94911f8cede9", "value": 621568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674765398, "uuid": "5023873a-b599-49f5-a0b4-7b70aaa987f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674765398, "uuid": "16047a4f-2344-4373-abb1-9246f1ed8a09", "value": "13933403b4b5d79da1decbc41867c842e3577bcba8ce3859f7d9b881348ad377", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4b7def4-9d9e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674754128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674754128, "uuid": "1f246aac-f99e-4d9b-a8dc-ce25a46d56e4", "comment": "Malware payload (AgentTesla)", "value": "a3dd74738d74ded3666855f6fd19d6b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674754128, "uuid": "18fc2916-845a-4b23-981d-b39a5fd57b14", "comment": "Malware payload (AgentTesla)", "value": "13c528d8bd29a171aab53ab0fcc11dcaed18a2b7ff2f821cf7187b91e4f0566f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674754128, "uuid": "01d914ae-caeb-4b4e-875d-2a7c49811106", "comment": "Malware payload (AgentTesla)", "value": "bb0a9f5004ce2a18d6ba7a6dd7f534cb911c03d2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674754128, "uuid": "f42e5bee-e1c7-4a51-a3ac-05f6751c0ad9", "comment": "Malware payload (AgentTesla)", "value": "523d7ae7150406bab6e96b455405464785532791d920fbdc50168879827ca909afb8c48e40db4c23c3ccb3032c25a31c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674754128, "uuid": "d1c3fd23-8ae7-4150-beb0-48ccf5788c3e", "value": "T1F0F42330B2E7451875F353D109A7B1783652808EE67A723FAB022D82D9265CB4F37AD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674754128, "uuid": "80ad0237-3c59-4995-98c8-b50e0ff160bc", "value": "12288:DERJ7FHyKr7f1JLtguLY9jGXABi9WiKfIJzCultbbp98BGux1xmopESWUdeIhiR:QRfSw13guLejGXX8iKf6zCdIuXlp3WUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674754128, "uuid": "a50fb721-aa1d-43c4-b34e-bdc8ab0c3f00", "value": 722963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674754128, "uuid": "7b1404f4-4199-49d2-a2c7-4d0f9f59d3bc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674754128, "uuid": "9aff19f3-25ac-41d4-ae49-41773f6cd184", "value": "Confirmation Slips,pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b785f3f8-9dc9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674772521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674772521, "uuid": "27fb81aa-eba9-442c-9651-ddd3fa8ca6dd", "comment": "Malware payload", "value": "a20c37f0c60ef053496b556da096cea7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674772521, "uuid": "78f9f60d-7c58-4985-8c63-163e44c25bd6", "comment": "Malware payload", "value": "15644a32b535b90d5c20f99508b35644911e19d138586ef36d625a32413bdc91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674772521, "uuid": "84c4db66-7022-4749-a0de-fd5362d84cdf", "comment": "Malware payload", "value": "f1190e42f369e1f83a12c1a2f88de2c094fe947f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674772521, "uuid": "695c1784-9b74-44f4-a65b-451bc5138d5a", "comment": "Malware payload", "value": "788f360de392285adc9bc9ca99804bf5cd4f542192eadd9b09ddd40a3730e4cc149993affb58f7c60d05ecc8a0936d2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674772521, "uuid": "cec0ae1a-4039-49ea-a1be-687344b06c03", "value": "T17014E0323690C072C9EA05305835EB613FB9793142B5894B7BA816BE8F237D1A77634F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674772521, "uuid": "07ef9568-a730-4c9f-8469-65d3f1525820", "value": "8112aba4cbddc2cc0c799fee8b497e25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674772521, "uuid": "7be1cc77-3ee4-40c7-9ad7-b26da31941cb", "value": "3072:CKBN3GRvmAQSUGLtLplxyyW4C5SwjSQnwsLjKtImkdAI3SkLSm8m+VHF:JeQstLplxyyWOGSWWOqrQSFHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674772521, "uuid": "713b2f44-c8c9-4e7f-8ba9-67239f2d1f7d", "value": 206336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674772521, "uuid": "c68cf45a-7c78-4f5b-bcd2-a3deb156c00d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674772521, "uuid": "ea56b6e9-6faf-4368-9141-0214c358e5a8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e898502-9d84-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674742656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742656, "uuid": "9d93c60c-aa3e-45cc-945e-b0850e5cde09", "comment": "Malware payload (AgentTesla)", "value": "5e70ccbbd54b848cd16693594feb85ff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742656, "uuid": "35f0f081-291e-46ba-8903-f5c4d35c067b", "comment": "Malware payload (AgentTesla)", "value": "1586614c1fee5c1bd15d513b23e3ea9f2d0be5ddfb96505a3a85aea5c1d8f7af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742656, "uuid": "139d3a05-081a-4e9e-be23-42484b84d57a", "comment": "Malware payload (AgentTesla)", "value": "7f7ee4ffc3c23c5fc460916ccb9775998d888636", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742656, "uuid": "5ab4351a-938a-46c6-87e2-d6d8b2e7924e", "comment": "Malware payload (AgentTesla)", "value": "661e717c161cb6fd6c671b57420ee3eac6584fd2b9ce49e279f6a607dcb1ba274fd479f5c38e0f53681256834fc438f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742656, "uuid": "2ce3723f-3b02-4eb2-9e00-53ff0a49635a", "value": "T1654412006AD4C5A3D4E34B72353DC7B6AFBA94006429935F67D0BA8CBE2E6D1DD0E712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742656, "uuid": "22da8dd1-6ee3-408c-8d4c-ab1a5ceedbbc", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742656, "uuid": "f176f9e3-ccfd-4846-a09b-1475d2627f97", "value": "6144:/Ya6Hcypo3kinPlFIE3RAhLpQp0hX6wsdx/ZThTZJG7:/Y1cypqvMEhAhglBdtZ47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674742656, "uuid": "2af38e8f-8fff-444e-9cbd-eda1b760a936", "value": 274748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674742656, "uuid": "8a837bd8-51f4-4018-ba9b-03e16d8ffeb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742656, "uuid": "0d42eda8-57f9-4bc5-a6cd-1a0e94e2a838", "value": "1194 FE7191PO1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc9f1923-9d93-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674749444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674749444, "uuid": "8637a367-1a25-48be-9013-ec4f33161863", "comment": "Malware payload (AgentTesla)", "value": "433c5a84e432a29326c5ac45e8842ad9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674749444, "uuid": "87fa543e-8696-4179-ad12-ea2810bbb04e", "comment": "Malware payload (AgentTesla)", "value": "15e30fb7205f72a8ad7dc0842655fcc1a43fec4c919a5e28cfd61fbb5124f879", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674749444, "uuid": "2d134951-a5ec-46cd-a4ba-b55d21d153bb", "comment": "Malware payload (AgentTesla)", "value": "01ebdf09558d180098933de810f860f7b3d799aa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674749444, "uuid": "d8a3d9a5-edb4-461b-9fd3-d9f65b8db791", "comment": "Malware payload (AgentTesla)", "value": "7494a7be072e2030b2bef8c451b6d0d0e331342deb0f7d6412ceb1297cdcae63c71227722619fae708e7e6da58a592b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674749444, "uuid": "9313b435-8bab-4065-a4dd-4c9ae0b5fd80", "value": "T157E41260B5B86B52C67A8BFDAA70290007EABC96FE22D35D5DD374CE11F2F404490E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674749444, "uuid": "594ea634-c767-4fde-9740-7bd50b144bf0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674749444, "uuid": "fc27f8f3-89e5-4bf7-a523-623e8df57c5d", "value": "12288:uE2Zw1gzs43BFjCfuXdm4SrjJE3FPSalLpCm0BbdtinyBfmsJ0CFqIG:u/RXYjJWPSaNpCCnGfmhOG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674749444, "uuid": "68a4eee4-6082-4015-8003-45f884e757b9", "value": 720384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674749444, "uuid": "cbfd06ee-3425-4b4e-8a92-da4fdd8fa461", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674749444, "uuid": "25c84c85-2d62-4280-99c0-578c4f0ce1f5", "value": "Contract Draft & Drawing Specifications pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "364a3aaa-9db1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674761996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674761996, "uuid": "767302cb-212a-4176-b7ad-19dfe89a1fcf", "comment": "Malware payload", "value": "2756fd6c9fff676619e52d2ef1311a8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674761996, "uuid": "dc8431fa-d55f-4701-a940-b844e8dee098", "comment": "Malware payload", "value": "16481e6736e49e69b050eae118e8295bf97da5c0b3074e534d1f133298cabdf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674761996, "uuid": "700bbf25-3f46-4334-940c-ed2412924406", "comment": "Malware payload", "value": "2d2d97edfe0bd47634bb852799ca2621c519ebad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674761996, "uuid": "14636530-a636-4255-81ff-843a9eb5ea3c", "comment": "Malware payload", "value": "2be7e1a49cbdfa2d75de76c712bc68fa19779c5c5d09c2a546fe21f75b0a2bde8ba60e14b6c25f3ab1a1a911d9359bde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674761996, "uuid": "ba67956b-266a-4abc-95ed-b5118bbae794", "value": "T1F417334E8279098AFDF6A43FDC07D525D694BD260374C14B0A4C624B6EEBAF43936F60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674761996, "uuid": "ad957ac3-7e1f-4a5f-b60e-d7bd3a740564", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674761996, "uuid": "58edd61b-c31f-4e52-a188-5a12cb323dcb", "value": "393216:3oVRTWBb+4hQayanSyY+k4tOJCEDd/m3pCZkVRiEFXnu7b5GDnq:3oHqN+4FyaY4tuCEDdKCZkVRiWu7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674761996, "uuid": "f3c0dfcb-b18b-4ea7-97da-5e9b63a706b1", "value": 19372372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674761996, "uuid": "ff91ed3b-b4fc-4397-b004-26d3f2b883b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674761996, "uuid": "f251b976-3a40-4f10-acf9-e704dd381a27", "value": "OHIO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "538823de-9d4b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674718236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718236, "uuid": "ccf8de56-1d48-434e-88c2-598852e1a80b", "comment": "Malware payload (AgentTesla)", "value": "d97c4f17cabb317ad03755bdff352349", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718236, "uuid": "103393a7-414b-4fba-a5ac-2de46fd1a8a4", "comment": "Malware payload (AgentTesla)", "value": "17749d0075f1855d1ec5badde6d07bffb3c1d4fd078167ae758137b5e5bb8d39", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718236, "uuid": "6eb80e9e-ac4b-4ce5-bbc1-880e9929fba3", "comment": "Malware payload (AgentTesla)", "value": "dfc99cb44ba2f98ba103618395b2862f008de6ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718236, "uuid": "079e7b2b-b09d-4e8a-a6b6-f71a4cdc179d", "comment": "Malware payload (AgentTesla)", "value": "175d5802042c1a27fa67a839ce40e7ef6fb1e0c823afd61caaef28e49440dcb903cb71ed6f35739be32c41960366c025", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718236, "uuid": "ed4e6ef5-4399-4157-9b83-bed9d09c632a", "value": "T18CE4AD5023E99F41F6BE0BB896B9405213B7BC967573E21D8EC130DE4EB2B04AB45727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718236, "uuid": "4975a10f-1d77-44eb-8fdc-0785f2ace65f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718236, "uuid": "4b43b9f3-4a94-48b0-889d-5fed1e0f3a97", "value": "12288:8SkOvbnR8ey/ZhjXDFzFqIGV+X4zd0uE1rKVB0oZWQydzpGHPVGuoyJwv:GvFXGwS5VZZy5+PMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674718236, "uuid": "9f603d72-6877-40d1-9e7e-6d0f42935fb7", "value": 685056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674718236, "uuid": "18f65383-8646-4996-8ff7-a252aec945ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718236, "uuid": "433ff616-fef7-451d-8bfc-73931790f210", "value": "FedEx Receipt_AWB#53053232904643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce94d610-9d0d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674691814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674691814, "uuid": "39ed652f-dd3c-43e8-8356-51f67880b9b8", "comment": "Malware payload (Smoke Loader)", "value": "91797ffda0cea9b465705aa0397a6c7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674691814, "uuid": "334d6ed4-9bdb-4994-a865-2778d61ddc16", "comment": "Malware payload (Smoke Loader)", "value": "17926c8b15795d5031256c60927e53e8b7b4d8c8ddcb065cb61409f1f8088092", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674691814, "uuid": "db17f662-66cc-4599-9c44-32993da53d0c", "comment": "Malware payload (Smoke Loader)", "value": "a8925c6d68fb044312c2d12063018fffe8ea9e41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674691814, "uuid": "e82c71de-2ac7-46a7-8fb5-026bc5897a77", "comment": "Malware payload (Smoke Loader)", "value": "cbce97c0043d5d615275b1f5d7ef745fe3d944b766ae12486875c188ccfa7e190b4fbbaec80cdba1305366abe2cb836b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674691814, "uuid": "afa736f4-8dfa-4bce-8579-bb280ebaf9ba", "value": "T1A264AF1E76D8A850EA294635CD3ADBD439BEF8D28F3C734732C4AA1F19721E0D527216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674691814, "uuid": "9e9c36b3-ecc4-48c9-91e7-853242ed75ec", "value": "e5f35c047e0fdde323b83e51e689dfb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674691814, "uuid": "f2773172-ee1c-4fe9-ab2e-a85218a1f78f", "value": "3072:Nx+amoLhT0JrKgoARjvlAbH4IiWvnZZI+GOVhRkX8Y0+L4Oi/XcLYbG/FmUT:nRLCJrKCTKgvO7Rm8Y0+MOKX4UUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674691814, "uuid": "45b22962-82e3-4d3f-92b2-4ab373951c5d", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674691814, "uuid": "ce194a34-d840-489e-9063-612524a1bef3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674691814, "uuid": "3da92fc5-4077-4833-af4b-5960c6a6de38", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75b08787-9d7d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674739768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674739768, "uuid": "3a7bc15c-d0f9-4c4e-a88c-1256c4461f7c", "comment": "Malware payload (AgentTesla)", "value": "f8c6822fe70e93d3645d98fb2f096f47", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674739768, "uuid": "f09e0c19-9486-4e53-8ff4-a1af1ff4956c", "comment": "Malware payload (AgentTesla)", "value": "18581776643e7ff918c5d6f8217e33b3ec7afe8c3df566a8d92833befb6e20b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674739768, "uuid": "81912f31-d344-4daf-a2da-b8fe8a853b5d", "comment": "Malware payload (AgentTesla)", "value": "8401789ffdd3df0861daea339bee4f19e2037d19", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674739768, "uuid": "1061042d-b364-48df-b8d6-18cbcf112367", "comment": "Malware payload (AgentTesla)", "value": "927ab7b64ce2242648a4c2e3af51e3b184e839283cebe7e4c64db0123ec11f3d3d4739486b83f1d1e82993c5425d715c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674739768, "uuid": "9f57c55a-48f0-4018-b7f0-e822506931c5", "value": "T11FF4AE1023EC9E40F6BE1B7896B9505117B7BC827573E21D8ED130DE4EB2B04AB46B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674739768, "uuid": "c4206170-1062-4deb-a15c-f4f7cd72f820", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674739768, "uuid": "0fc0817c-a728-443e-9598-8835c90b3616", "value": "12288:GSkOvbnR8ey/ZhePXDgzFqIG+Olvi7Pb/K7PaQFbZ3Opm8qlCQOCgaugHLcxP7:4vekXGAPrK7DFbZ+DqlC/CgGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674739768, "uuid": "59334917-6171-4853-b16f-c910a812893e", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674739768, "uuid": "52b80369-0a56-4742-9ba2-c5b615169e18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674739768, "uuid": "8b9c2f5d-0f45-421b-a23e-95cc74d76b66", "value": "f8c6822fe70e93d3645d98fb2f096f47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f3262c2-9d5b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674725235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674725235, "uuid": "56e3ecaf-f79a-4be0-b2a6-107a0dc998e2", "comment": "Malware payload (AgentTesla)", "value": "fad30655a5eb1930aa39d310a8cd0fcd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674725235, "uuid": "4186c9df-282a-472a-9204-5ae207ba776f", "comment": "Malware payload (AgentTesla)", "value": "1879d9e00b506ab85d2192843c2ccbcc2e40ebad4f335bab3f6314c88c4cac6a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674725235, "uuid": "9b163d2f-6a38-4ade-afda-fadc469f2c23", "comment": "Malware payload (AgentTesla)", "value": "120fc94e3bf5dbc6cd16fbf050ac26631ee5b21d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674725235, "uuid": "03af84b1-043e-4f23-ae37-7090d09dada1", "comment": "Malware payload (AgentTesla)", "value": "6e1ac4d83292ee438f27642d0db76d01c86b365eb12f18d35703be0915f6be1b51618b06dab1ebdc842bc91615c9ca99", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674725235, "uuid": "4fbeeef4-e888-42ca-8b3c-b8eb0e8dce39", "value": "T1BB159C52196743E6ECF58C7832B8E52826A24CD6476E9C3EBC863D7A8CF334F4455B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674725235, "uuid": "760165d5-461c-4b56-8b58-3b19d6a3dff9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674725235, "uuid": "696c11df-ccf6-42f9-910b-0589da2372db", "value": "12288:fWS45nJrTmHkFrVoaqnkF2L7a6S7JiIdcf38KE9IBlCLuTWdVb:+S4PkkFr2sAjD8K9SiT+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674725235, "uuid": "65015896-179d-4b1b-b438-412722ecd0af", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674725235, "uuid": "dc85961c-30a0-4e04-8a34-7489ae323c62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674725235, "uuid": "a92d77ca-c872-40bd-9693-a4ca2cd47698", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc998e0-9d71-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674734631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674734631, "uuid": "56456b96-68e4-4eae-b15a-fcba317d268e", "comment": "Malware payload (Smoke Loader)", "value": "9f801ed88f1b5b1d9c5dd1f89fee1878", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674734631, "uuid": "0a1cab68-926a-47b9-b725-e6153cea5cb7", "comment": "Malware payload (Smoke Loader)", "value": "189912450fc1749959fbfbc130b7d0c6a91420c2595de005792e8b16d620bae7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674734631, "uuid": "3b74b483-0a82-4355-aa8e-cbaaabe90312", "comment": "Malware payload (Smoke Loader)", "value": "948cf4662f618656bbf9d2667704fe14fb9c89e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674734631, "uuid": "b5b9b531-b07e-44fc-955f-cef1598ab070", "comment": "Malware payload (Smoke Loader)", "value": "1451e20d1b12dd1bac2fa56239d125d19135b53c0a08d885da229682472fb47b88362a98b44bf0e5b1c2a0936165c04c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674734631, "uuid": "c60c940f-453c-4c85-b659-75acd54d466b", "value": "T15814E1127990D0F2F4A744740864EF90AEFBF83316DA588B7BD40ABE1F306D1976A356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674734631, "uuid": "68f0daed-f53d-4f47-b663-3a58eb131e0d", "value": "76acbc9b0e9b8516eed30a33559882bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674734631, "uuid": "3aac9030-4057-4005-927d-bf4f4dd4a45f", "value": "3072:fBN2WOWdgL2dw4h5Hkv6apQM7HmfT6rPCHWPltz0kequ:Z+L6w4wv6apQwiWrxlxX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674734631, "uuid": "ea067913-2710-4984-9350-3ab31de4d307", "value": 206336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674734631, "uuid": "d2c0ac5a-ea99-4d54-b533-c5052edeee28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674734631, "uuid": "1589d8c7-4f38-45eb-96a8-10eaaa4144ad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd3890e2-9d3e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1674712830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674712830, "uuid": "8101432c-2194-4641-a08f-05258701fcce", "comment": "Malware payload (Amadey)", "value": "e2ee20e2f0a8853cae1772d095543799", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674712830, "uuid": "2c2e5254-f311-4b71-b348-ad178632325a", "comment": "Malware payload (Amadey)", "value": "18f33da5db9ab9b2339158aaef6663ff97fa2994395211cf23626ffa7c1db9ae", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674712830, "uuid": "da471d18-689c-47e9-bbd2-7e1a6d0dd716", "comment": "Malware payload (Amadey)", "value": "185bcb81c13f88ae11c4d0424075fbc798cdbdec", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674712830, "uuid": "d860ee0b-e913-4638-b8fd-fb82a672e4c0", "comment": "Malware payload (Amadey)", "value": "fe97dcca3f48c2fd4a511b033560690972f3ea0ec5d6bfd81f6fe7dbd714ce37c93cd341764bdc12a11243a2e5def7aa", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674712830, "uuid": "6177e0c4-33fc-4ad0-8980-153fa2a99156", "value": "T19B15AE11FE4BC070D5D921B151BB27F24D7AA60A972145EBA7C02DB59E201F33A3FB29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674712830, "uuid": "f4746aa2-21d0-4acd-a0dd-01e05b14d1e1", "value": "bb5ecce76cda9939b2d9969f610cfd03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674712830, "uuid": "f4ae519d-7565-4e6d-b3a6-bf164a1c67a0", "value": "24576:fMxb+U4AFWNkTbWgp6d461tnfpgOH+Rwj5u:fYtaNbhZ+aj5u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674712830, "uuid": "fad1e85d-cbb9-4fc5-bfff-be540de1f5ba", "value": 881152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674712830, "uuid": "26e61067-f115-4eae-a713-84099f28e15a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674712830, "uuid": "7025aa48-4502-455d-b797-dfb26f1ba0da", "value": "cred.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10d2969c-9d50-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1674720272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720272, "uuid": "27b2b5d6-70f7-41d1-a6b5-869eb24eda00", "comment": "Malware payload (Loki)", "value": "4d7cd9c316e41723aa0608be0d4cabec", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720272, "uuid": "a73273e7-edcf-4bd0-bef1-2243e0a69150", "comment": "Malware payload (Loki)", "value": "18f5414d33aa5a3c6732944c7568747632f54409ead2b9204329b65dd5fb97d2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720272, "uuid": "b7f0f0ed-6b3a-4b5c-a4bf-9f17b630acb7", "comment": "Malware payload (Loki)", "value": "10ac8d63174c933b7a9fead4944ac970dbead588", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720272, "uuid": "59928a1f-e695-4409-abb3-7b901d8d8dce", "comment": "Malware payload (Loki)", "value": "5a3b5758b8d3cdd95200bdce8d87382c661857fdda5b55384ff02588700b8d34cd4b8442ee3a25efbfd009a4cfc5f69a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720272, "uuid": "d00aa56d-ff3b-4712-88d0-dbc5b41acc39", "value": "T16A228D3CD201F81AD112447DE641C3F2FB789193E622B92C301473AE0BA12D71BDE6AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720272, "uuid": "6587f708-b108-42f6-9372-035197eec6dc", "value": "192:ScIMmtP8ar5G/bfIdTOPVuSnamWBX8ex6y3KrN:SPXt4ATOPFnosMKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674720272, "uuid": "1cbcdb0c-0d22-46ed-8669-853e41a55bfa", "value": 10360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674720272, "uuid": "6360bb57-5b45-49fa-a877-03c6bd9ed2d6", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720272, "uuid": "133c5c5e-525a-4050-ba05-045eff28e93b", "value": "220123-inv-224.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "554852ef-9d65-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674729406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674729406, "uuid": "a0e7e7a7-98ad-4c48-b12e-9fd5fb7ffb12", "comment": "Malware payload (Smoke Loader)", "value": "44661e7514e3fb6d61d99dafa6aafc14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674729406, "uuid": "d98d6082-7f78-4bc8-b795-a161c7f7a58d", "comment": "Malware payload (Smoke Loader)", "value": "192e8f44d77bee481c1de971fe4868c9dd86ce1495b8a084b8b61652fad3fd55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674729406, "uuid": "71a368ef-46b5-4b99-af9b-007d2787189b", "comment": "Malware payload (Smoke Loader)", "value": "e510c33689108cb4c89c2ec7a4b551f4c2d6b7ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674729406, "uuid": "a26e8e9f-a721-4395-b96a-3515892fd149", "comment": "Malware payload (Smoke Loader)", "value": "7c95891bb57d3c402e0a31980ff553030fcc46b7919cc5260431c6ccb353d50a60a1dbedc1efc62527113f46c01d6afa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674729406, "uuid": "8dc79908-92a3-4e2f-bcc8-976eb834f04f", "value": "T10E14D0323690C033C99644B85865E7D56F7BF9335769888B7B680BAF5F302D0672A387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674729406, "uuid": "c399b7ea-4ae6-4739-9ab3-62c5284549a0", "value": "2fb86d3afd3014d2e2e15a2dd2f620c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674729406, "uuid": "84da1f40-7c1b-444c-9d8d-fc1a9e02dd9d", "value": "3072:7BN2o6CP1sLGZVUkTIf5fWjyzpAI10zYNY4ncGFiZDLR:lDsLiUaI5HAycYNY+cGF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674729406, "uuid": "491f7f33-eff3-4b71-b9ee-c50c37ece486", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674729406, "uuid": "a84cff3a-1eb7-4172-bddd-6daa915ee60f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674729406, "uuid": "ed19caa9-4a61-4eb6-a0e7-7727bdf8b336", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be41fcb-9d59-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1674724129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674724129, "uuid": "95bf805d-9608-4dc9-b6b9-142d61c086fb", "comment": "Malware payload (GuLoader)", "value": "d766332991289d0675135dbe53af6189", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674724129, "uuid": "d2aef436-bd65-48d8-874c-0d55ff9d2f5b", "comment": "Malware payload (GuLoader)", "value": "1969c4cc6d65b25044e03e5d998c23872fb0749c549cc2674cb8e9fbeca5bc23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674724129, "uuid": "a172dd77-4d3c-4ee1-b943-ee503429ec09", "comment": "Malware payload (GuLoader)", "value": "7903c5983326391c771814abd42bfd33d62e0aff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674724129, "uuid": "aee10fbf-d0fb-413c-9a0e-d521729ae4fd", "comment": "Malware payload (GuLoader)", "value": "124a05251481bb1a30983815f4b620ecb9407c9baf39a8124b9dddf26e4bc2feb6edbce2d12438f2984df17a1ebdaa79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674724129, "uuid": "0d85ebd0-9536-4fb0-ba7b-b678e30fe31e", "value": "T1A9C4F146B245E690C8514E39150B9B858EB3DD143E82EA9737A0BB3ECF7B3C27619347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674724129, "uuid": "7175498b-5fd7-4d68-b04b-bbf111b7e8db", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674724129, "uuid": "572782d4-00ba-4a92-a37d-46c8da5bcd58", "value": "12288:qBEf7xcXwxArx4l5Ycyp2SJ3SsVbvZWikHx/pHQmMZ:nflcX/AYc03SsJBW9RU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674724129, "uuid": "269e96a5-74d4-4401-abae-62ae13662488", "value": 582293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674724129, "uuid": "91bf87d6-76fd-43e9-897d-62eedc994597", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674724129, "uuid": "e175d8b5-0b03-44b7-99ff-885f3bd2df33", "value": "SC_00183285.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac1f972a-9dd1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674775937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775937, "uuid": "0bc7ea9e-18d2-4d93-8310-79ff4a77b680", "comment": "Malware payload", "value": "55ce7bedbb562c58727b47abef769f27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775937, "uuid": "068f73f7-9473-4fcd-9827-ab3246e20e9c", "comment": "Malware payload", "value": "197e3f3db38b7f1107617a67e3a6e048133a8daef8d60a2599054d48b5da5815", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775937, "uuid": "8c133e47-34b4-49eb-a0ed-1f7568f76e70", "comment": "Malware payload", "value": "d2625eca492c2b43189febfb16c1ecbda5be6fda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775937, "uuid": "6916c587-2e1c-4663-aaf9-08ea80a7a06f", "comment": "Malware payload", "value": "b5f728c70bf2b2d7044edc6ca4c0017440c940b6ead2fa90d9affbbd19fd6b1d15efd4e3a9787e4e9cc175ac927855f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775937, "uuid": "eea65926-3961-4dc5-ae10-6dbc8b9af24e", "value": "T18514D0323680C0B6C5E711305875EB513FBF653182A5859B7BA80AAE7F607E1A63D34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775937, "uuid": "10e3f09d-6874-4c75-b72c-999727f48646", "value": "8112aba4cbddc2cc0c799fee8b497e25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775937, "uuid": "64d20b13-cb25-43b2-b012-48c297d49bc9", "value": "6144:fkXLI6mK4larnFYgJi00N5wrEdleV8ZH:iBf4l2FpiV0kJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674775937, "uuid": "f8bcf2db-6a54-4938-a53e-804ef8aff570", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674775937, "uuid": "7e6635f6-18e8-4087-8eea-0dc1f11d2eb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775937, "uuid": "7d0def7f-6ff0-498f-85bd-84c62309f7f3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cdaf540-9dd2-11ed-88f6-42010a9c006e", "comment": "Malware payload (IcedID)", "timestamp": 1674776261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776261, "uuid": "52fb1a08-ba35-4c04-ac27-a8172dca976f", "comment": "Malware payload (IcedID)", "value": "0b7b3668c7c6a12cdc41c45dc5ecf28b", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776261, "uuid": "a13f833a-8246-4fc4-a08d-e547c1bb2375", "comment": "Malware payload (IcedID)", "value": "19c6557ae51b7322ad35b35cf4729fc98521a1b99b0f9bb14d39defe4e2a0e09", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776261, "uuid": "964bbb5d-e2c1-4933-989c-808dae685492", "comment": "Malware payload (IcedID)", "value": "282a20df6eff21b58c480b28db1d04ab632d3c25", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776261, "uuid": "91ab3a7b-e311-485f-ab08-c1e788037d0b", "comment": "Malware payload (IcedID)", "value": "bd8e64c4ab554c6ef222f689abc346ce3e94f887b3a93b72a4b66941783bcb28c1928c737f632131c5538b5c7a438131", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776261, "uuid": "56d1245a-5638-4711-9ca2-68aefa429c99", "value": "T13441E96413DD1A48C3769D797C7CB1044A77B8260E31C669068852C18F54728ED7A777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776261, "uuid": "ea9095c6-268b-4f80-9a66-5807b15e3961", "value": "12:8x4erbelFfhJiayf1ymfVSCUfefqbcPl+Uc7c3Prfq:8x9MfhJ61yZCpf8cPl+/Q/rf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674776261, "uuid": "c3a888a5-ad09-4ace-b8b2-3908494ce9e7", "value": 1978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674776261, "uuid": "68e9c104-4dd2-49f5-834f-da0a9c401cf4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776261, "uuid": "ee7b157f-b35e-4d7e-8285-de1af5735e29", "value": "Scan_01-20.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43fad98a-9d4d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674719069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719069, "uuid": "f6de0e24-20b8-40e4-b5d0-710b1c53b6c4", "comment": "Malware payload", "value": "92a1f9ae13b587aae6f6f71a65c798cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719069, "uuid": "3b9ab542-e35e-4039-8a4c-8dc74df266a7", "comment": "Malware payload", "value": "19ed8e453f1584a47c3a95566cfe08d76313577c53d90026af9998fef1dc6e27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719069, "uuid": "290cfa7a-5476-4691-8ef0-97a3737df456", "comment": "Malware payload", "value": "22991158f48e3f9641ba290a7b6bf3d018e5c742", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719069, "uuid": "63bae50a-4ee3-462c-a577-be5e83c6fdfa", "comment": "Malware payload", "value": "1d2a6b38e4a088fe4b5ee61926a3e820bd899624c558cf07b3dcb8f7af92b7b441d16e334e07c47c536c015f8cedbd6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719069, "uuid": "66df7637-98e5-4da4-bdd1-528c343f691c", "value": "T16B76331479CFC2F3D8CB143266A96687B5B497691F3290F753E80E2E9D6B218D341B38", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719069, "uuid": "bb844700-3adb-40f8-90f6-3101d209b862", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719069, "uuid": "cdfd04f3-0188-4cae-b8d1-d0951a398cf5", "value": "196608:91OtL8cNqNAi7Sn6WlVc0o+FeAYstXPlklO46NiphMRyUibqmrJ3TB:3OtL9N6fSnDlVcFC/YAsJM8LJ39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674719069, "uuid": "5e848f32-b187-4cfc-aca7-275cccf4d824", "value": 7627659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674719069, "uuid": "18d94ecc-8f04-4f02-a97f-1df8e995d33b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719069, "uuid": "33487631-a52a-47ac-8152-9363c1ec71a2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed43c1e-9dd3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674776640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776640, "uuid": "8a57677b-3f8b-48cf-978e-255c55a95a36", "comment": "Malware payload", "value": "702d43f37081ff47ec55f4a965ee892d", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776640, "uuid": "4c19e4d9-4b6f-494a-bfa5-e3c3ee553359", "comment": "Malware payload", "value": "1aa40f0bcf14d02d5aa184c70f2d9fb8e20532777a63094580abf1d79d2525e6", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776640, "uuid": "d6b2b838-0893-4fad-a73c-69e5099ee431", "comment": "Malware payload", "value": "fa82bc945eebf1b83b108bb5ebb3e3aa194a06fc", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776640, "uuid": "1381b86d-77ea-4cfa-b7e7-2650d627d582", "comment": "Malware payload", "value": "59dd7349516e7f2f1f917790325ae32000c298bc1ccb5edcdff52a015c08d351dce1accbd23a719085edd154d3250c86", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776640, "uuid": "87f89e4b-f42f-4a67-b1e4-9158f60b523a", "value": "T18441272803ED1944C3B78E36BC79E5118573BC251E32C169028412D94B24628ED3277A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776640, "uuid": "ecf75d8d-330a-4de3-b5bc-69826d1dde01", "value": "12:82X/MVcfMl/YrrGrhf1yUfVSCUfefqbcPl+Uc7c3Prfq:8pc7a1yHCpf8cPl+/Q/rf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674776640, "uuid": "abd7dc56-0586-4fae-8ac9-f1ba0a8eabd7", "value": 1972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674776640, "uuid": "63e32c18-37e7-45a7-99f0-83b1e2b48d14", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776640, "uuid": "62be87e5-5bff-4acf-9f41-d4b306e238e1", "value": "SCAN_DT6281.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b997d27d-9d3a-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674711106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674711106, "uuid": "e6150dcf-0369-42ec-bdc5-5d434bcf634f", "comment": "Malware payload (GCleaner)", "value": "7a64485bbd83a2944efc3b3a9bb1ae60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674711106, "uuid": "85e7f188-066b-42c7-b462-fae1e7e41231", "comment": "Malware payload (GCleaner)", "value": "1aed3d806d4eba159d88a3778b0ada1d38d38e86804d4d8272b6c605213d58e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674711106, "uuid": "61a284c9-6a02-4999-a429-860f49fd0839", "comment": "Malware payload (GCleaner)", "value": "fb49755b2eb5ccae3ca89fcbe894e0a77a81417c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674711106, "uuid": "f4cf7a36-203d-44e9-b962-7075d4b3f5df", "comment": "Malware payload (GCleaner)", "value": "ff42d6355b1957ac04f0dd124ce7eb87b67e1f367919a7004a5b53ebc97ab329d68c401405a9553ff34498b716489fd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674711106, "uuid": "5d76e928-55a1-4c64-9569-78f08d2e736c", "value": "T13A85234AB8D5897ED5BB8AFA35306080AF71FC8B603F251073D9178D2EB12712C75AD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674711106, "uuid": "f1030a18-92dc-4b47-8ebd-ad7a6c208eb2", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674711106, "uuid": "9b97c3e3-98ee-45e3-893e-48cff98b8899", "value": "49152:okug+bLyzEQKM4hkUxNv2cxBeyoxR7LoQtJCLLLCgv2MR:hug+PyEDM4+yp2ANoXLZJCTv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674711106, "uuid": "8447624b-d633-4908-904b-a4b2943fe296", "value": 1874581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674711106, "uuid": "b4fee467-9c6b-4f60-ac28-8ee2bb965074", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674711106, "uuid": "918674c7-1e0f-41bc-b865-1878146d9474", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36de1afb-9d62-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674728067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674728067, "uuid": "218b4b90-fb48-4d9e-9a95-edc1755cd36a", "comment": "Malware payload (Mirai)", "value": "9048122d74b6cbeefd480fbbe224732b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674728067, "uuid": "35f8c830-7037-4dc7-8cf6-38cacd37d55c", "comment": "Malware payload (Mirai)", "value": "1b75c1721f66c5c5ca5ffddc4e9bfa785620189b08319434a6cc69e5e564e078", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674728067, "uuid": "61f0d349-b32a-45d9-9eb3-a0cd6ba4e357", "comment": "Malware payload (Mirai)", "value": "f2c525bc28877d6018f12b235b91823454e0bd10", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674728067, "uuid": "675a9f8a-e442-4173-84b3-9531e56a3125", "comment": "Malware payload (Mirai)", "value": "46f5cfff45b7ac4cf1faf077821852085d161eb16e1d98a11b3cdb39cbacd130e5e951c9ee46c686c30e18db6712172f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674728067, "uuid": "8b0745d7-186f-45eb-a372-df055df6c733", "value": "T103D2E1E0CF1C7153C5B21A399976D88063CE19D879D53079F6242BAFABC5810B43DB95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674728067, "uuid": "808a5de2-d6e6-4ffa-a109-6006811e1c01", "value": "768:HwnMUX65b7pjE80LcTE/b4XDWVxBOt6a3UZa:HYMe61H0yE/bODWV7OUg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674728067, "uuid": "8a04fdc0-d749-4f97-976a-dea0f596e737", "value": 29496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674728067, "uuid": "b9ada576-2dc6-4587-8648-e5088449b491", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674728067, "uuid": "163325c6-f1e2-4c48-9ae9-21209a79ac14", "value": "9048122d74b6cbeefd480fbbe224732b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34991820-9d50-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674720332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720332, "uuid": "0427e8f2-cf5b-4e6b-9e5f-535f37f4d4de", "comment": "Malware payload", "value": "b1ac3e6b68f5bbb9fb1148f085889777", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720332, "uuid": "f6d38e75-1fa7-4cd3-9e9e-3c631396d790", "comment": "Malware payload", "value": "1bc0ad4c383d7f40c8555d9fd03cd6b93548b301d7f3f7f87fb98adc5685defa", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720332, "uuid": "e95aefb2-4e44-482c-9861-e27acaa0860d", "comment": "Malware payload", "value": "eafdbbdfefb00f5913e96afec7706b178eabcf04", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720332, "uuid": "6cb61f31-ecc3-4d85-b26a-80323c8b38d3", "comment": "Malware payload", "value": "06044c865a7234176287cd02806a176c62f3f7327a4ee4969155e0358691ec3c8bd625e46b3d80dbe0451a211f9a0c09", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720332, "uuid": "5dcc67ec-02a7-40cb-911c-543bb42c1a72", "value": "T15372C01DFEC1F6187BF248EE35A1726999F8060273EBD7855C583425813870B9AB26F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720332, "uuid": "a4520e81-28ba-4aa6-8f7b-36bed73b5236", "value": "384:SuLeGLF8miYYiiglAuJPqyxhu7PK70y3+NOnCMkXlb6SneY:wuapvQP+K7E4nC511nj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674720332, "uuid": "986627a3-0cfc-479b-8d48-2af81d5bf3fd", "value": 17178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674720332, "uuid": "4864c720-ec4c-4856-9335-7f9faa40af75", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720332, "uuid": "079e6be9-a161-4a7e-ad5c-4932821431cb", "value": "NEW INVOICE.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6653f35d-9d75-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674736307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674736307, "uuid": "e055c33c-c0bc-4a50-9145-f3ac98d40cdc", "comment": "Malware payload (GCleaner)", "value": "00ee0ae4829cea4310b66138a30b02e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674736307, "uuid": "1ce97874-590b-4374-9806-b06c13b07797", "comment": "Malware payload (GCleaner)", "value": "1d6ae9136609aebb1ab6bbca1194e50c51ec2eb95945683832dcd723d0e494bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674736307, "uuid": "caf21cb9-043f-4971-827e-612b0fd1f66d", "comment": "Malware payload (GCleaner)", "value": "a52d6844f0803bb8045746a5489c152183620b0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674736307, "uuid": "69d80be9-6c00-4382-9664-831dac3703ea", "comment": "Malware payload (GCleaner)", "value": "68b7c2d66c7af2389a0ed05e2ad715d275a333e89a18440f7ec5073be5110e4732d7aa1c5569a8f2c3787ddd0b53f73f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674736307, "uuid": "3c9a180e-9048-4443-843f-9e676bc9efdd", "value": "T10895234BA1E2E1BDCA254AF73E345680AF337CC6147D0029793913DD2FF55A069A23DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674736307, "uuid": "fc2d8812-dcc1-4562-bd9e-8d9e891d48de", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674736307, "uuid": "ea2ebd1e-ee32-42d8-9bc4-105a6ff43967", "value": "49152:okug+LyJ1NC45h8GIHaYmrNP7diyent+1uY4LCgv2MR:hug+c19HI63Ddj+0vwv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674736307, "uuid": "295408fd-8ebd-47b9-a521-bb364c451064", "value": 1892875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674736307, "uuid": "d59dfff3-8a9e-4f5e-aedd-66bcede98a93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674736307, "uuid": "e45ed48f-e6ad-4d76-9c6e-7397f069b942", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6805ab4f-9dcf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674774964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674774964, "uuid": "28cb85a3-72ac-4601-b198-996d5668babd", "comment": "Malware payload", "value": "ea7bae1a92859df6fd4980d6d762ca36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys Stealer", "colour": "#3F2EA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674774964, "uuid": "de8d7fb7-e04a-4e28-9630-bafd6da79111", "comment": "Malware payload", "value": "1d80b8ed824382630f9b336695f0c03670894b9a107951c74ccc5f287a3e37c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys Stealer", "colour": "#3F2EA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674774964, "uuid": "2fedbc2c-01cb-4d9f-8d90-b83acf2cf88f", "comment": "Malware payload", "value": "7a6fc386608f1318b7f303696a9a8d3aa42bc5fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys Stealer", "colour": "#3F2EA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674774964, "uuid": "637b3df9-d1e6-41b4-9a40-195d5b648c9f", "comment": "Malware payload", "value": "23982279df873b275512e692bb071751e1649d804817ae8fac4d0744073a252195140057f4825f86b62aca5ca98bb34f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys Stealer", "colour": "#3F2EA5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674774964, "uuid": "9c8653ea-5dde-4c32-98d3-7f475a8c402c", "value": "T1FD64E155B162C8F5FE884177A829CA6A3B7936760B34CAC3B73C158A7E602FD511F1C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674774964, "uuid": "90608fff-59ee-40c1-9cfb-c8855260a511", "value": "617157d4575ac8c2cf6618c9730ab986", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674774964, "uuid": "a268e266-ec83-43ad-b6fc-b28aaa30cddd", "value": "3072:eRH6Uf+yOUPxnxQDMcNPlBauCB6jBeQMYdGeMfuhYKTuE5yVRhOF7tE:eRH6o+yOQn0PlBZCBjPeMfoT5krP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674774964, "uuid": "9c780764-a81e-49e0-a560-408635c516d4", "value": 329253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674774964, "uuid": "eec2a5db-2d88-4a7d-aab3-3619cf29d086", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674774964, "uuid": "8b636551-d7b0-4924-97f0-e9c6500aee0f", "value": "Notteppad_SettuppX32iX64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c31603-9d4a-11ed-88f6-42010a9c006e", "comment": "Malware payload (PrivateLoader)", "timestamp": 1674717831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717831, "uuid": "d2a7c338-9ecd-4026-bde9-ecb9e2a633f0", "comment": "Malware payload (PrivateLoader)", "value": "e4285ed9f73fbe9b801a1b245ce7cdb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717831, "uuid": "dc186d65-d2c3-4d3c-ad63-262d0db99728", "comment": "Malware payload (PrivateLoader)", "value": "1db21ff2a1259b9aa3a5406db534ed160ba5b6a044b776507581155fb9bdd2e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717831, "uuid": "f04cae16-47dd-4502-a651-034bc3cc4de6", "comment": "Malware payload (PrivateLoader)", "value": "3a488206550062f8897d7413f5ac2895859fa882", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717831, "uuid": "94ff195b-1c6b-4265-b5e6-baeba8c53f41", "comment": "Malware payload (PrivateLoader)", "value": "575a48957a8516f352713061e6e5465a0d036b109880ad14604deed03c2374aebde841c6429cf9a25e5f2084dc8c9764", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717831, "uuid": "b086c9b7-2ed6-420e-b877-28ff42b918a6", "value": "T127F59D12E9809035F4A301F297BE1A7A5E7CBF31231054D7D3C8689C9B658E1BB36B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717831, "uuid": "3fc8b6d8-cc47-41fd-bfa6-c6a9b8c5b7e4", "value": "022b33510c2cc67820972fee66dd38d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717831, "uuid": "1c6a332d-1e9e-497d-b598-74681065da21", "value": "98304:AqNHddSy2xT3SJ0vsw4AHCJpV/82TJNK+gT9/69CzF07P7CbM5zD6sILTjblMS0u:rjV/pNK+gMwz+i4osI3jhMSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674717831, "uuid": "8d6adabe-e8ac-4d1b-8994-25a70c7194a9", "value": 3640320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674717831, "uuid": "833cf1ec-c1fe-4007-9cd6-1d0213010416", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717831, "uuid": "2be92475-f4b9-48e8-98bd-72b7a4e2eacd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a28ee9a9-9da8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674758312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674758312, "uuid": "bafa2e1e-86c4-4bbe-ad6a-7e467fcd15fe", "comment": "Malware payload (Smoke Loader)", "value": "3117c26b2e2305bd4e6003b587358a9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674758312, "uuid": "4396cf8f-0e1b-4edf-9ed5-568043a675bc", "comment": "Malware payload (Smoke Loader)", "value": "1dbb3f1461e1b02097665194596537bb0b948c33f0ff3dc10dc8cd3a92db324f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674758312, "uuid": "7bbf4019-19c6-4ac0-b1bb-34f315c973d6", "comment": "Malware payload (Smoke Loader)", "value": "b24b9892f5caaf7cfa0b13121d6973f231fa95cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674758312, "uuid": "686fe1bd-c28f-4e09-a239-a3f4f3c5cbdf", "comment": "Malware payload (Smoke Loader)", "value": "aeb288ec35ad0cdd780a066314cef312309929a3f9960f4adc5ab49fa9fdbff81ca07dddd2a21989675708b5cb748456", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674758312, "uuid": "d8869bf8-89e1-4b54-8c26-e3614942a10e", "value": "T1A614E0227480C432C06155345C69F7A22F7ABD321679998B7BE90A7E6FB03E0A377347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674758312, "uuid": "6f2ce9e0-2d6f-4468-b73d-a09d41d4ac66", "value": "4dfa6309511cb75d1093a1ac55cf0bae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674758312, "uuid": "103ec126-89ea-4e59-98e8-850cebf714c6", "value": "3072:7BN2o8eeD0LpoPTLrggMn8cR5K8/NqDRcQIfpfpJTJ6tNG:lK4Lpo7AgMn8cjqdctQk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674758312, "uuid": "c59c6f4a-2446-4db9-97be-c90e95d66382", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674758312, "uuid": "e1f96512-aa66-4496-b4c3-4a07557fb706", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674758312, "uuid": "3f277038-d3a3-4860-9af4-1b944ba3ac58", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca7f06a6-9d51-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674721013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674721013, "uuid": "b7d97a05-f71b-4fcc-968e-7933e729820a", "comment": "Malware payload (GCleaner)", "value": "81ba96988ccd8a13203ceccd4d7ab6f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674721013, "uuid": "c84252d2-287a-46e9-b080-50cc0272a291", "comment": "Malware payload (GCleaner)", "value": "1e05b818e665b6f8032fe2345a3902e39a1e271db0392fa79ec2dbbe3ce729f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674721013, "uuid": "9e46fa1e-613d-48c6-a4ac-a28328438a07", "comment": "Malware payload (GCleaner)", "value": "798699a3de570b8de9985735907dfeb32db2a7ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674721013, "uuid": "43309d3b-5266-4a24-8e49-3b29ea6cb2d0", "comment": "Malware payload (GCleaner)", "value": "050ca462d65d5887f1ec7d3337acef14864a608c9f2a2bdb9e8e9fc391daacb5c2a5ca578ef48f8d81f7d48c516af2ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674721013, "uuid": "cd0b7fe1-11bc-4522-b73f-e51568b8a926", "value": "T1908523467091C2BDDA63CAF62A31A2856F73FDCB10BE00943AD467CD5F736A01C606E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674721013, "uuid": "a3c3fe2d-644d-4371-8e30-1002b89a14b3", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674721013, "uuid": "b6db59b3-48c6-4914-8e11-cc7ede7168f9", "value": "49152:okug+0T7oy9+QCTgcuWF7o26AMXc8ixMYLCgv2MR:hug+0/loQCTFuWO26AQExMQv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674721013, "uuid": "2dc77e8a-8daf-4b2a-a0a3-c596dc6ddc2e", "value": 1861055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674721013, "uuid": "24c7b19f-4056-4dd2-a935-b38fda4dcb25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674721013, "uuid": "67f55a41-a335-4763-898c-4cc0d64b3a10", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d085d803-9d94-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674749799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674749799, "uuid": "f09e872b-a6d7-45de-bf3d-9bb047ffd85d", "comment": "Malware payload (GCleaner)", "value": "0bcf2e9979b9253c1586e1acc2b08ff3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674749799, "uuid": "1cc77f4f-5a78-4617-abd3-0aaef9dc84c4", "comment": "Malware payload (GCleaner)", "value": "1e2a0b1e41555f0855e803de4c338683bfe4f7a5cfa5c98f317ca0c81e4540f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674749799, "uuid": "52a9a7e3-6610-4689-b008-1a942daca3d4", "comment": "Malware payload (GCleaner)", "value": "4728bd5df25309c00eae1123b9be440f978bb3e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674749799, "uuid": "b3c75813-b717-4bfc-a9be-fdfab18adbd8", "comment": "Malware payload (GCleaner)", "value": "f7d9e1cfa1a0016bb6a6c7a4df4f00aa1615e7bcbb9e54097b78a3cf60d5e5adc61a005b366c01ee6ec9242a4a765609", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674749799, "uuid": "e7d65246-0b19-4cda-8140-75191bdb8597", "value": "T13B852349F156597EF5A20EB33E706281AF73FE4B243D051132A5278D2DFA27069B2BC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674749799, "uuid": "420fe755-1fe2-41dd-897a-01a042bfa565", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674749799, "uuid": "e221e8e6-aeea-4a90-b3da-66f69b57ec55", "value": "49152:okug+5NnSwH8UAHnUdVXuJtT9W1dISIUp1E4BGlLCgv2MR:hug+51SwcZHnUdVXctTM1dNgZv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674749799, "uuid": "163ec214-aa8e-49c2-a276-b6e15c5ff23a", "value": 1874559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674749799, "uuid": "129b118d-9f09-4171-bae3-aa0054174ea0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674749799, "uuid": "7cb77aa7-b822-4849-87fb-75033834a610", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e63762-9dd1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674775654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775654, "uuid": "5f7fc871-42f9-47f1-91bb-be1f4538c307", "comment": "Malware payload", "value": "065b654f986a5f68d164e93a9c7f5fba", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775654, "uuid": "e1f993cd-453c-472f-8488-18d6c751321e", "comment": "Malware payload", "value": "1e46734cc23a65d178a97c058d8aaa1202f93e960c7760b1d210498aad26460d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775654, "uuid": "419340e3-2faf-43d1-a814-8e5524cd3424", "comment": "Malware payload", "value": "c1cf758bed81fb825e8fc37072ccd8cbdd3aae3d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775654, "uuid": "e62e7cc1-7d32-4f94-b39e-a8288ad9567a", "comment": "Malware payload", "value": "cafdf39b39a2dd60bebd117fa0685fbb8842d25f78e2c673df8e6dab90edcc8417e7002f22d352fbb3c251d4889c92f5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775654, "uuid": "f28da47a-88e3-4eaf-94ed-3e01d076d2bd", "value": "T1D61255340491A9371DB323D039DA6B6F895B13FD52D2E903A2F97743A1D3E8BC94129E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775654, "uuid": "44e8e16a-c3ae-409f-bda5-5adb6ad08058", "value": "192:7b4OTecNIIQcm8UHZfyIaWdv61YTvr2E5uhl:7UOTecNIIwf/fvr4hl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674775654, "uuid": "3bd930cd-ae6b-4d9f-ba3b-642eea0e7ca8", "value": 9374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674775654, "uuid": "9f90fc6d-c2fb-4274-8753-9d87dbb16465", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775654, "uuid": "1c273ed0-2e81-4d8a-a3e5-494b3b2f0c45", "value": "descargas", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "068c75c5-9d9e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674753755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674753755, "uuid": "45b1e1e3-b3ca-4d62-930d-1f6406d9b9a2", "comment": "Malware payload", "value": "0315996e817b582806849b61acad8b90", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674753755, "uuid": "8b97b31e-ff9a-43bc-a199-d9c10a6f269d", "comment": "Malware payload", "value": "207a2cccea2713def3f435ec74d3b2ecc292246c84bf0786cdfa548a15df3673", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674753755, "uuid": "5c6b5cd4-dd7c-4d1b-84e6-726c886f46ac", "comment": "Malware payload", "value": "acdf5ee554514cd1ff179dfff8c1541cefd1697b", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674753755, "uuid": "56290372-d3b8-42b9-99fc-1d0502a122bf", "comment": "Malware payload", "value": "a4c30140d1857305697afcac49064bb5e1f63de28255e21c9ef22eb910d479fe714f3e6fbd66a2adc79e192c0d7ae191", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674753755, "uuid": "09acfde9-6c47-4111-b42c-cf0c8e3103df", "value": "T159F4332A1FB2B642977FF3302CD4562647F82E384C53F47DC9AA5408CA6E8545C8D9BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674753755, "uuid": "b9e3a05a-0f82-4a81-90fa-7775a6dadf77", "value": "12288:ohML7nvXmvq+yE9ntrc4vXDgoDHlSh7kfQKG3HSRaei7LLf2AG/7LHSsD0XM7spD:nmvqA9tzDgoDHUpkIKGyafXLfW7LxDQl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674753755, "uuid": "006bea37-434e-4828-a136-56a89a37ef9e", "value": 785801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674753755, "uuid": "4f5af3d3-8ceb-4cc4-ab87-09660f7be6a9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674753755, "uuid": "1cd2c587-4ea1-4ed2-ba80-aa6e719577c3", "value": "Documentos#0978.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48643c6b-9d78-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674737545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674737545, "uuid": "d14a5af3-b2d0-4626-9d33-20c1c88d5d58", "comment": "Malware payload", "value": "083e0870abb57368f24bf16290313a82", "object_relation": "md5", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674737545, "uuid": "595f3dc3-e787-46d1-8f7e-f7a9cf19a1cf", "comment": "Malware payload", "value": "208e85cc66f2ee482dce1c6ee5f1ea45592e9fc9980c1b04b5157975d127dcf1", "object_relation": "sha256", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674737545, "uuid": "0443e4a9-f8f6-432d-801d-f515b04215eb", "comment": "Malware payload", "value": "d64e72eea8fef9266b707c2a51d541f6b011eb2a", "object_relation": "sha1", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674737545, "uuid": "b1a72641-0c55-4938-8cbd-3bb0e40e029c", "comment": "Malware payload", "value": "108072f46e0045dd52e42f6a324350fde13c587d1e524089ad9efab46850b8e6040afae3478ddb1a39026c2b9c4f686a", "object_relation": "sha3-384", "Tag": [ { "name": "Alien", "colour": "#0FC4E9", "exportable": true, "hide_tag": false }, { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banking", "colour": "#5A2204", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674737545, "uuid": "2d661c8f-42bc-45b9-aaf9-93ec479b15c3", "value": "T134154CB277DE7646D909737AA84F1A484F6BC0301E83B6D944CB4AD4A40F4CB6AD0D9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674737545, "uuid": "5d52d7b1-f22b-40ec-8da9-ed34e9b86d59", "value": "12288:AUXSwi+XKOMpeXff3caF9hvyStNjjc/aQZ5MmHJ4RqZJ6yzwvf94Je:AeSMaOMeXMaQyNjS5lpD76z1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674737545, "uuid": "856ab532-9222-4d9a-967f-60192a599163", "value": 934372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674737545, "uuid": "124cc835-b957-4c97-a5f1-6fc88ca24af5", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674737545, "uuid": "41f3799b-504a-4365-b93e-9bc8746660ea", "value": "208e85cc66f2ee482dce1c6ee5f1ea45592e9fc9980c1b04b5157975d127dcf1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b21ff7f7-9d38-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674710235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674710235, "uuid": "2da6ec68-3dc4-47fc-8712-6abbcdc6c39e", "comment": "Malware payload (Smoke Loader)", "value": "4bb971b121f29d7aa7b0c1bec69f47d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674710235, "uuid": "4b7db623-a05b-4023-82b5-e232a471849d", "comment": "Malware payload (Smoke Loader)", "value": "212f9a9f31056b03d1ed46f605e40abaa2044494fde94a96779dcc49a8f8748a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674710235, "uuid": "725e79a6-5d73-4978-86c4-4f2edc5359ab", "comment": "Malware payload (Smoke Loader)", "value": "057441411ebaa0ee95d4d5450fd5d5e0fc4849d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674710235, "uuid": "36c76193-5618-4954-8d8b-a095df2f12e5", "comment": "Malware payload (Smoke Loader)", "value": "efc1585479c444420c59c13a343fa059ca5bc473243839aabbee52f61aef8397324d736425027117c9421882bc1b97c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674710235, "uuid": "4e4320bd-adad-4b01-806b-e057aaf2d502", "value": "T14C64BF1275D1B890F9164A36CD3AFBD4392DB8D28F3C73573AC46A2F28722A1D52721D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674710235, "uuid": "0d4b00de-9778-427d-9a2f-f19fdd9f3855", "value": "e5f35c047e0fdde323b83e51e689dfb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674710235, "uuid": "bca035a8-9055-4363-acd9-204561b9e1f2", "value": "6144:5WLeNNkpmRnX7DC1SK5pBBY0+MOKXPMUT:5W0N4qX7DYd5pgWjMUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674710235, "uuid": "f1868e73-245d-49c4-a1f6-3248fb46da74", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674710235, "uuid": "5338d30c-fd92-4ede-b054-f1cd13768005", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674710235, "uuid": "6e347eca-0513-4d53-912c-648d1af46496", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66cf60d4-9d50-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674720416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720416, "uuid": "a574616f-9dbc-43a8-ab20-2b4e2285817c", "comment": "Malware payload (AgentTesla)", "value": "b5e43962614a38a4c2f658e6fa655763", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720416, "uuid": "73f59eea-a5cc-4f7b-8ef6-bb5be7afc423", "comment": "Malware payload (AgentTesla)", "value": "2171a810f63c6f2fe3417e657b83644feccbc2c79c3ff804050e8970cc98713f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720416, "uuid": "4e3991bc-220c-4106-89b3-2fcbf11d074d", "comment": "Malware payload (AgentTesla)", "value": "558388321cb0f2ea7fb39f97c31296789bdb84ed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720416, "uuid": "64594826-88b9-418a-bef1-40825f935b66", "comment": "Malware payload (AgentTesla)", "value": "fcc0e49b8ab19e784fd90c53ffc317f257adc124c761cbafd0d733c36200cd0e3604386468ff60519b1303285619aec5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720416, "uuid": "b0b9725b-fea1-43d1-8599-275b7cb5206c", "value": "T106442217C56E208D2877A43FAAE6E1434B0AF55340DCE34EDABFB2B90074E4799C5B16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720416, "uuid": "a2d56869-dfa8-4788-8e96-efe39cdc55be", "value": "6144:1Sttu/r9C0I8RcqDv7zcPl0z5QPKsP797aQmgt:Qto/r9/IAPzcK+LTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674720416, "uuid": "2a491509-23b2-4395-9e69-b843869fc7de", "value": 257854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674720416, "uuid": "d036a25c-4850-4ca2-8a82-81b876fedc13", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720416, "uuid": "b2847f1c-4c16-4f49-89b0-8983143f5b03", "value": "UPDATTED S O A.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30dee784-9dc1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674768859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674768859, "uuid": "233938ef-0790-4c3f-aafd-e567c56f1c1a", "comment": "Malware payload", "value": "48513cdfcc69d085396164d02849300d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674768859, "uuid": "4cfad740-b99f-4c71-a40f-ba5a3b1f28be", "comment": "Malware payload", "value": "2219f5188587898fbda643385ed89dd3f3196f415c35286e7b37a41b016793ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674768859, "uuid": "f1f74c97-34d7-4608-93fb-6ab69ece080a", "comment": "Malware payload", "value": "7a4400536896e1e9e3265620458cfb36ef12546d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674768859, "uuid": "f4baf2c7-da6c-4cd0-b2fd-510739fd79f0", "comment": "Malware payload", "value": "00f1a3b31719092e111235aa15f42febff6ef2cfff24ab3615d718bdab626721e29c66a162deed278f63e28a317e6c03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674768859, "uuid": "b1c8b60a-e221-4421-953f-27e567d71b54", "value": "T18414D1323690C072C6AB15305864FBA12F7A79714760899B7BA80BBE5F707D0A77634F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674768859, "uuid": "bed71726-6fbb-48ca-a83e-96bc14602cc0", "value": "8112aba4cbddc2cc0c799fee8b497e25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674768859, "uuid": "af76fe3f-2405-468b-bbf3-8d9dbd0158e3", "value": "3072:81BN3GYHwsVWTLnG0Pe5NuSCvCaJbv79IUhc2cEkr4m3OH:a6TLnG0POuSq7SURM3OH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674768859, "uuid": "5c59e2e7-f61d-4806-a68c-21e230b8dbb8", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674768859, "uuid": "bc69381f-2069-4145-800c-8072a0b15b0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674768859, "uuid": "548e3099-31dc-43c9-be2d-d8f38ce72d9b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b932b9-9d6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674732648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674732648, "uuid": "de21d32c-845d-4b89-89ee-5a4bde77d668", "comment": "Malware payload (Smoke Loader)", "value": "371b0f489cf72aca56a5768dd663998b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674732648, "uuid": "8c0afea7-f13e-4095-8ba6-f95aab2c40f1", "comment": "Malware payload (Smoke Loader)", "value": "229be580e17464a0207c34cfe245b7a25630f733f89f0471fe5bd917ef4bf864", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674732648, "uuid": "fef5028e-f98a-4a68-a42a-085748f376b4", "comment": "Malware payload (Smoke Loader)", "value": "d63d89357008c4db459c70cec5d8d829b750b8aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674732648, "uuid": "695d7745-84f3-42f2-b610-ced514614866", "comment": "Malware payload (Smoke Loader)", "value": "b68821bd11a7ea2f4badb9d17226f86e9f1345a0185aa4c9e7a1c8d032e2ef1d9f4446ef8b36f655b106e91b2ac1dbf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674732648, "uuid": "567b6842-d03a-4094-b395-1fb5fa7a6862", "value": "T15D14E0227991D072C02799744830E7D46F7AF97316B8488B77981EEE5FF06C06B6A3C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674732648, "uuid": "90adfd36-4ed8-46ec-869d-cfcbc42b5845", "value": "76acbc9b0e9b8516eed30a33559882bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674732648, "uuid": "e2136f87-1fdb-4d6a-9259-4dee9ed0dc8f", "value": "3072:EBN2uonqOLWvX7Vuj5MjrCBpg+UH5J9MaAwLl/dBtRrmtIq:ceLQX7VueP4S+EHtAwLhtk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674732648, "uuid": "612da197-32e6-4c8b-af74-f98cf297ba8d", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674732648, "uuid": "a83f6a1a-fa4a-42f0-a7a3-eea95992ee5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674732648, "uuid": "86e58e86-c856-4300-a942-6b7208a66db7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bafcae0-9d4e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1674719404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719404, "uuid": "44cd9c47-a3c2-4dc5-b740-ea8d35843c4d", "comment": "Malware payload (RemcosRAT)", "value": "f3d8f3977caf5bb7277a09068c3aca63", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719404, "uuid": "65a01523-5975-41f5-a8b0-783ccd0ad77b", "comment": "Malware payload (RemcosRAT)", "value": "23dd65161a7f297125c40f5c9e12d9c0bc9c314021a74de9d47ec8bc13146b18", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719404, "uuid": "fcf48ef4-b23f-4b0c-9db7-00f4395657c6", "comment": "Malware payload (RemcosRAT)", "value": "ffea1fba751305463c6aed080b01c0638b3e11d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719404, "uuid": "824dabcd-1a89-426c-94bd-5a28e29a9cc6", "comment": "Malware payload (RemcosRAT)", "value": "054a66bbaf98c483b5c8cf94a88b5d235c44c1bd40b43cfbf56c021fb2c07aad373e4114a6b668e34461870dbf9e8610", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719404, "uuid": "ccdd964f-eac8-43fa-b77f-a8c1211db15d", "value": "T103C580203EFA502AF1B3EF655FE47596DA6FF6633B03A45E1051038A0A23E41DDD163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719404, "uuid": "ae593ec7-91fb-4b04-8143-0f348cca2789", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719404, "uuid": "bd0eb41b-4c98-49a2-ad77-35a9c4d12510", "value": "24576:2UDtXTeU/EpjoDpvOykLPaEbOEh5wwsUHoeDAYAgLpgO9W7vO4vx8iyGU1J1:ZEpCkTF7OIVAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674719404, "uuid": "8404c9a0-7a38-43dd-86d0-154eb6ce96a8", "value": 2594816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674719404, "uuid": "99b1b860-8bc2-41bd-977e-8b64a41796ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719404, "uuid": "52fb2308-d463-419c-9655-3bb404e3ba51", "value": "f3d8f3977caf5bb7277a09068c3aca63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ac23ea7-9d9e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674753762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674753762, "uuid": "18d42447-650a-40ae-9a2e-56a29b29b72b", "comment": "Malware payload (AgentTesla)", "value": "78835477a75733fe79bd6c6712ba0c4e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674753762, "uuid": "2521f5da-950c-4782-8d00-1a456bad0393", "comment": "Malware payload (AgentTesla)", "value": "241a47ea1f456f83ff5b4d6a26e7faccdfe0f39f1a269ece140437d1aac80f89", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674753762, "uuid": "6399b5fa-5e36-4e10-92fc-30820874d237", "comment": "Malware payload (AgentTesla)", "value": "e8c939ae63effc34102169c6e448deb6914cf655", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674753762, "uuid": "57609476-ea33-47a1-ac8a-4af2ec8e4533", "comment": "Malware payload (AgentTesla)", "value": "b23c25672e55fccbec739e356021d3837216c8a27f8fa7152994a9850951566432209df44e3b187656b69a0148625639", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674753762, "uuid": "486cb0b6-3eeb-4ca1-909d-946badf04b23", "value": "T1D3244B7435EA295160E6F9D70EDBF9A647B7F3E0013A8E3544DC0A0997DE850E8823F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674753762, "uuid": "59d33a62-5111-4ca7-8ea0-8ded07720323", "value": "96:CEus1VkB3wq888880188888g88888AXX88888A888886Bzszm88888+88888+88N:CEnVkB3wqFXtBQzllzTJQTf5WA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674753762, "uuid": "a43b21da-090c-4f55-a966-c643b95a930d", "value": 225750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674753762, "uuid": "173cf65f-2818-4bf3-bff2-412d1dc75e41", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674753762, "uuid": "6f11cd8a-3f40-456e-832b-a79c0331f244", "value": "origeeendrVBS.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec83c038-9d75-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1674736532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674736532, "uuid": "870d2309-d700-4bf2-bdb4-ca2b829b9769", "comment": "Malware payload (Loki)", "value": "9ea56e5bea580a497664cb61b8960d17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674736532, "uuid": "1572664a-1dfa-469a-a165-2bdf40c04e88", "comment": "Malware payload (Loki)", "value": "25a16ecd58f1e4d4519cee4cd646de26bec0a672e3c7fd1c344835451ff5e9b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674736532, "uuid": "2b0e3cde-3eac-4344-9f9f-cb115a3515d5", "comment": "Malware payload (Loki)", "value": "f3ecc2c727be56dc7d8e441cc20124824bddd46c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674736532, "uuid": "0203c368-68fe-448f-a66f-3d8df2670ad2", "comment": "Malware payload (Loki)", "value": "602d970e9e41327dc5061768517e5a7f7b6ee98ff239ae632044a775552121ece9c877b5a0ce120b569144331d055b57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674736532, "uuid": "2f87e0b4-7e11-4992-8271-094c9f1afd16", "value": "T1E0B479E2A5D4FEC7D6BB21352EE136200B239B19285552418FDC760F3B225DE3782B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674736532, "uuid": "52cdb4a1-34d3-44b8-b72b-bad8dea9744d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674736532, "uuid": "a0bc93dd-6388-4ec3-b444-643e9bbe4822", "value": "12288:b5kA4p6X3i5/i6a6GBCL2XzOVIk+FaH1X:b50n/LGUL2XzOuk+W5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674736532, "uuid": "21df4c63-c107-48d4-a3fe-5331e614e86a", "value": 519680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674736532, "uuid": "50f21b63-134c-45c7-b7a6-84b4a163806a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674736532, "uuid": "3871fbfd-b42c-449c-9e9a-79e3796bbd30", "value": "????? ?? ???????(P.O6044282)???-??????????.ex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5136e9a4-9d7a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674738419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738419, "uuid": "9701a5e3-9a1b-4799-b1cc-ed26a25e03d0", "comment": "Malware payload (AgentTesla)", "value": "905cfaab6c8926a60c0c0daa26ab496b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738419, "uuid": "5b2e24a5-0fc8-4a36-887b-eb404ec835d4", "comment": "Malware payload (AgentTesla)", "value": "268d6278d88b2f5f4ff3f0d071ad0545d12015d4e3c7d57a108c161ccdba2465", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738419, "uuid": "52b1a8dd-7fef-43e0-ad14-015273d65477", "comment": "Malware payload (AgentTesla)", "value": "63b82ae26127eee45dc8c47ff73b42c0495f0181", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738419, "uuid": "2d1e8c83-4dbc-4d04-8f2a-56945d9ecb23", "comment": "Malware payload (AgentTesla)", "value": "b7ac5c5f6ada740db297f25215f8c9818a2053e3f59e883e753219de7a5c20b307b35cff9667c9d4ff1d3b4aacad624f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738419, "uuid": "64813ba7-d935-4ff3-af2d-f02d7ef44ec0", "value": "T1A115AE1423E9CF82F9BD4776C274525063F37866A432D7896EE1A0FE1DB3B104A42B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738419, "uuid": "c3a97938-b191-4f78-9c64-afa9c28f5f98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738419, "uuid": "ac8c7a6e-5d65-4fa9-9963-b7acd1ac89b1", "value": "12288:WtG7vV5zxPCRg6a/pW5XDpFqIGj4nqU4/WD1XtkHSJhQ8Ftf/S4WJrgsI00pl:aRGMqVW5Htf/d+rgqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674738419, "uuid": "ef49c24a-89f1-450a-ba66-062584bc325a", "value": 914432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674738419, "uuid": "c746e8cd-62d6-4276-8541-6646f973f464", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738419, "uuid": "06e7b63c-1f5c-462c-8eee-3d21920af530", "value": "TT Swift ($ 17,506.50) 19.01.23_jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d6b58dd-9d4d-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674719139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719139, "uuid": "5b87fd4c-1640-4503-9a23-09cb1d774797", "comment": "Malware payload (GCleaner)", "value": "8f8390a3d9d2ef97cde8da69c76b50b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719139, "uuid": "23466c3a-d0d6-42df-8ba9-c82bce088e4d", "comment": "Malware payload (GCleaner)", "value": "27d8b32e33b49bd8f9f63177bb09a703acfb84870b492ec2fa7d6e2880dfe513", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719139, "uuid": "dc44fc69-58a6-4339-9081-60886c3a5460", "comment": "Malware payload (GCleaner)", "value": "ae8b3c078b0b5dedf4d9f2cd3a8a31a8a95ac46e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719139, "uuid": "12928ec5-7f04-4969-a1f5-7b70e65b2751", "comment": "Malware payload (GCleaner)", "value": "f4d9b508b8ba0abe20cfb81f69bbe8ef25b28df5c5967b42bc40fd7c198963bf3fad031bcb573aad3c21b1927f261cfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719139, "uuid": "18b383e8-5bd0-4d55-b81a-c6f1f370fa3e", "value": "T1FC95234B6084DABDD52282F71F7419046F33BC87747D1011362D639F1EBAA306AB6B6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719139, "uuid": "0b3a5c8c-3621-4d33-8231-fbe77645b947", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719139, "uuid": "9a94ef17-dcbd-4fd8-9584-7c3285e48cf0", "value": "49152:okug+y1E+i1XcRGrx4Us3ra640HjZJM5kxZ+2ELCgv2MR:hug+yCocx4UWjZE20v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674719139, "uuid": "396c7119-bf86-4c69-aa69-28339987ebff", "value": 1909595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674719139, "uuid": "e169e5b7-3407-4a11-a91f-d4ffa80403c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719139, "uuid": "1b40c4f9-07a3-4b41-a549-6892587f2d64", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65ee2714-9d78-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674737595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674737595, "uuid": "1e39bb30-edfc-45ad-bc73-483d7b351e6c", "comment": "Malware payload (AgentTesla)", "value": "a04bcb74de8c74903c464b65ac59fed9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674737595, "uuid": "c9359f3d-7776-4079-93ea-e782364d11e3", "comment": "Malware payload (AgentTesla)", "value": "28077feabc25e755cd22379ce5ff757c9913aee54da57f1530a4a99b594afb77", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674737595, "uuid": "fdbd5f09-7f52-4bf4-a22c-7a004dcdac98", "comment": "Malware payload (AgentTesla)", "value": "1c47995e8179250da905bc54d69d2e2e88491369", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674737595, "uuid": "b0e2028c-23fb-44a1-a6cf-8cde3ffc4345", "comment": "Malware payload (AgentTesla)", "value": "bef29251bed331d6df1876bcbb535e88df893fba413a1c195a09f1111079df9abf1dc06fbe914b3f75f1e465d886f1c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674737595, "uuid": "238d5ccd-d7fe-4a10-96b9-1d9531d25fda", "value": "T1D505373D1D7793F2D434F97296E1A4A0FA9F4492B367C9A9C9D61BC04F022826DCE12D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674737595, "uuid": "81459fec-b51c-4982-8b10-a033fd29fc2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674737595, "uuid": "9122fdbf-b545-47fb-a8f2-0754068e2942", "value": "24576:OT/f7T8irmdjXHNOrAe/Iueolr6btf07RTYKP93e8F:QFlr6bl01MA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674737595, "uuid": "2279b1c1-c427-4356-a850-b7ee1d0b4704", "value": 795648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674737595, "uuid": "6a0cd53c-9f4a-4175-b794-837068a9c066", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674737595, "uuid": "70865381-6cde-4a07-8246-1a46a4bb452d", "value": "new order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "293e9a87-9d9a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674752096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752096, "uuid": "23dfc401-54ee-43f0-9437-4696998cdcfd", "comment": "Malware payload", "value": "2552f7a77b1834ebc2c62e2f9432e54c", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752096, "uuid": "8bffa6dd-a81e-4798-9582-5fca3d30b575", "comment": "Malware payload", "value": "28deee1dd68bfd6a75ca2794fcae30fa3d349afa4e4bbf5bf8382eefc10a81cf", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752096, "uuid": "5f917ee5-95a0-4c64-83eb-d95e2d54f1e2", "comment": "Malware payload", "value": "eedee537ce4bcc252358a1e1a8687b2e50ed19f8", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752096, "uuid": "47a09887-235c-474e-85a3-218c90f89cb8", "comment": "Malware payload", "value": "88fd90d03e3ad2a0c7005be37eb87c155a6f29a977e844458aa96e1979524f21d78a7dae7fc078767d1f30093710802f", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752096, "uuid": "696e6eb0-eafa-4327-b686-2911f58cf5e3", "value": "T19F31100B6F1B962544773A7564A3E949DCDD67037B3B2A1ABE08C4845F3064E8DC06DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752096, "uuid": "ac637265-2574-4ab0-a613-9da4a5b22a3d", "value": "48:oR3qMADnfzOiSBZndHD1OcLrkhHkw2khHSw4uAYaPC7:kZsybF0ckRikNSwvAYa2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674752096, "uuid": "148314c9-40a5-4f8b-805f-67461ce63251", "value": 1696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674752096, "uuid": "2b46682a-54f3-406f-be80-e0c8a841ac00", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752096, "uuid": "a70e32dc-b1f5-41ad-b19f-948f7b00837c", "value": "temp_eno.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3484f930-9db7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674764570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674764570, "uuid": "3066a55d-61a5-4a0b-b4af-ab649331dc6e", "comment": "Malware payload", "value": "008e8c42b4e7fc06d00955818e737381", "object_relation": "md5", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "bomes.ru", "colour": "#3AD5F4", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674764570, "uuid": "6c41a433-0a23-4a3d-82d3-3bc0d8910046", "comment": "Malware payload", "value": "2a152cf27b31d78029faee51bb1a19640cf0a1c8ba0c91af74659c1aace466fe", "object_relation": "sha256", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "bomes.ru", "colour": "#3AD5F4", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674764570, "uuid": "e245db1b-53a9-491c-bffb-cb39632636dc", "comment": "Malware payload", "value": "477f0e569b64e0ea8a55f7d285f2270acc87fb60", "object_relation": "sha1", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "bomes.ru", "colour": "#3AD5F4", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674764570, "uuid": "84c862ca-bda8-4ec8-b5fb-b8829eaa1c96", "comment": "Malware payload", "value": "2934b1edec1417d93188b94a43425022b18a72662901d4f4538d2e97fb7e26527384360657248d13e2d29474cbe718dc", "object_relation": "sha3-384", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "bomes.ru", "colour": "#3AD5F4", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674764570, "uuid": "8c3d70dc-6617-40a2-82b8-f3d507c391cf", "value": "T1D5237E6EAD629341101D57B03F920DAA0E87418F59C46EEF792D8D9B1F00BB25C9B8DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674764570, "uuid": "a41be166-7281-44ba-9919-382921be41de", "value": "768:UefBsJnFKa1vM90+Ryh8OnWqM19YQnvgy5:UefBsZFKIL+Yh3WB19Ysvgy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674764570, "uuid": "184c0098-dd3b-474a-a9d0-2c4726057aa4", "value": 48906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674764570, "uuid": "00269b95-177f-4a9b-9563-408921e79ee6", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674764570, "uuid": "5eb66015-8dfb-490d-880e-329d656f2921", "value": "Confirmar Transferencia lista.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75aec74f-9d78-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674737621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674737621, "uuid": "3a82e767-c632-4dc0-afd4-4de5d0622b66", "comment": "Malware payload (Smoke Loader)", "value": "226ad365ba85e59c7ddfdb502249df57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674737621, "uuid": "94296967-52c4-4968-b1da-705e791fae05", "comment": "Malware payload (Smoke Loader)", "value": "2a43756ae3b03104d427e0a4d26e7ac2f93a030954cbeacbf0ad5b752efe1e20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674737621, "uuid": "1b5e9305-0ed5-46f3-92a5-9d4103e2eece", "comment": "Malware payload (Smoke Loader)", "value": "3eeaa134648afb07e33ff79b5cf7485fc2f0e68f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674737621, "uuid": "2679cac1-2908-4d72-b638-eea33bc67a9d", "comment": "Malware payload (Smoke Loader)", "value": "227686f5774c989048e6c42792cd07574756be7ff93d8e3417b7c29169cfb3751addaedf990325740ca7f66d8c3f64b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674737621, "uuid": "284ed291-9bfe-4e53-9b96-a1076b67b790", "value": "T1FA14E03276D0C073C5AB44B09824DB943FBBF43356A6998B77681BAE0F702D11766B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674737621, "uuid": "6f419765-279c-4405-89da-ab9d9ee77402", "value": "76acbc9b0e9b8516eed30a33559882bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674737621, "uuid": "7c9ca725-146b-4ed8-974d-c36f431260d3", "value": "3072:ZBN2S//AxwL4ERuk50pya4rn6BO1Yi0lGMmKR90SpGB6sY7q:fLLZRuVpyagsUYQMmKEB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674737621, "uuid": "2829100c-9321-4beb-92fe-47716f46429f", "value": 206336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674737621, "uuid": "d10d651a-f67c-4537-a89b-7bc5f079dd31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674737621, "uuid": "c9bff17b-e805-4a55-baec-eb36712ba051", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0189426a-9d7f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674740433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740433, "uuid": "d2193ab5-c31b-48bc-b1c8-a87f80e99b35", "comment": "Malware payload (Formbook)", "value": "0bcd71fe183224f44846a4d9607d3d4a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740433, "uuid": "481d3077-7d80-493f-b6da-454cdc384cf9", "comment": "Malware payload (Formbook)", "value": "2a5d4d93f93cef9dda409b56f1d08b248a7dd63b49a2e51e40e0af6868be0c83", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740433, "uuid": "d67667f7-90da-47ee-9f7b-6bdea2214d3d", "comment": "Malware payload (Formbook)", "value": "d794213e0e1d8d86429d763d73b3b897db0cb759", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740433, "uuid": "064cfaba-700c-4c6f-b547-6423790945a0", "comment": "Malware payload (Formbook)", "value": "89e202ca5f3bd858f69b7518955057c0088641dcdb4f2ed6da728bd16d0f5ec96a8868576d5f1827731e54104dc7e8b8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740433, "uuid": "6edc8b46-12fd-4f27-aa28-81e1a695a82f", "value": "T116442365F52C7002A28C124E7D85DF9DAF39DDA777A00B4AEEA87390E13D70E4640B6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740433, "uuid": "d777dd17-57fb-4fde-ab64-7f484a63afd2", "value": "6144:MErsrkrGyJXzDqXNnVAptUaU5F249Iwpd3pbCNe:MErxGUPWNnctG/249Nd30Ne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674740433, "uuid": "41c44267-7e42-4d53-868e-852114471bfa", "value": 267627, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674740433, "uuid": "184bc1ef-3773-467e-9288-a0ff5f009b01", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740433, "uuid": "11d97b67-274e-49f8-8faa-307f40f19afc", "value": "U\u00c7AK \u0130THALAT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32dff600-9d26-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674702290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674702290, "uuid": "8cee4fcb-e744-4e2e-9249-480476d9fa35", "comment": "Malware payload", "value": "94848862978ad041e7eeb158fa857c21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674702290, "uuid": "3e22fef4-36d9-4cfc-922a-f0d49b11696d", "comment": "Malware payload", "value": "2a87b23a3e08d2d1278f8b987e548eeda8cfb3f957963f606cfed126261d05d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674702290, "uuid": "2100068e-126e-4f22-a0fc-3576ab14cd54", "comment": "Malware payload", "value": "2f86fe101e336a6da3e66db7ca4c658b79952171", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674702290, "uuid": "c552a6ca-41f3-43b9-aade-396f794b694a", "comment": "Malware payload", "value": "432e141061dfb22746f8d808c3370a2fceec8eaebd1cfbea9165a27ce319a9e1bf25a4f7434d4fb05a2f2a732317f35c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674702290, "uuid": "7799f366-59e2-41ab-9dac-4b925c4ca0a0", "value": "T125763360FCE5CAB9C6A118318F306ED6BAF292C3473A5963EF5446CE1E74D0CA719325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674702290, "uuid": "b6f5ba90-573d-40d4-8418-dd001d8165be", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674702290, "uuid": "cae19dfc-2eda-4e99-9dfa-f8caedcfaa2d", "value": "196608:91ORm4LoWdH42vNI8RpSMipj2KwNFwEmUs6Xay:3OtoWdH42vNbR8GXFZmUs6X7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674702290, "uuid": "a54365c2-0238-4281-ad8a-2fa2a33c3d28", "value": 7596172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674702290, "uuid": "b7c5b2cb-7325-450c-8862-d7539315e6a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674702290, "uuid": "e85bc2a6-265c-4394-a23d-cf829b13d7af", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c5588e-9dae-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1674760629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674760629, "uuid": "f18f47e2-94b8-4416-a5b4-d2744c286ebb", "comment": "Malware payload (njrat)", "value": "c82348a5d5d621e7a157c6a9b5c12464", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674760629, "uuid": "c83f4bd1-c1ac-4b76-871d-5873dd2a6589", "comment": "Malware payload (njrat)", "value": "2b0befb557b636663da7a1315abfaba656f7605edc4a47c38126c6bfb25c66af", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674760629, "uuid": "e241c098-ca85-4c49-9215-b8bfad0d28f1", "comment": "Malware payload (njrat)", "value": "2359dd8ed849cb6d20a879193b7c5ffe2e82b2a2", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674760629, "uuid": "33108297-2514-4975-b208-b8fe74876792", "comment": "Malware payload (njrat)", "value": "6767db6ac06134fd20f89b9ffc9b04177a3bc26e6e7c4bbb376ec93a7cf8f4633d9f4df651e12c7af56daf7b5a613b3c", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674760629, "uuid": "602d8da2-a748-4199-aa86-0b1a3745d57b", "value": "T1EE24296074D2146430E664EB8FDBF4988B7BB6E50039AD2B60DC575F5BEF1009B02BE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674760629, "uuid": "fa2d7d6f-cfd7-4be8-adf1-c2a81b1ae9d6", "value": "384:YE5VkB3w/lUWcwsYtJA09GiNLB+bArcy9PO:+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674760629, "uuid": "aa381722-bdf8-46cf-a4d9-83bdb768de1f", "value": 221666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674760629, "uuid": "c08d7eb6-7cc3-47a0-a7f9-a22ed7ef0b0e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674760629, "uuid": "b8b72210-343e-4895-8ae5-e152b66b5199", "value": "INFORMACION DETALLADA FOTO COMPARENDO ESTABLECIDO IMAGENES DEATALLADAS#2022-66678950-99659-22596-966652-PNG.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "835e072c-9d7e-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1674740221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740221, "uuid": "f18ad79f-328f-48f2-a75c-da50ab31c725", "comment": "Malware payload (DCRat)", "value": "5abb645e379065fff7f0c9bf91a99b11", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740221, "uuid": "7d3ead53-5aa9-4b86-9fda-935104e00e1c", "comment": "Malware payload (DCRat)", "value": "2c334aafd6a531bd7dbaadb0e5f9eecef379534be9ecccba5043c390969cdcd9", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740221, "uuid": "4c6670ae-71db-4a07-9102-b04c91d86c1b", "comment": "Malware payload (DCRat)", "value": "6761ca986d1db9e4698cfe031cff76a9ba150cc7", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740221, "uuid": "a973b736-dc0f-4b40-831e-fca06d0c2a0a", "comment": "Malware payload (DCRat)", "value": "270eabb8a2840c9b8ef1fba6659300cd5519a4cf045d6d2bb0af599c05745d21840ee5f2e0b647d6d1a9b2cc5103d976", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740221, "uuid": "7cf549b6-ba37-42bd-bf16-8d72e45d026e", "value": "T112535C002798C965E2AD4AF8BCF2950146B1D5372102DB5E7CC814DBAB9EFC64A137EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740221, "uuid": "6f502b5c-fa63-40dd-a318-f6c565598892", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740221, "uuid": "48239752-9b49-421f-bb30-b076645f1231", "value": "1536:HhYBLTM3Ufc4c7VGeeiMl8GbbXwsmoGZZVclN:HhYBLTM3UfcVVfeFmGbbX7mxzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674740221, "uuid": "11f40cc7-7636-4d53-8f02-4389cf48b750", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674740221, "uuid": "7a006f63-1509-465a-aac8-b43a9563c09b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740221, "uuid": "20d237cf-1246-4be5-9006-7c0052a1aae7", "value": "tKyvzKSp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "648094d8-9d4d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674719124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719124, "uuid": "03555288-56d7-4949-aa55-525b235f12c3", "comment": "Malware payload", "value": "09c169f638b0d451edbab0c1ac2c51c3", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719124, "uuid": "f3f58b2b-19b1-4af3-8bee-bfcd71144b05", "comment": "Malware payload", "value": "2c5bdfa01c22c52d6d68bad15b88a2acce9ec3b367443133b0285b082e5bd695", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719124, "uuid": "8814cfa7-03ac-4753-88d9-8c5530132ef6", "comment": "Malware payload", "value": "acf01eec8af0188c61d3bad47ba1a55580021dee", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719124, "uuid": "085f48db-eb92-4d2e-8ad1-e8b3dfe9e3e1", "comment": "Malware payload", "value": "42ae3659dc9423da9174752bee15a0945b0f344ed6b2daa4b3bd05bf22111bec4570532593ef491586a2164cc9accbd9", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719124, "uuid": "a56630fc-3a0c-4171-81f4-01e6c56c0fef", "value": "T175752216FBA54291EE91C6391D37C55C6066ECC82FAD4B8372687B1E2D314B40BA73CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719124, "uuid": "660773a0-ce7d-41cc-b115-3d85833bde51", "value": "49152:2D+O/Jd0D+O/JdnD+O/JdVD+O/JdvJq02H6jpHpC5E+p:2Dpx6Dpx1DpxHDpxTq0a2ZpC+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674719124, "uuid": "655226d8-93a5-4ead-855e-87ea47743abc", "value": 1665536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674719124, "uuid": "dcafd3b4-308e-4fe7-8f19-914a8493990b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719124, "uuid": "6cc98283-db87-4f52-a5a5-83aeb3e905cf", "value": "Alard inquiry list.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8595e76f-9db8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674765135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674765135, "uuid": "dd8d688a-8fe9-4868-a7e1-ed2b09f79a40", "comment": "Malware payload (Smoke Loader)", "value": "7078e47d081358d7d202fdbdd7ad1a0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674765135, "uuid": "5e93cdcf-ee4a-46c4-8e33-a1f1e7a51c31", "comment": "Malware payload (Smoke Loader)", "value": "2cf1cdec1f02d88fbc38ee3e5fde2fc120fe86bc3f6db3c2b894011bb91dbd9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674765135, "uuid": "c01903ca-3aed-42b2-9bfe-bdc2c0cce32b", "comment": "Malware payload (Smoke Loader)", "value": "b720820d6215d017e023338588fb8ae562050a4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674765135, "uuid": "af588667-f9e2-414c-a2f8-8ae578629f27", "comment": "Malware payload (Smoke Loader)", "value": "21ef72c80a9c2771ee13dbbb44cb82cd4c007fdb4751458423fed0c6c21eb7cab8a09ca9a2c4ec5fd7556ae87d612752", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674765135, "uuid": "65981882-83d3-409b-ab19-c662ee00d254", "value": "T16F14E1227690C471C59610750CB4EBE22FBEB42153E0894B7FA836AE5F203D1A7B635F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674765135, "uuid": "c5884faa-89b1-4276-9e8f-fc998093331b", "value": "8112aba4cbddc2cc0c799fee8b497e25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674765135, "uuid": "418e1175-0002-4863-b557-99b0f5d0a59b", "value": "3072:qJ3BN3M6nEYQSBVLTz6ie+JA5OuWfD/js9uaCMFmlytRetnA/:eZBVLTz6ieKuWfD/AbmlytRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674765135, "uuid": "d7499a98-bc92-4d23-9f95-edebfa2bd788", "value": 206848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674765135, "uuid": "e4360511-74aa-4019-88c5-256a7961fb57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674765135, "uuid": "26470727-4036-42df-a60a-899a6ed04a32", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48065898-9d8f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674747423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674747423, "uuid": "6f99b418-869c-4a45-9246-4555900bc8df", "comment": "Malware payload (RedLineStealer)", "value": "f2d7dd87fab0490a02bab277e1163ad8", "object_relation": "md5", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "pw-Heron", "colour": "#B54250", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674747423, "uuid": "82fc23af-9219-49ba-8fd8-26115fdc9ee9", "comment": "Malware payload (RedLineStealer)", "value": "2d06ffe3fd78dacb905ed60124083b912dd0295bfaa3bfe1b1f3082b2806f836", "object_relation": "sha256", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "pw-Heron", "colour": "#B54250", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674747423, "uuid": "9cf19a78-4b91-4b6f-8a61-4556f3f9d8f0", "comment": "Malware payload (RedLineStealer)", "value": "2e2f13293103c9a76cff2ac968291bb50bd63871", "object_relation": "sha1", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "pw-Heron", "colour": "#B54250", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674747423, "uuid": "623a23f3-b697-4e2c-91ac-b87b619d8436", "comment": "Malware payload (RedLineStealer)", "value": "1e339266e35595d8df70084598b23268dce96e4c2369d3055d0bb0bb4db1099c0cd0a125eedf6cc1e55b7b417657a8a9", "object_relation": "sha3-384", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "pw-Heron", "colour": "#B54250", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674747423, "uuid": "9309ca46-fcb1-4981-8818-ae784abf9774", "value": "T153F4233AAA789CC7EFDB9A3853106A9FC754D59D4716A3CB261BD8F031683CC4560D13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674747423, "uuid": "168d5731-4cbd-4453-b9cd-dd9ffc75a0c9", "value": "12288:s2W5iypGWkspGbmMs07yHbrwQsY64mHzBp7JS5HAK16qNDyRv:aiyEfUGZs+yHb86yrSxAK1RlyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674747423, "uuid": "c1bb9dca-3ffb-4bba-a051-4f015df9063f", "value": 791582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674747423, "uuid": "cc15a099-bc23-487e-be0a-d717d0f15bd2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674747423, "uuid": "663bff81-5ece-46be-a393-0f8281e5f2da", "value": "Setup.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6905be3-9d64-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674729113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674729113, "uuid": "fa4c3e4b-a705-4f0e-9f45-192aa3718927", "comment": "Malware payload (GCleaner)", "value": "91c1b804b92dd8bfbaef16e86f3d1e4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674729113, "uuid": "ac5647dd-dc03-4460-987f-bb427dd17127", "comment": "Malware payload (GCleaner)", "value": "2d3e7407accd901aa6afaa40364d3f784cd16dad5d48a1e296f1d31ad3214eb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674729113, "uuid": "3a4a2831-932a-48cd-8483-a250956cbdbc", "comment": "Malware payload (GCleaner)", "value": "99e9be2d0b856c41391584c38311c77e3578efef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674729113, "uuid": "3404ef7f-492a-481e-87af-3b5b85015f6c", "comment": "Malware payload (GCleaner)", "value": "9f5dbc5761e1cd87d6c855dd9ea23b97824e9c7cf0cd50ab16e6a3dea972bc92d159a2b2156e150f18739966783874da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674729113, "uuid": "71419285-f161-4095-9078-e4029b57b0e3", "value": "T1A285334FA5C284FED5508AB626705140D73FBDD6703E00563269A7EE1FB26B0287CAB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674729113, "uuid": "a7921f35-c3e3-4f86-ac89-2d2c87e9a2ca", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674729113, "uuid": "d9687658-813b-483e-b258-38216f3ddc7d", "value": "49152:okug+SJDh9424mQ1e0aDP7R+SjaNxfooKY00VLCgv2MR:hug+SNaNbaz5aNpYYdJv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674729113, "uuid": "645025f8-7bc1-4df3-853e-715a742d6308", "value": 1870540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674729113, "uuid": "817306cb-c3a5-4894-9383-13c3e69f4818", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674729113, "uuid": "6b678858-85a1-49ff-9ba9-0745d165c396", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3317289d-9dc9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674772298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674772298, "uuid": "fbbe5def-3821-4e26-97c2-74d43eda0c36", "comment": "Malware payload", "value": "f3b0a5228be500fc051391877c406350", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674772298, "uuid": "ae214d46-0a85-44cb-b84e-2120f5c3458e", "comment": "Malware payload", "value": "2d71aa39fa330e79f87ae64d8464a6473d9b20c20e742781a3ae6e49174b55b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674772298, "uuid": "a2ce7b1c-d1a9-4bd0-ba61-d51ccde15086", "comment": "Malware payload", "value": "2502f0099e3e102dc3f448111b018b527e3730da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674772298, "uuid": "710af05e-61d3-48de-8c81-11a1e5a0fb13", "comment": "Malware payload", "value": "36e336a4700fa7101f944634682fff94973558936e16b2bbf7e3fce6d063cdd79504609dada4159499a0c0fb1b063d89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674772298, "uuid": "14e84427-e923-4294-b246-9b882df53a26", "value": "T1B9D58C36BAF75026D98DA036EF5747344AC11C75DEE1C312F829BA0E1BB05C0756AA2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674772298, "uuid": "0605091e-928a-4eb5-bf73-0fac819fd013", "value": "8747439d5ab0aa335f0ae3497aab053f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674772298, "uuid": "ec89cf8a-2727-4c51-a670-3b63de0db084", "value": "49152:A9ZhgVxHR415J0ErxJwnEHrWH80G9YOCwvFFo6zJ:yZh4EJ0g3TaH80G9T/vFFXzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674772298, "uuid": "f947fa1f-feef-40b1-a9dd-59071d3887d4", "value": 2952704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674772298, "uuid": "f475571e-dc4c-44bd-a5c4-38a6402d379a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674772298, "uuid": "2ca4c654-f1f3-4692-9867-29e4dfa6cdde", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a9a83d8-9db9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Chaos)", "timestamp": 1674765385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674765385, "uuid": "6dbd24c4-e2c9-4ac2-907a-8733dac23302", "comment": "Malware payload (Chaos)", "value": "692ea33f6b08ccd47ef8a4f8b913fc4f", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674765385, "uuid": "88f656c2-44ed-4977-a016-d2a8af678d36", "comment": "Malware payload (Chaos)", "value": "2ebb2a34dd6633e785f67d118a8c778969e4e34d667cf554268997e13920a1c6", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674765385, "uuid": "690fc2d1-b105-45e9-839e-f66bfacc8704", "comment": "Malware payload (Chaos)", "value": "8a2f0c6b5f422cb2125273be1eece261aa3007e0", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674765385, "uuid": "cf57a6fb-4156-428a-9e9a-876dffd73a12", "comment": "Malware payload (Chaos)", "value": "3ed462273c87e227e101b20ed3d1a46674990706ca6fd6eeb4e78ca6e17b45521d0794b1214d276c85e127a53d7737bb", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674765385, "uuid": "dae3d5f0-a5b9-478b-910b-674b374cca8c", "value": "T1D7344C243AEB5019F273EF755FE47ADACA6FBA333A0794591091034A0A23E81DDD153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674765385, "uuid": "c0eb12ef-dfee-4c25-8330-abe960198d42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674765385, "uuid": "9b435f24-be1a-4e6a-909c-7720bae729a6", "value": "3072:aoT9szr954q4qf8NWPr0Dp/XpoO1zDsJOFQVrFsUBTa488+6WniGxfLwxhqSEaqw:0r95wCPADpaOOwajTa65HyigEX1OeLn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674765385, "uuid": "023f27ae-85ee-498c-b2b2-4c0e48e29e34", "value": 247296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674765385, "uuid": "a92cf504-443f-45cd-a8ad-51dc8381737e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674765385, "uuid": "a20bc77a-24ac-4226-8137-a98e2b870db8", "value": "2ebb2a34dd6633e785f67d118a8c778969e4e34d667cf554268997e13920a1c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca0e1fa8-9dcc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674773840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674773840, "uuid": "2e17d35a-c566-4b46-8d5c-7f37d54155ff", "comment": "Malware payload", "value": "af76750570fedbbdbf38de48955c0318", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674773840, "uuid": "ac5b5b89-4c58-4fa9-85bb-ed8095276f33", "comment": "Malware payload", "value": "2f0fc2d8533e413f72ddf914b4af25e2436000c05a87573389c68e8721a2d840", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674773840, "uuid": "6e1f25b5-08a8-4e25-a918-de77366efe08", "comment": "Malware payload", "value": "6b31621dd42c39592d36f48cdebe2ab024e8db96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674773840, "uuid": "8a22ee2c-2d97-4c0c-8b87-ccac69bf4daa", "comment": "Malware payload", "value": "b78765c73183096779d42a4bdfbddcaef2041385699a5c782b765e6162188324526b4433930676811ead9f7fa0af2339", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674773840, "uuid": "ee50e5c2-c024-4b2e-8e5d-011619db1a1b", "value": "T17D14E0223540C073C09A117458B4EB613BB9B8311675894FBBAD1BAF5F713D0ABBA34E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674773840, "uuid": "b414d4d7-cb9d-41f6-96d1-e8f02032a4fc", "value": "8112aba4cbddc2cc0c799fee8b497e25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674773840, "uuid": "c37bc541-8fe8-4647-ab6d-be42e9d10126", "value": "3072:DpBN3oJ74NyRlLw7a5gyl5JlCPYaOf+D6adBIY9H7QkY/ZX6DR3H:LSlLw7a5gyRYrOfM6KB/aZk3H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674773840, "uuid": "47fe8736-fc2b-4669-81a1-08f541ac8d8b", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674773840, "uuid": "df884292-bce0-4395-b372-5434c6c26363", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674773840, "uuid": "4bae0303-9aaa-405b-b205-e8e311a95ad5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cc38bc8-9dbb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674766221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674766221, "uuid": "75802578-0276-44e3-b650-4b765296b870", "comment": "Malware payload", "value": "0dcb7f44095aa1afbaf134b107d8efd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674766221, "uuid": "4f3d44c3-6875-4eca-9451-bbd4265bec18", "comment": "Malware payload", "value": "2f2b059f28121a74d3d56189c02692387e5c0469f89ad091ee49a1eebce92cc2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674766221, "uuid": "0b9e0b5d-93a7-4604-85f3-650a1c878794", "comment": "Malware payload", "value": "12026286f031a596144d7fe48da0c49428802ad4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674766221, "uuid": "898f8447-d5d3-4ca1-bd2d-1687cfdd0059", "comment": "Malware payload", "value": "7b0aaac637390a5d6eaf7340453ae8520cba4a2f4b57a530570f6402fa7f15feb28a5b6ab13d9f078f976bebbdc67096", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674766221, "uuid": "1e7e6f9f-5d4d-4a6e-9bfb-26f6aeceb04d", "value": "T17304D51437FCCD11E1BA1A3F6961A05182BF9802AD42F25B76C767CD0E36B40F957AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674766221, "uuid": "469c0bec-0fba-492c-a904-686a393181e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674766221, "uuid": "aeb51137-b01f-4d07-a58e-d9a3e87fdc99", "value": "3072:mxqZWjnacI0iLMROUqcwwewE9vh+HxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jV:MqZ7MROLvdvh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674766221, "uuid": "ffbfd7f5-9052-4bc6-9ab2-659e431f7c91", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674766221, "uuid": "27beb0d2-a50e-445c-9d0f-3a0b21873b37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674766221, "uuid": "fb6a16e2-1854-4956-b2b0-33c02e359f4f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d00619-9d4a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674717990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717990, "uuid": "b98fff8f-4507-42cf-8781-7befd5358a38", "comment": "Malware payload", "value": "e12a21b7e572193b92fde5ad513bba67", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717990, "uuid": "f057405b-6a77-471c-adb0-0e95b006332f", "comment": "Malware payload", "value": "2f380d29bfc64c30996f200c2a9303dcbf393be3b8d11aee29c0630ef0fbcb07", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717990, "uuid": "54a82c70-d1d6-46af-ac2f-88ba955d7ad1", "comment": "Malware payload", "value": "7adc86c41ff18be6468efe5e6234502cabdaebb1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717990, "uuid": "c160a820-8279-44fc-b28a-4867edfd8e12", "comment": "Malware payload", "value": "5c52d6c1eeffbc2337bb0d0130718d8138e6e50811fac9c382f42d9b5064d2cd589f080f0a069faea3e7332a955fde0e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717990, "uuid": "f6f32c58-5338-4b7c-9783-9783ae294b72", "value": "T1BAB4234D8DB39217C19757392B1050AFE4E42D6BE8DCA196EE32B15D0DCE3FAC3152A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717990, "uuid": "f44b892a-6d24-47cf-843a-c4d13dd3e31f", "value": "12288:Ut9jbVc1+d4meWqXGWLU7Ny8o+Q0Q9DkMs:onxeWqVokL+Q0Q9gMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674717990, "uuid": "c7513b33-3ff1-4823-8246-ac8d73fc7cc5", "value": 534330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674717990, "uuid": "3ef46ff5-19b6-43f1-b64a-f97bb38ba44e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717990, "uuid": "9b703c0e-3830-4b41-83a2-c65576c0b968", "value": "S O A.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60240318-9d30-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674706661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674706661, "uuid": "613636b4-323f-479a-8510-318c133202d0", "comment": "Malware payload (GCleaner)", "value": "bbbd5d3ccbb93052b8027fb3d46ad526", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674706661, "uuid": "c6471f7f-7696-428b-9b5e-a3632736a863", "comment": "Malware payload (GCleaner)", "value": "2fa731cef7d3ff24950f01d2b60abcbcb50bf82c3703def4426df602fd07c389", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674706661, "uuid": "22e9fdd6-957e-40d0-9ec3-08bd78921325", "comment": "Malware payload (GCleaner)", "value": "d20512ccb4f53673974f4fc31c29e4ef12e0277a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674706661, "uuid": "72b5f8c0-62ac-460c-941f-70fa87ea83ed", "comment": "Malware payload (GCleaner)", "value": "7e19a5381839c4a2c5d7150b1bafb948966a6d2a25137429f74015946785c72288453be4d74bf758f330fa9c4fecbdc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674706661, "uuid": "644611ff-1372-4aa7-ac11-4d1751f3020f", "value": "T132952329D5D191BAC96386FB71385081BB766D0B34BF24427F2453EC2E3B3A079A63C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674706661, "uuid": "2dd8dbf0-6e53-40a4-a5f5-cf8a5a2d8110", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674706661, "uuid": "dfa6eac9-4aea-4033-8d2f-22c50fe9a1da", "value": "49152:ZQug+9qF8t3dQ0a1tyTROI65iKyv2hvl+T7LCgv2MR:Wug+90+JTyY6N+Tvv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674706661, "uuid": "c8e21f73-9ab9-4371-a86f-18229fcd005c", "value": 1875379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674706661, "uuid": "a64471fa-6092-4675-898f-b7e2d8c837bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674706661, "uuid": "1a7d2e4a-9a5e-402e-84d6-76b7f4431cd2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e2cd82-9d24-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674701512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674701512, "uuid": "43be3ed9-53d1-4bb1-be54-6862c8e60247", "comment": "Malware payload (Smoke Loader)", "value": "bcde0c3af682c480cd532e3b20b431e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674701512, "uuid": "b965f164-6b75-4058-af8f-8ab5a13d8f0b", "comment": "Malware payload (Smoke Loader)", "value": "30081d3cc3d74c90eebb202828a3386a2eaeb75fefab6b64f0241daece60918b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674701512, "uuid": "cd9719c7-c433-4dd0-a11f-c16bb9ff7013", "comment": "Malware payload (Smoke Loader)", "value": "4ce5c347adcef4c56c439b76f2dcb06467d1a259", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674701512, "uuid": "45ec926c-9cbe-4efb-b8ef-09301e7d40c3", "comment": "Malware payload (Smoke Loader)", "value": "94a1715cf998a889d3f0db019273e0093ee6657797725f7bc71db851823e5a0c07f06f0831d5a58d6acbd470f261f786", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674701512, "uuid": "b62aca0e-1f1d-4667-bcca-ee5c00b3d280", "value": "T11064AE22B6D0B854ED164A76CD3ADBD4392EF8D28F3C735B32D4AA1F19732E1C126215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674701512, "uuid": "2fd1ca35-9659-4cd4-a768-dc809f0d7266", "value": "e5f35c047e0fdde323b83e51e689dfb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674701512, "uuid": "e10409ec-82dd-4c5f-b376-050cd62ff810", "value": "6144:0PLInPsOEwBNSUnIbykJgGY0+MOKXF2QDcUT:0PYEMnyPJAWRPDcUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674701512, "uuid": "b726fe8d-7509-49d7-b3d6-8cdb1e52eee7", "value": 332800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674701512, "uuid": "70f25894-87ac-4915-9dc2-6dd1ba9cdc35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674701512, "uuid": "cdfd56d8-d4b4-4fa3-80c0-ff2a9d55f3e7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "407ea09f-9d4d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1674719063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719063, "uuid": "363b1307-f86a-470c-a990-2c1dc8794315", "comment": "Malware payload (Loki)", "value": "9281a044182796eb8cb475c9d848b22c", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719063, "uuid": "88b94ee1-d2b4-48b6-ba70-3cd782dd8db0", "comment": "Malware payload (Loki)", "value": "3076cb6e292d99f4a945ef56d63ce7b234215177fe8fae47b1811fc5503fc2dd", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719063, "uuid": "5dcf0f68-baa3-4f2c-9e6e-476525d0c4e6", "comment": "Malware payload (Loki)", "value": "f022f15ecb7d248b643db4bd69137abbbfd1d135", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719063, "uuid": "b4fd2436-7a67-4560-85f5-3c105b24a11c", "comment": "Malware payload (Loki)", "value": "534110fb32b82ecbb3ab4c2b2e74cd2b41268d7dc42dfa81a86448d8e0765fc92da9e756d9f0cdf9595a8c799af8c9d0", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719063, "uuid": "a8308245-3e5b-4bfd-8da0-f3c140ab31e1", "value": "T1C6751216FBA54291EE91C6391D37C56C6062ECC82FAD4B8372597B1E2D314B40BA73CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719063, "uuid": "70551c6b-c079-4024-ba32-65e3b800e885", "value": "49152:ND+O/J9ED+O/J9HD+O/J91D+O/J9ExZRUhd6iPBUkilVh/:NDpxODpxBDpxPDpxixfCd/PBUFbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674719063, "uuid": "a880503a-cd1b-4db2-a711-4d88e416c4fc", "value": 1666560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674719063, "uuid": "bbbc59ef-801a-43a2-b7e1-66618b4517f1", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719063, "uuid": "baeac668-14ac-482c-b00c-2efca96c859e", "value": "shipping doc.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f000aa-9d80-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1674740942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740942, "uuid": "01fd29de-6b7b-41b6-b0c0-cfe392cbfca8", "comment": "Malware payload (RemcosRAT)", "value": "78e04840b1afd0c966a7ddaee7b67b5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740942, "uuid": "a23b2539-2ca2-406d-9940-51b57ff57c74", "comment": "Malware payload (RemcosRAT)", "value": "30b342058dd80eae36044b9f6733b06a08ea4309b64b18186c86d7bd9af10d89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740942, "uuid": "277fc54d-b7e5-433c-9b78-5a67de70a25c", "comment": "Malware payload (RemcosRAT)", "value": "6fb0b77af22467fe2a4122c7d9a6e1de885e1758", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740942, "uuid": "eff29a74-bed7-4b13-b362-1b9d20e2dccb", "comment": "Malware payload (RemcosRAT)", "value": "88ef45883aec28503bfa7c552ba3febd5a27e62dfc308f23f5b3b012f64653961b9250a6070e6d3c24e695bd91ecb0b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740942, "uuid": "c317dad2-50a8-4f02-8879-2250a3870158", "value": "T172D40281FA4084A2EC676732193FCE3259537C3D6574266C2ECE7D7B3EBB811A009667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740942, "uuid": "d0a75d87-f303-49aa-910c-f13879e88f9c", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740942, "uuid": "1c9c1f9d-f222-4802-bf46-cfaa35fa9274", "value": "12288:jY6PwojPPTJQfEVIeTkWc3r7UCWUnkBhjJbITxFb7H/3+zPl+J:jY6PwO9TVhk33r7FaBctFfHvg9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674740942, "uuid": "ae1b5c4b-25cd-4a6e-921e-c969f3908d87", "value": 652148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674740942, "uuid": "15fd9588-dfde-4c23-8c1c-772200cb2008", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740942, "uuid": "8b8fcec9-c2a3-424e-913b-ff626976871c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c3ca4c1-9d4c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1674718707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718707, "uuid": "9ab23294-a317-4993-84fd-9a0ca7ce53cd", "comment": "Malware payload (SnakeKeylogger)", "value": "3e65c681db5bada63c72143ae34eaba5", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718707, "uuid": "02a108d6-2039-40af-9a24-3be4b9b74f33", "comment": "Malware payload (SnakeKeylogger)", "value": "30e913ddcc58ffeac044f96d3d2973ec20646fd5db5058a3afeddb7280a6a5f1", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718707, "uuid": "c938359a-0efc-4bcd-8e95-b8940835dee7", "comment": "Malware payload (SnakeKeylogger)", "value": "5d52904f143a8e2c094a0e55473475fca37bae27", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718707, "uuid": "2e9631fe-c987-4f9e-b990-a56fbc335bf0", "comment": "Malware payload (SnakeKeylogger)", "value": "242a976d1aa0018eff894022b8cf961352c88e4150c1a5ffcae4c3aa493b1fc5f66b79432d0728dc4ea72ce2125fc061", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718707, "uuid": "b0cde8a9-96f9-4afd-bacc-fdfcd2231581", "value": "T1AC03D087EF8EB2615D82753B7DB5762A6007FA2820A84136D4F03936C1994E39CCC4FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718707, "uuid": "68c9590d-0016-41f2-aff0-be349c31ca10", "value": "768:mpVORd0ASb9nA70tzzT80IciOOWAKpVORd0ASb9nA70tzzT80IciOOWAEpVORd0q:mpAD0bbmET80MNrKpAD0bbmET80MNrEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674718707, "uuid": "44cd7f47-49ef-4567-bd39-f8da7077db7a", "value": 38152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674718707, "uuid": "26cbcdd5-0475-46ba-a868-492b15919b12", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718707, "uuid": "6b6934ac-e33e-4d88-ab15-2a494c30f715", "value": "Attached Files.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed514361-9dad-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674760585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674760585, "uuid": "ed5b770f-8951-48bb-b534-45c14f08ee2a", "comment": "Malware payload (GCleaner)", "value": "7a43b46c584c4f5afbe1723de5d0d2c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674760585, "uuid": "b847f23e-6a78-4345-abf9-de5a79fa0572", "comment": "Malware payload (GCleaner)", "value": "31c870d3fa13086da9b127b178b97a2e461747fd068917a3cf79ca90b4bebce7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674760585, "uuid": "5b072a2b-de68-4dff-9d71-22ee19f3f20c", "comment": "Malware payload (GCleaner)", "value": "b3ee3aada7aabf3674b54365ddef2a6104533ff2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674760585, "uuid": "b414ff36-83fd-428f-996a-ffdb0791a5b7", "comment": "Malware payload (GCleaner)", "value": "4f937e7030346387e0458ddb4d54fdd09b5d8a26e8582df4a3e97df76fd2e6b53d731005f2ae1450d01b53271b52ac8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674760585, "uuid": "d7e6601e-6ce8-41f0-aaa2-6e873f404c99", "value": "T16385338EE4D146BDE426CABB383055809F7BED97347D1502328F13ED3E973A06D68689", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674760585, "uuid": "32f582ca-8ac9-459b-a4da-bfe934f6bfff", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674760585, "uuid": "4a444979-c1b9-4687-911b-3464e3c3cf84", "value": "49152:okug+IEXbfodTNg0BEUP70Fld9xxn46+OgyluNLCgv2MR:hug+IGoJg0B8FW6+OnluRv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674760585, "uuid": "26d3d18c-f3c2-49da-8b44-3e204f529a6a", "value": 1872900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674760585, "uuid": "7e9d15ac-a641-4629-82f1-292eb68594c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674760585, "uuid": "065501a0-9d25-4865-a505-8b6220d7a193", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c3cabcd-9d49-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674717258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717258, "uuid": "b3fc6d00-8bad-4a16-9e25-8e9c4cb90f05", "comment": "Malware payload", "value": "2098c39a88a6ba2b96cbbf0c3eb5dfa5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717258, "uuid": "1c6cc0e3-c9ce-4bcf-a24e-a97c652e8bf3", "comment": "Malware payload", "value": "31d7149077d7e6435a2ae87c98afd4ba487e9733e2fe50050bd05930b691e7c1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717258, "uuid": "1a272d85-0e70-40d6-b31b-235950532e33", "comment": "Malware payload", "value": "0459fb74534470852e90f49be3f771306ad8f3a6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717258, "uuid": "04dde66c-6a1f-4795-9367-de05ee3f48e0", "comment": "Malware payload", "value": "b49043e19a4f01bb36dc2f8066858930ced36f0afabb28f4638a77ac6e7aa9dc45a6b27c287c1dfde73bd30328e15ae9", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717258, "uuid": "9a2012ad-9789-4a61-8bd2-d5bb66565c2f", "value": "T1E523F1B6C550347ACBB98B7C445A25B0D04FD585A6106FB80827D7EC528B08FEF2F59E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717258, "uuid": "a4cb5c81-702d-4949-a42e-8bdc23f08594", "value": "768:LaDxCY8rzQW5WjfIPMAKgSRJ/LAsUw3l4PqiLQH+4T0yNnYHwqrVuob/3ERXdM:LaDuTKqNz0T+w3XiLQHbTtNYQWoo/SM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674717258, "uuid": "dcc38c49-7139-40d7-83fc-49800235379d", "value": 50086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674717258, "uuid": "3b16ea8a-082d-4fff-9f2e-acf83fc7cb09", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717258, "uuid": "e74ed0b8-6389-43bc-ae54-65452ddbd1e7", "value": "Multichoice DStv 2023.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "886859c2-9d74-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674735934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674735934, "uuid": "286b13af-36b0-473e-aabe-418447453dbd", "comment": "Malware payload (RedLineStealer)", "value": "54049ded954af64ff7c7979889ea7cd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674735934, "uuid": "efcb2e27-c698-4dcd-8dbc-54771fc67578", "comment": "Malware payload (RedLineStealer)", "value": "32b2911f42f6973883ef52d8d56cafc12aa01e38142782f3c5a54f3c4b5b5320", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674735934, "uuid": "1806fce5-2179-482c-a889-263dd5270470", "comment": "Malware payload (RedLineStealer)", "value": "e41643a08f25e3fd2813081bbcd4ceeadacb512e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674735934, "uuid": "11c9f845-84ad-4a05-9508-2ad428b04cb3", "comment": "Malware payload (RedLineStealer)", "value": "c7376850a0c9ab3961ce5ac56e5f42a388e8e1682b5222aaf79d6261f296d572362ddbf0f8d4b26065596bf39d459615", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674735934, "uuid": "60f7873d-ba76-404d-81f0-eac0bf109b38", "value": "T1B114E02179A0C0B3C462C4745860DF957FBFF97246A9894B7B940AFE5F30AD0663938B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674735934, "uuid": "af4f6134-195a-41fd-a5af-29dfa6056eef", "value": "2fb86d3afd3014d2e2e15a2dd2f620c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674735934, "uuid": "eb3c7eea-95eb-49bd-8361-f09cac28959f", "value": "3072:7BN2E2nvLsxgIg8R45GuhyVYI/7lZ4kQqKq1FMdhp3qlp7WA2DZ:laLZIg8Rx+uYIzr4jCFMdLqlpKA2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674735934, "uuid": "1bac9495-c8f2-4467-8e96-cd21bd877adb", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674735934, "uuid": "bb3bdcf9-bd13-4c5f-a29b-0b1f7d553831", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674735934, "uuid": "1016b30c-dbb6-43d1-a2fa-2ab0b61b41ac", "value": "54049ded954af64ff7c7979889ea7cd4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93e240b6-9d6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674732947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674732947, "uuid": "3a429237-8397-4ee6-96b7-fb858808d46f", "comment": "Malware payload (AgentTesla)", "value": "ffe0e47c830074c08cc38d524a0a151b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674732947, "uuid": "cee0d667-5768-497e-8144-058cbe2d956d", "comment": "Malware payload (AgentTesla)", "value": "33081432003180dd71c9c60c93ea8fdd66414267146561d449e2473fa002c595", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674732947, "uuid": "b33f878a-d9cf-476d-93cf-28aad4bd8ba2", "comment": "Malware payload (AgentTesla)", "value": "841cf89ff664c420a08ce322ea353e4ca42304ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674732947, "uuid": "ab53b8d7-2e56-4b9e-8337-cf5aed6e2b40", "comment": "Malware payload (AgentTesla)", "value": "7178748d153e2202807d624744be0a226c2cb3ec71443089ea8620008afbbc06c8cfae43357db971c030d0c85cce41d0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674732947, "uuid": "e33dbcf4-6f6e-4860-a24b-13d0b9db48a3", "value": "T16E05373D1D7B93F2D474F97252E5A0A0FA9F4492B3A7C9A8C9D61BC05F022826DCE11D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674732947, "uuid": "76686736-f659-48e7-8e17-00845900ae48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674732947, "uuid": "ed270b8d-4dd8-476b-a4b7-e3ef19f314fb", "value": "24576:GT8irmdjXHNOrAe/IuHolr6HJ39rJvQLtwoNMGWQjurU54WZe8F:9lr6p391v2twvGpurw9EA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674732947, "uuid": "ce6baaf3-910c-47d4-9e34-80e6d1a7387b", "value": 801792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674732947, "uuid": "3fb650a9-0d62-4389-9ed2-3b5cdcbf6508", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674732947, "uuid": "2cd64b4c-1104-465a-99ea-6e3700c6ac97", "value": "OwK0KuzNMqRO6ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c72c0680-9d80-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674741194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674741194, "uuid": "7ce6d693-da23-407f-9d0b-c598af8e8d4a", "comment": "Malware payload (AgentTesla)", "value": "2c3d6d560fec89f263e7b73525adc6e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674741194, "uuid": "e76b44f2-98a7-4337-a517-ab72c46a2365", "comment": "Malware payload (AgentTesla)", "value": "33dee3fa1474d96c5f4dec544d0015c56a7a3f46a80033c9ee4cb46c5f677a25", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674741194, "uuid": "ca943f78-4efd-4c0d-94b4-de337903c9d1", "comment": "Malware payload (AgentTesla)", "value": "0d46ac81cf5f01014bd0ef041a33bde894f133e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674741194, "uuid": "0883c2b7-31d9-4b18-8059-3ab79309eaea", "comment": "Malware payload (AgentTesla)", "value": "3aed03790a1669d315cc883426bcd10f91dfe05b106ab3f1d30b349e7f98b27878f1a05308abab6c405a5568208639c2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674741194, "uuid": "9fff0180-dc3e-494a-8645-0cd33612746a", "value": "T16E15DF4072BCDB02EEA48FF51011956107B22E6BFF64F3685D82B2E71A73B913E50A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674741194, "uuid": "51584528-e342-4bc5-8be3-41178513aef6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674741194, "uuid": "37d624be-6466-4a3b-be53-60625b4bd57d", "value": "24576:48kyGyO3QzlGI6AAgZ6sstuG5M/EJdxu5ip:48kypO3jI6AQtuG5McJd8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674741194, "uuid": "05908906-a633-483d-8d98-d702ee8d20c7", "value": 883200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674741194, "uuid": "2d828a90-97c8-4dce-b07a-447041256239", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674741194, "uuid": "c7c99c0a-f217-4e46-8f02-3ccea5e55636", "value": "25012023144006.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "557e3a25-9d5b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674725112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674725112, "uuid": "13918ef1-ea2b-4e32-acd1-6fea71f3b3e1", "comment": "Malware payload (Formbook)", "value": "2e445cf287769000660e81966e76990c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674725112, "uuid": "e78bc657-7caa-4113-8fa3-21106872bd0b", "comment": "Malware payload (Formbook)", "value": "34e23668337ce3dc96cec4ace686aa660d2935b1aab8f94978257a7012c2bbb4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674725112, "uuid": "b41012ae-0833-4c10-aa42-adca48c57ffe", "comment": "Malware payload (Formbook)", "value": "d7455a6cda30a8b258a471b9ff14c4e8db075838", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674725112, "uuid": "63fb0115-5900-4a97-b7fc-4df84c190aac", "comment": "Malware payload (Formbook)", "value": "776c27d841bcfda93d54a7a91c10187302a19233410317ce83ca4fd9c92bb0cb13e05fde0a789e96a0ca3738c5beb482", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674725112, "uuid": "fbb1bce8-564b-4877-bb1c-7411b6c9e4dd", "value": "T1FBE4AD1023ED9E40F6BE4B7896B9505213B77C967973E21D8EC130DE4EB2B10AB45B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674725112, "uuid": "d406163a-b53c-4321-9fd5-ccee25134041", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674725112, "uuid": "4952edb9-01dc-415d-985a-b054ef58de4e", "value": "12288:bSkOvbnR8ey/ZhJuXDJzFqIG6jxoM+/BvMmr4iQBzOnj8+V0XYCVTn3fwqZizzB:PvJ+XGgoB/BvMsttYQJMiZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674725112, "uuid": "be4f8436-9a39-4ac5-bc02-4bdf79fc0a1b", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674725112, "uuid": "a85b3399-a034-4a5c-8c88-8fe3e3a22150", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674725112, "uuid": "4304a8b7-cbc6-411f-9873-b3b19207a04d", "value": "2e445cf287769000660e81966e76990c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08ed8706-9dae-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674760631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674760631, "uuid": "219852f9-1fd4-421a-ab13-7efc6b076a4d", "comment": "Malware payload", "value": "3957333ce88482d8bffdce4c0a0b8208", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674760631, "uuid": "364b5cb8-a08f-4feb-91d6-e226686ad469", "comment": "Malware payload", "value": "353a133b42bee88f0bc7c2fb4c5bcac42d1d63e5098c1c4bf881670c7dfa2c9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674760631, "uuid": "797517f9-30ad-43e7-88fc-db484b15d586", "comment": "Malware payload", "value": "765a800eb9dd2d8acf541eb7eda886a1b5d5aa46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674760631, "uuid": "648f4272-1fce-4376-893c-e60cfe717f46", "comment": "Malware payload", "value": "a897a0deaabf33cd2767276d02a45052c013a00c60000289513d1d4ac76f802eae11cbd4aa80eb3fa5369e785f256e1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674760631, "uuid": "8a59d19c-20e9-4edb-ac56-557b621e5ed9", "value": "T1C345E06D01B7DF8FD97980B9C035D29097F550A9A19AE7C2AEC5F0FA4CC270D4A8347A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674760631, "uuid": "0fd7fcd3-c71d-48ac-b6e2-5d416f2fae34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674760631, "uuid": "c62dadf4-87c8-4abb-9bc9-d2bdbda26790", "value": "24576:OGijvhWwIahgkuLIcS81HYjlK/jB5nVSqVWnJ6:d6I0gkIIISjqB5VJw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674760631, "uuid": "59386649-18f8-43ee-b050-8a294c269a36", "value": 1203200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674760631, "uuid": "051de8de-0b41-4abb-b6d9-e36333779684", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674760631, "uuid": "ccc0519e-2abd-4578-a6a5-1851b28f59b1", "value": "\u03a3\u03c5\u03bc\u03b2\u03bf\u03c5\u03bb\u03b5\u0301\u03c2 \u03c0\u03bb\u03b7\u03c1\u03c9\u03bc\u03b7\u0301\u03c2 \u03b3\u03b9\u03b1 Po 45371_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bc9426b-9d9b-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1674752583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752583, "uuid": "bd1f7c56-1292-48bb-88b3-da2639b52ade", "comment": "Malware payload (CoinMiner)", "value": "39bb929b21232d0d185eea25970c9245", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752583, "uuid": "43451bd3-776b-4b0e-a60f-f44118f31061", "comment": "Malware payload (CoinMiner)", "value": "35bcc3e6ca1f862362dd2e9c852889cc309c7867bac549011c6233f64da4e9b3", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752583, "uuid": "c3c56e97-4d8e-46b1-a8c3-09871ca8ba91", "comment": "Malware payload (CoinMiner)", "value": "c636f5dd6bca4918f3a3e3befce3b98552683374", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752583, "uuid": "21f30dcf-6822-4e04-bb32-f7b72460df5c", "comment": "Malware payload (CoinMiner)", "value": "a51f29dbd03d4d9c1470bd2246bb8accaeed4a69954e05535d235432be1692cdc2d83e8d482f1ea66ffde27036415fc2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752583, "uuid": "55a3b36f-7046-4bac-a783-b0d938ecea34", "value": "T17BC5DF51FE2DE3B3E2AA9138C56285F80E206C15EA82855B7D7CFE0DB77424064F9739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752583, "uuid": "cc2ef8c0-f26a-4242-a2a8-b9075abb2951", "value": "e09d24bd2c3805b9216b6a3ee15d2894", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752583, "uuid": "3d2bea54-e0a0-4d59-85d5-2e15db02266d", "value": "24576:cvAY+g9ZAgVAQE6On7UQlzdvt60ofQtwdpR75OHeHFYSzSURIqEZxNbrLl:o9ZAgVhcM0ofrdlHjzSeLMNbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674752583, "uuid": "5e2260ac-1cef-4880-bb12-28eb4e02fd99", "value": 2725888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674752583, "uuid": "88f02355-3886-4a55-9e87-6c1892e117fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752583, "uuid": "3f18106e-5006-4241-8b4a-01d0975c592d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b2434e7-9d50-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674720397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720397, "uuid": "745c0405-07c7-4d98-a9fb-f099cc944712", "comment": "Malware payload (AgentTesla)", "value": "06d1505c4c11ffde2bfb54b3d9f8ecea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720397, "uuid": "f36499e8-17e6-4ba3-bc9a-c01449604744", "comment": "Malware payload (AgentTesla)", "value": "36856ffca1429da7e4a47d88ff8069505731d206666925eb996aca2abd09cad4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720397, "uuid": "bd2b2407-55b0-44a7-b9cd-f217d68e4c1f", "comment": "Malware payload (AgentTesla)", "value": "f5c16daeb83db261c0ed8f4607c77257b0a8a800", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720397, "uuid": "a1021f5f-bd62-48d6-9f3d-1eee0b73f483", "comment": "Malware payload (AgentTesla)", "value": "ac0abece0bd2504c2fd7ec230a132b200ab77aa249b1fea5cfc9c112261299f2e78198a5548f367fe4aeab83874de9bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720397, "uuid": "c6a4a8d7-dd28-4973-9c32-ec35a6f4b7b2", "value": "T1F5441256A3A5D49BD8B35A335EB692434FD9F91310FCD30F5768A7AE3830642C98D322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720397, "uuid": "23f7e855-1d72-4dd2-9edf-4fd02c99dc7e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720397, "uuid": "3839ca92-b71f-44d9-ae0f-d2f1ab743062", "value": "6144:/Ya65e2VHS0I8dcoDH7h8Pl0zP4PKsPRtdaQmDD:/YrRPIsPh8KE11q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674720397, "uuid": "d98c9f76-858c-4bba-bac0-a8dcc604dd7f", "value": 272628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674720397, "uuid": "728abf8f-ae67-482d-a71b-278838a6e120", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720397, "uuid": "ade21913-b1e2-40bb-9ea4-c2e6ad1fb9be", "value": "DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "397976d4-9d49-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674717334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717334, "uuid": "37df3224-ac11-401b-96ea-118a1d69ff88", "comment": "Malware payload (GCleaner)", "value": "4671ef9ddf68ffb86824ea2fa787266b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717334, "uuid": "fd77a537-7031-4018-8e6f-9c81f0ab75c3", "comment": "Malware payload (GCleaner)", "value": "378d6af040e1051a742e917dcbe441741bb11738c7d7ae26856b60deac570c01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717334, "uuid": "d4c2be96-5b04-4b45-b2dc-0ecba7a8e8f1", "comment": "Malware payload (GCleaner)", "value": "d5d61b5a674af432b0e9170d00bb0e361cc9aa67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717334, "uuid": "4b8543f2-46de-4795-a9db-6c4a11cb0198", "comment": "Malware payload (GCleaner)", "value": "9f92f6bfb06d62d0ed6728cd5e0153cfafed38bdcb2e3323c2963372ac37aaa8f1d5fd93ea2c2a0136cd3b5e1dfa8aee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717334, "uuid": "15c469fd-78e9-458d-9e7b-2d82641e71af", "value": "T1C485235E4881563CDC7A86FB5F745050AB33BEAB747D00613285239E2EE6AF015FA2DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717334, "uuid": "3a32bae9-a739-4cad-8841-59d9707cf573", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717334, "uuid": "5390f9c3-06f6-4b97-bcc7-c4634e09927c", "value": "49152:okug+krZXYIkxqXuPH6kQWDoFpg3pgazCDf+IdLCgv2MR:hug+DWXca5koFApgazCjhv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674717334, "uuid": "a5d19509-bace-4915-a289-67560152d353", "value": 1865137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674717334, "uuid": "566cd1b7-4468-41d3-8ca9-e172be8b8216", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717334, "uuid": "7bf8027e-abaa-482a-be59-f5d0a0ce56f9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2146f2eb-9d62-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674728030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674728030, "uuid": "0252df81-00ca-48f0-addb-21fd92e254cd", "comment": "Malware payload (Mirai)", "value": "4dc1adf613c88280ba85703d7e89336d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674728030, "uuid": "f18c59b9-6217-41d2-a893-d284a60f400d", "comment": "Malware payload (Mirai)", "value": "38024cc37f026553d501467ba61baa406c208896b2eed7c3135ae5ab7acc90af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674728030, "uuid": "ade7c6f1-1c8c-4524-90e5-7b6f0280657f", "comment": "Malware payload (Mirai)", "value": "d242096fa99397188c6251873254c1c9558a0165", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674728030, "uuid": "b7e629c5-66c8-4de8-b79d-9a34318aeb21", "comment": "Malware payload (Mirai)", "value": "cb25c5da8476bdb17065e7b3802c151df34dfc14b06e2099471e050a59a32d8dda495e17a3fc713af8fc1d5e5b2c64be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674728030, "uuid": "ff6224a1-55de-4d4a-abce-a80ff6379568", "value": "T1CEF2E172A2D9C7F0C4BF00F22C7BB91D8F153B2D4298D6F6BEE9212558A27990C46313", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674728030, "uuid": "40838622-ed53-42ea-b2a4-2440db4e3235", "value": "768:R4mdOmeQChAaqC9ayg0G16WPBHcVcBwVgnbcuyD7Ufyq1:Kj3QCwEfW8ABcWBwVgnouy8qq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674728030, "uuid": "73d2a3ab-f650-40f8-9938-27f8a3b7d91e", "value": 34872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674728030, "uuid": "b9d61a3a-04e2-458c-a857-d006b9ef8884", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674728030, "uuid": "92a59781-09e7-4191-a228-58f3e4736a1b", "value": "4dc1adf613c88280ba85703d7e89336d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b7fa347-9d5b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1674725202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674725202, "uuid": "5dd4d8ec-60b1-4338-9526-e16fd73c540e", "comment": "Malware payload (RemcosRAT)", "value": "d9f490baccae0bb8360ad4df84976173", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674725202, "uuid": "c2de3976-3c35-4249-a5f6-c4f149339974", "comment": "Malware payload (RemcosRAT)", "value": "3894b882bf47de623188c43658f2b4986a251942d19a628fb6cfc081345ab10d", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674725202, "uuid": "ae3cc053-a908-45fc-8a16-b558dac6eb2b", "comment": "Malware payload (RemcosRAT)", "value": "6c576b3473f7254b2f26a6a77b5db49268b23144", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674725202, "uuid": "8cfe0499-5508-4909-a0fc-762453a31aae", "comment": "Malware payload (RemcosRAT)", "value": "e40f52a1830e01da6029f4ac0c0495e639df9fbbc53c86eae369861358698642c7a392a87bc503d4ef137678ddd57801", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674725202, "uuid": "e88e6480-ebf0-4e6b-8e4d-620a52a59d7e", "value": "T144153331F589A40CC68721C7C6B12D2BD6BA1313E4E6E1C7FAB7B94856D42B6F133861", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674725202, "uuid": "e524cb4d-a638-4095-98f8-a06fe01730d4", "value": "24576:7pjsJoBsc3Nm1MXI0zbqNQWKs0dbQemZgP7qn:7xsJousmMzvYO7qn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674725202, "uuid": "c46fcba8-a086-4799-94d4-66b322a13e62", "value": 905146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674725202, "uuid": "f0ff4ded-1aea-4517-b2e0-bac1be70df90", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674725202, "uuid": "8e2e2102-2592-45c2-b6d8-b0c2b8aaaf38", "value": "RFQ - 01.300.TRGVH.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8aa4884-9dc6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674771288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674771288, "uuid": "691ce2f5-e7ff-432a-92f4-3d4a05269da0", "comment": "Malware payload", "value": "6da348ed5bcf074ccd3d67bb6d5c12bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674771288, "uuid": "9b396974-ac98-4e76-a9b4-6e4824f008cf", "comment": "Malware payload", "value": "38c41d2b20d22a89d341c398a0569353f78fa8d237d2a7550188c63e7205cc8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674771288, "uuid": "105a0d51-ffae-4752-89c5-48a4a5ef8c23", "comment": "Malware payload", "value": "eb9d60b9b4cbe5ed23640e059c95704de362ae5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674771288, "uuid": "81c2f810-d4bc-432e-af88-5c38d5272bdd", "comment": "Malware payload", "value": "a8bbbf9f7e56c7bc4563d4793d3791538b65b5b166ccf64aa7027ec6c6580b578c934e55b2b515bca3c32cae99a49a7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674771288, "uuid": "0661fdad-8016-44de-afd0-7a7b12828aa5", "value": "T10714E032369CD0F2C4A614345C65FAA52E7A65311365898B7BE80AEE0F703D19BB734F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674771288, "uuid": "7889a340-4438-47c7-91e0-9427c15b8ab3", "value": "8112aba4cbddc2cc0c799fee8b497e25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674771288, "uuid": "593a7894-011e-4e08-9c47-a2a7fda8dad9", "value": "3072:OeBN3bOHUYAiFVLjV6Sed5eEuwtRZSTGSTonpo4zrChpqi15PWQfHHr/:tYFVLjV6SeDue7Rp+hpf5LfHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674771288, "uuid": "70099fdb-5219-462c-96c2-b6dccfd16e50", "value": 206848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674771288, "uuid": "3a09680c-815e-489a-8288-66d64a65d216", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674771288, "uuid": "7fe16a38-8b06-483a-bf1e-e5f966438d1d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8a40502-9d7e-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1674740391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740391, "uuid": "f6c055b2-1d8c-4fdc-bc10-c0ce5c635552", "comment": "Malware payload (GuLoader)", "value": "a4e5741b1e9c9953f14ba8f3d080423e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740391, "uuid": "ce35c93b-8978-4f01-adff-038c90c207fb", "comment": "Malware payload (GuLoader)", "value": "38d18e8967d8808f9bc53e6eb5f22bc065b0e5d170f911eb21451799a60fdf03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740391, "uuid": "2838b2e4-7135-46d2-ac6c-be4a97fe2afa", "comment": "Malware payload (GuLoader)", "value": "9251bceadf28604a6f03b5c5396b4e42f415f3d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740391, "uuid": "d4089e58-9868-4d3e-a4e9-5e70aaca7ae5", "comment": "Malware payload (GuLoader)", "value": "f41849f3aebf460cb31e39257f7d9243295e56711f2090cb723804ce8128ea3e8d4d687f7aa708f325ad61b89ec8b80a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740391, "uuid": "459c71c1-e9fb-43a5-98bd-3a8453c67da7", "value": "T10E942397798155A7FA4B93F00573DA36DF7B4F115026FE830B385BF2386A7600A250AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740391, "uuid": "a5b9e607-b19a-45b5-b522-f955a294db53", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740391, "uuid": "bf7d6a4f-a46f-4839-ad67-87c3814ee037", "value": "6144:/z2sL6KlAFTBuIT+sc87fp2GB3CbOHWvNMEEdCc+smun2LDBISOcqaQSaWEbmC6j:7lGA2+s3joGHWcC5G2LDBISOcBfaWwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674740391, "uuid": "329bace6-dc85-464b-955f-ab41435c7c35", "value": 410640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674740391, "uuid": "7701dd7b-3489-431b-a2ee-1d44b9e25e8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740391, "uuid": "064e9337-8e6a-4e89-aec6-b74cb9e5a80f", "value": "SWIFT_MT103 JPG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f72000f-9d4b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674718122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718122, "uuid": "2657cd22-1c5b-4b68-8066-3a76b88ffbc1", "comment": "Malware payload", "value": "fc7ad4479af8a1c5e2aa40494b51b3ba", "object_relation": "md5", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718122, "uuid": "8fbb00e8-e41d-48f8-8643-fbc0bbcc8dfc", "comment": "Malware payload", "value": "391855ff65dc60135036043f973c42e87a34c17376c4fc0e2032ea0314a9213a", "object_relation": "sha256", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718122, "uuid": "82223ace-b516-4548-b5f4-e13699c2b3b6", "comment": "Malware payload", "value": "64563e893fd37bfa4797e2af6c77fcc97222de58", "object_relation": "sha1", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718122, "uuid": "fbd50c2f-9596-41b6-9de2-7261f4ec6a01", "comment": "Malware payload", "value": "21c87e8c78442d40a28221f9a14651997f99009c8d84c5bb5e2ecd4e100dc4b0db9c3f870eb7843f017d066a296b45f8", "object_relation": "sha3-384", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718122, "uuid": "46d797bf-8235-48cb-bfb2-b0fb981ebf8d", "value": "T10AB4230D8DB39217C19B57392B1050AFE4E42D6BE8DCA196EE32B15D0DCE3FAC3152A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718122, "uuid": "7facc3c4-7899-4465-a0b3-56a8daae69af", "value": "12288:zt9jbVc1+d4meWqXGWLU7Ny8o+Q0Q9DkMH:XnxeWqVokL+Q0Q9gMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674718122, "uuid": "4211c717-84f2-43cd-b39a-59b772db857c", "value": 534336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674718122, "uuid": "c7526ec6-e9c0-4685-b60c-a495d6423b47", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718122, "uuid": "4dbe3328-127d-47bc-a145-814e42d83397", "value": "DOCUMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "173af77b-9dd5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674777406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674777406, "uuid": "25a36ba1-4c9c-4756-80fd-0fcc4ca7a71a", "comment": "Malware payload", "value": "2833c82055bf2d29c65cd9cf6684449a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674777406, "uuid": "c1661297-8292-4487-9795-28c792c10186", "comment": "Malware payload", "value": "3928c5874249cc71b2d88e5c0c00989ac394238747bb7638897fc210531b4aab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674777406, "uuid": "4d2d9742-0197-4b9c-9721-fd3dadce9fd4", "comment": "Malware payload", "value": "75612233d32768186d0557dd39abbbd3284a2a29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674777406, "uuid": "b0896413-9900-4add-9933-f6a09d72499a", "comment": "Malware payload", "value": "455cccbf7fbb7175ed8b74eb49180dbe9334f916f19f53eb55f25380f761f40d4cf0848512781af9ad29c49fd60583f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674777406, "uuid": "0f876976-da90-4dc0-8798-bd12d875feca", "value": "T14F666D07B6A318FCC1AAD870865FD573B931B8984211797B3794AA302F27F605B1DFA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674777406, "uuid": "fe8f24c3-8b69-485f-95ae-35b67b2ef644", "value": "196608:ob59/FouGsmUvvR2MMMHWtBOiP/5duYQHM:oiTQYQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674777406, "uuid": "d855a5dd-cd5b-4fb4-a65f-8467078068e9", "value": 7018688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674777406, "uuid": "e20e9659-b4aa-44e6-8ee0-2c8f6c963a4e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674777406, "uuid": "3946917e-f97d-4afa-ba43-42b8cc039a81", "value": "linuxsys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88a59400-9d67-11ed-88f6-42010a9c006e", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1674730351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674730351, "uuid": "506c93ea-344e-4202-87eb-59c1f1721ee3", "comment": "Malware payload (YellowCockatoo)", "value": "84fbb918cde1275b0a73a1f085c84dc4", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674730351, "uuid": "23e366c1-0906-4c73-85de-32f18e063b54", "comment": "Malware payload (YellowCockatoo)", "value": "3afd9e84650e8e467f672143d270f260ed2a3507af5e6cea08d39f548189c680", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674730351, "uuid": "3236730f-be9e-4562-b621-4fabf7040d67", "comment": "Malware payload (YellowCockatoo)", "value": "a96bc0748d3e6972b846f9164ff5b1e2a3cb9874", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674730351, "uuid": "7576e8dc-29ed-4fcd-962d-f19401d30b94", "comment": "Malware payload (YellowCockatoo)", "value": "3037a43730f7404e7c115b21f36561371d446e075ad979483706db550136a73d2bb0d7334529418aa623161bedf6b7db", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674730351, "uuid": "cef824c4-d440-4807-a840-1c495bbf1bda", "value": "T10EF533F10C7A8A1E07F4E08EA258A2A5B31720891664CE5F71FF37B1E15C987195B7EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674730351, "uuid": "e6d264c4-41a3-481e-bd3b-a3e1c3954e9a", "value": "49152:cKsaFty1+JtYhVa10yM09uBno1pSKRRUCsKweKOUdvwqiwwEOTxw0+N7uwP8:cK41XFyMQR2K/UCLw//bHMw0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674730351, "uuid": "35fd9608-2829-4364-bd9e-5f9bc90440c0", "value": 3504408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674730351, "uuid": "a6633eca-aad9-4782-a9c2-9e7f3480cbb1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674730351, "uuid": "3b8449a8-86e4-43a9-9481-a74d0b2eed4d", "value": "adverb-clause-definition-wikipedia.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16825f93-9d77-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674737032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674737032, "uuid": "77eb2dc4-c3ca-4469-8bb6-06aacea9bceb", "comment": "Malware payload", "value": "9696381a348b7ca9a8d23c050d2db516", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674737032, "uuid": "eabab99b-ebbb-449a-8973-18f613fc805f", "comment": "Malware payload", "value": "3b44add0e74d3699479f14a4e2535be9b4b75e9b0b18fda231b0f2e406449785", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674737032, "uuid": "7908cc53-5a9b-4d4e-9fdb-7f145c2f0c00", "comment": "Malware payload", "value": "21b1df7fb2410fbfac6579e300eff65d691ef584", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674737032, "uuid": "0c57de1f-c4ee-47ac-a7b3-83902c903f28", "comment": "Malware payload", "value": "0ffc1d0a1de79f18aae5ce2348fca23ac5a4fbcf2b555da9d3cfe6c18c95f417f90dc41fca3daf5f2215eaa00880fa07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674737032, "uuid": "086036d9-3869-4175-8183-50baa8de791b", "value": "T1F67633037EF68DF4CC67043BD8262F8112A6EAC44B71585B6FBC0B2E553DAE19B6452C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674737032, "uuid": "65ba648a-ed2a-4416-b08c-8fd580babe35", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674737032, "uuid": "a0cfb238-e4e5-47a0-a3b3-ab41454c472d", "value": "196608:91OvP22CHccYsVKYah2BH892vdL0/p7zHg2nnrs:3Om2C8hQrLNdIB7zA2nnI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674737032, "uuid": "95b53466-b497-41a8-9e6f-9d9e03dc7b8e", "value": 7605969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674737032, "uuid": "2f52d535-fb52-4d13-ac3f-f465e0ddeccc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674737032, "uuid": "8b739a83-dc79-4efd-9d36-93f03b5fe635", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3539916e-9d17-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674695852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674695852, "uuid": "7f277f84-e85a-45b8-ab6c-19707ce3d0df", "comment": "Malware payload (GCleaner)", "value": "aa7b79996c4fdfad138338d97c8ab9ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674695852, "uuid": "5f96661a-df6a-467b-a26f-18d29b20f673", "comment": "Malware payload (GCleaner)", "value": "3b4e2e02441180415b3f780ae083d47d2903aaf4e221984e1db77739ff4b69d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674695852, "uuid": "7c416196-5ee1-4376-8750-8b0f1b0ef64c", "comment": "Malware payload (GCleaner)", "value": "3946a1e1ee65c22a2c34df7afba9e946d64bde48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674695852, "uuid": "74ce74ab-0221-4b23-af9e-72929063c7a5", "comment": "Malware payload (GCleaner)", "value": "069064c2fe455037b21f66d2b1ec3ba309b9f528985ec979594d73e5c7dfbec52dc1782c9bf2ec51678eeebd9c1a2ee7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674695852, "uuid": "5ba3c7b4-e724-4094-ad12-87bc20758c52", "value": "T101853343D8A14533E20396713D1E6295C531B97F0838256826CDBABE8F167F16F16EBC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674695852, "uuid": "5e542c52-6f74-424d-aff2-3ce7e63748fb", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674695852, "uuid": "ae48b18f-8eb4-45e3-b342-54f9c0c0571a", "value": "49152:Z/6OVMMZhDwt5I00jgmITojbiB+RJoG6mzIe7ZIykhin7mYLCgv2MR:9Jhr0t53J0jbCA2HKIeqyky7Pv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674695852, "uuid": "bd813829-ab8e-4d76-883b-3ffb3fac3da8", "value": 1822771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674695852, "uuid": "5c37ec8c-9b36-4fda-a01f-3eaec39a642c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674695852, "uuid": "569061ab-cf16-4a31-8105-7d1f8d38a7e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6365ffb7-9d16-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674695500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674695500, "uuid": "eeecc3a7-e153-4351-93da-49c866e56eb1", "comment": "Malware payload (RedLineStealer)", "value": "b1bceed8c497747cb47d6009263d21fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674695500, "uuid": "a83142da-254f-4edd-8b97-77f909efa6d8", "comment": "Malware payload (RedLineStealer)", "value": "3b56d01caf9b58cd1caec37de1429bf946b1c14ffbe3eb80f93c9ca54778939a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674695500, "uuid": "cd274660-51e7-4385-b203-386606b080d1", "comment": "Malware payload (RedLineStealer)", "value": "bb04877c8ec9ef79f53d3c4c4a6ab957a761cbb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674695500, "uuid": "6f3e8d24-04ea-4e83-8570-e2e05c48b99d", "comment": "Malware payload (RedLineStealer)", "value": "c8676b61deffb354c852dca14041d8651c16f7bd614d8ae205dfcd3b36dbdf25d9ec2815c586e954c3ce8cfd14634b3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674695500, "uuid": "5c090faf-0c45-4a5c-80b7-27935576894b", "value": "T14E64AF1272D0A850F9264A36CD1AEBE4396DF9D28FFC725732D4AA1F18732E0F526315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674695500, "uuid": "0f793339-6cf3-4d8d-9191-f0ab6bb4b640", "value": "e5f35c047e0fdde323b83e51e689dfb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674695500, "uuid": "7e970b64-51a2-4c2d-8fc2-96ed4d5a86b8", "value": "6144:52LSA86mPcOzDYIdX5wivRGY0+MOKX8VjUT:52p7q1oqmsNWAjUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674695500, "uuid": "b74a6d61-1a1c-483c-b19a-c6930310a0f0", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674695500, "uuid": "5e9a5ad0-613e-4b69-8997-4613ff43f94f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674695500, "uuid": "02fe740b-63e9-43f3-9150-b1aa9fe7a1b2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ca5ff2c-9dbe-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674767536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674767536, "uuid": "cea2f307-6d54-41f5-814f-03fd67dddedc", "comment": "Malware payload", "value": "33efdc024c1ae71c40317f555dffe259", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674767536, "uuid": "78012d41-45a2-4f29-bae7-e12a70f65e20", "comment": "Malware payload", "value": "3be75e845b7a1686cffab759d6ce7855080511d084f146967763c4b5ad05e2cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674767536, "uuid": "c3a5cbf8-d606-401e-a3ae-cdfc45567a9e", "comment": "Malware payload", "value": "57fa2a7b71d08c8972c1267aeff2eafa04ebfc31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674767536, "uuid": "1ec7889b-66bc-43f6-88f7-ca4a349f68d6", "comment": "Malware payload", "value": "9eaef3fbf771e018c04091c910ef2f957d92898715b80e9de3f162e814d3d4588be1544f2217574ed183ca70b63b7ee2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674767536, "uuid": "0a661b3f-a9d2-4925-8d00-18788489a177", "value": "T1FE14E0327690C0B2C59612701C60DBB06F7EA5364660998FBBE90FBE5F207D0A77635E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674767536, "uuid": "b97e2579-b8a5-45e6-b4b1-a6a519dbf28f", "value": "8112aba4cbddc2cc0c799fee8b497e25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674767536, "uuid": "637e845a-42e9-406a-ada2-63d2dfad55ee", "value": "6144:mVkLtzGbUx5XuAh6zkWXZTQ+vHdiGFe1XH:5RzmO5X16ZZPdiEGXH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674767536, "uuid": "e59e4ccb-9bb4-4ad7-86e5-840a8924c8b6", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674767536, "uuid": "436a5cd0-7d3a-4ccd-8cbf-ce40366f77e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674767536, "uuid": "eb2d6856-b4b6-4fcd-8e1a-6e7357449366", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39a9346f-9d9f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674754271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674754271, "uuid": "7732f245-b347-458f-92c7-a1dda3e66c6b", "comment": "Malware payload (Smoke Loader)", "value": "3908a5eaa9a469afbd495ffc6b26395b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674754271, "uuid": "4cb7dcd8-0580-476d-9bba-d647f8382d61", "comment": "Malware payload (Smoke Loader)", "value": "3c8bcffa4129325099ce496b056cc58ec103addb8b14d0fbfb6b4445bd59d99e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674754271, "uuid": "99cdc15d-77f4-4cc0-a52c-b54a45efd75e", "comment": "Malware payload (Smoke Loader)", "value": "94c2566112f54e9aa2169e9107ccaa116c9e6f3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674754271, "uuid": "59c9cf88-0e35-4930-831a-29749cc2a35f", "comment": "Malware payload (Smoke Loader)", "value": "b9846bc952f0962082d1c5c0fb74dbb4dde251307182d679a8ca49793150f504c935ee50b18d41ed0e5249d8e21bacd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674754271, "uuid": "685859c6-fca4-47d2-9d1f-4bbd38e3ef95", "value": "T17C14E0317841D472C46551749824F7957EBBB9331ABC984B3F980AAE5F303E1A23A39F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674754271, "uuid": "24793b77-cbea-449d-8d50-bd2eed938c8c", "value": "3441d27f999e45e989c5f0204be01528", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674754271, "uuid": "70a3534c-d20e-4285-9ea8-fdcff6dcc686", "value": "3072:dBN2lp5bQ9LR6aLjxyW5IMEhCTC7IC6KHy6ocDDQMJFg:jNLR/jxyRCWE6Cs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674754271, "uuid": "c8ad9053-6737-4501-80dc-dc09fe938687", "value": 202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674754271, "uuid": "28ee8b9a-8f7c-4a2b-86a1-f8cca3287e21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674754271, "uuid": "013d7e29-4975-49ec-9914-48d5988d2bfd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a337b3-9dd2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674776252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776252, "uuid": "fd0a564c-54b8-4880-88aa-978d06c65fd2", "comment": "Malware payload", "value": "447f8354874f034444d52d96d44fef30", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776252, "uuid": "dbbc425a-a5f8-48bd-ba73-d21dffd375e4", "comment": "Malware payload", "value": "3d68a0260a35e5a05db856e8ecefbf6bd3c46ab26640fa6499d93f84832e030b", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776252, "uuid": "7d604e6b-7a43-460e-a6b4-35e6e7e83a11", "comment": "Malware payload", "value": "69d265b302f056bcdcdba41bde69ee358fcacfea", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776252, "uuid": "3aa1161d-0634-4547-a4fd-8e2ef44863cc", "comment": "Malware payload", "value": "7516ec20da504197acd9330a8842f4ed185b34100891172957d4b2da9a162bbae35d8537977cafb516ef604775b7fdf3", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776252, "uuid": "5419cbbd-8944-4710-b0a5-67699f74c10b", "value": "T1B63171145DCA6321D376D43608ACE30A855D7412D933EE5D06E0C6893AA5A00ED20F69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776252, "uuid": "200d46ac-d551-4c56-afa0-b462b1dc09e3", "value": "24:8ATwQCi4sie+d5oJD8bdMsadM4o0cP04zfZPY:8AWVe+dSdxskop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674776252, "uuid": "672d9da1-9c09-4674-9a28-224862539210", "value": 1842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674776252, "uuid": "c11108c4-2094-4f98-aed4-1f5738512e74", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776252, "uuid": "bf8fd06e-b86e-47ad-a829-c616301cbd89", "value": "69d265b302f056bcdcdba41bde69ee358fcacfea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d961f921-9d15-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674695268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674695268, "uuid": "842bd49a-2b5f-422d-943d-a7b5a6a29b75", "comment": "Malware payload (Smoke Loader)", "value": "9ef03280944fe1f8475afe5c03018c9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674695268, "uuid": "f0d589da-8bf0-4b27-8f2d-9ffeca0ef628", "comment": "Malware payload (Smoke Loader)", "value": "3fa1326ee9ca9f197373fa51c061b9a8025885666d26a5f8c5f766cacea8c1d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674695268, "uuid": "8f51941c-1d39-49ed-8672-bcc8b8383639", "comment": "Malware payload (Smoke Loader)", "value": "2f545127d0b3747813e2ccaccc15050b2b7e026f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674695268, "uuid": "c4a8d6b2-3f86-4225-941e-73ca7a1003e9", "comment": "Malware payload (Smoke Loader)", "value": "bbc3549b013b91f97e944ab31436c015e24f5c8ad869a32d82458fb474dd218ef7e6b5eda317118b90e8a5437560637b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674695268, "uuid": "d11c1b29-0aec-40d6-b9b0-6e9196b33c2f", "value": "T14E64AE2276D0A860F91B4A35CD1AEBD4392EF9D28F3D735732C4A61F2D322E1D527216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674695268, "uuid": "133ba0b0-7062-4793-a642-6545abb3b69f", "value": "e5f35c047e0fdde323b83e51e689dfb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674695268, "uuid": "9385fb8c-2565-41a9-b0d5-adee06165a64", "value": "6144:UmLEw8zD0QL9FWppOqkdY0+MOKXPalUT:UmjmDxLYOqkCWDalUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674695268, "uuid": "3baae069-1c42-4df0-b7e3-5c7942e99710", "value": 332800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674695268, "uuid": "dfa12953-5c9a-4bc3-866f-49335c380df0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674695268, "uuid": "5ede906d-901a-4264-8078-24b32c312b94", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc247a29-9d11-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674693608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674693608, "uuid": "97907bba-d0e3-48d9-90d7-e6c83d942d90", "comment": "Malware payload", "value": "dc594706b3bea3a043c8075571f77f9c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674693608, "uuid": "dae429ec-a19f-4225-b9b0-656548f9dbf1", "comment": "Malware payload", "value": "3fde1f1b262929ab527ea2cc875ca3fc34828dcfb7179eca88512fb081509258", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674693608, "uuid": "01cc6e79-f52b-4f6d-9be2-eece53d48e8e", "comment": "Malware payload", "value": "abf990ec9caa9aca16bef77950f0038e2cd5489d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674693608, "uuid": "e3ed5468-f162-4827-901f-89f41d174c93", "comment": "Malware payload", "value": "7f129dd17eb0840737214d80ae2ab197730f8bd74ccf7a8d0dc4ad2cfe24c9b13a10656da71355b4eaf6c6144d9591ab", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674693608, "uuid": "b51d038e-6cfb-4e87-b386-65e48329407f", "value": "T13D2475B831974964E349C91A5168B56D0AF5F2E374C54DB123EFE430DFA4FE0AF88286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674693608, "uuid": "8d3c5505-050c-45d5-8bae-c3c311ed751b", "value": "1536:96+STvHyjtHv9Yr9uy2oTLawNRI+vLUSd+3BH56mAgaeeVhMDw5wfL1:9KwraRDAw5wfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674693608, "uuid": "ae006b47-4864-43f8-8bc6-3efc59e0dc79", "value": 218936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674693608, "uuid": "2d081951-2545-4f1c-bd05-d82fa26367c9", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674693608, "uuid": "b1fcae89-7e18-4049-8b4c-90d076d4235e", "value": "VSL PARTICULARS.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b3b1f0-9d47-11ed-88f6-42010a9c006e", "comment": "Malware payload (RustyStealer)", "timestamp": 1674716514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674716514, "uuid": "4aceb11c-0d0d-40d8-84f2-c99f7c308fd5", "comment": "Malware payload (RustyStealer)", "value": "e3f13f9832baaa5ef8e84c935e9e2f61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674716514, "uuid": "26e3aa58-e2b0-44f1-8697-bbe23ddf0816", "comment": "Malware payload (RustyStealer)", "value": "4051373fbcf6225e7b67e16853aa69b82fa337197f623b09b2471ab79faf039c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674716514, "uuid": "4380859c-a42f-4bd7-ac7b-f4bc9ac77ea7", "comment": "Malware payload (RustyStealer)", "value": "2beba51405b452c1e20d7367be5d7b3059b5d13b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674716514, "uuid": "42d1df67-dedd-42bf-a243-854c8c1c0a06", "comment": "Malware payload (RustyStealer)", "value": "ff872c08bcb939ed680de959fa4fcd3b33a7b54e07ea18926f17666cf254278a404d9cff761620df2914cda36d60a2d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674716514, "uuid": "873ca30b-7b97-4fa7-a0b2-150d8ea2d19a", "value": "T1F4166B03F6A186E9C0ADC17887579723E772BC894B21B79B5BD05A313F22B605F5E348", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674716514, "uuid": "6e5a9e82-cc56-49bc-872b-1211537ab8d6", "value": "c7940ab09ba5db7694669621de3ef310", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674716514, "uuid": "6c5ed450-c303-413f-a78b-8d49eb276163", "value": "49152:nRCEwJ+YsXP2mv3dqAUrxpZe9hs/i+kyX0HF21Av/0yCxo0H1gI5TiIx/o1B:YMUPRZkp521gIgIJo1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674716514, "uuid": "3cf5b549-9b14-4714-a69a-5325f358bd81", "value": 4213760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674716514, "uuid": "a4465e75-000b-4e8e-b7b3-2455b1a9dcb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674716514, "uuid": "e09a8c5a-b388-4688-90ed-057c1d1a16e4", "value": "e3f13f9832baaa5ef8e84c935e9e2f61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90bff352-9d4d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674719198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719198, "uuid": "eae25aa7-c983-4e0b-b163-2a57a9d76964", "comment": "Malware payload", "value": "d521794367525afe908d4bfbf78fcd43", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719198, "uuid": "fec6792c-feb7-45eb-9de2-951f07dc2f82", "comment": "Malware payload", "value": "418d69653038330328239a6bbe5974bdbebb3de9efb8038c4abee75b96b0841e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719198, "uuid": "22e0668f-ec3e-464a-895d-b6cc8810d547", "comment": "Malware payload", "value": "80d27ef76a664f58763c33c0599914788daf3e65", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719198, "uuid": "e048705f-6444-48e9-a6a7-3b855d1142fd", "comment": "Malware payload", "value": "f395df837411e0d4bacb6b0d60811a44e57a77d532e87aacf9767ab3b45950fa7a18db95ce8a26570431b81f65e57003", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719198, "uuid": "7830f5be-3a9e-47bf-9d60-90e2d4a92c9c", "value": "T12EF312220ACA753CFC3FA2B5A940D7294618CC3D4767DBBAAEB514615660EC2C193F87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719198, "uuid": "32ebcd83-68ad-4096-a5cd-4a7dd3f8c234", "value": "3072:NRdCwLkkU6ApQ5oybrHpbjSiyiPt2QxnxuJU6ukAePU6ukAeWn:NTV31Ay5jS5gtBJ0JBuSBudn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674719198, "uuid": "7f8a85d0-b88b-4649-b129-0e2790646f6b", "value": 159933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674719198, "uuid": "fa9a92f7-383b-428c-83df-f8ddd3d02ffc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719198, "uuid": "adc76934-7b36-4e9c-92ca-e82148304f0c", "value": "ORT98763456789.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f929b0c2-9d48-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674717226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717226, "uuid": "cd1f4f7b-f3ee-43e8-a8f2-14f4110dda58", "comment": "Malware payload (Formbook)", "value": "c4fd67bd233a4af4b95e7188b37b9b82", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717226, "uuid": "2e22cd21-0135-49b8-a138-54e26582c628", "comment": "Malware payload (Formbook)", "value": "41f42b705a4529f90b82efa202036f1d8ec1ddadfee9b2ac8c137d01f86cf497", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717226, "uuid": "092b8303-81f0-457f-a5bc-b5c64c9408f3", "comment": "Malware payload (Formbook)", "value": "8874061d4b10c53d151201c9315cb27014b40aa8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717226, "uuid": "731f473b-9762-4a58-857f-fcfffa4b3310", "comment": "Malware payload (Formbook)", "value": "4cd12c916bf8887ef44c5f843a41a96ba75ebc7af471561a63564bc6c3c43f3d1dc39cae76963319ff1a67d00676765a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717226, "uuid": "47cf9b30-f45e-48c4-9ff4-2d8c9be101de", "value": "T15274234847F4E83503C34E993053F2D28FEA83765561C7A9DA503763EA337A84856E9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717226, "uuid": "b9cbd6e9-b015-42ef-8f04-f0592b20555e", "value": "6144:9P5Fz/kja9dkp9r2U2w0UfsN2YAySeBYR7sVL02X9Ydzzwz0fYgFwstL6R3IGHYW:5cjt9r20SN2eNSs0s94zzXNFwKH4YK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674717226, "uuid": "30fcfc1a-99d1-4034-9e1e-178df2ec34d8", "value": 347165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674717226, "uuid": "7161b2b3-0fe5-4d73-8ce0-63514f50322a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717226, "uuid": "708ccb2e-7aff-4947-985c-f302b93fa2e1", "value": "\u062a\u0631\u062a\u064a\u0628-pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9956a4d6-9d4a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674717924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717924, "uuid": "457d5251-eb95-46fc-8b33-20b61680326f", "comment": "Malware payload (AgentTesla)", "value": "0c653ee4933b596667f39be018e6db46", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717924, "uuid": "3a5a2aee-2d7c-4672-a511-9f8125679abf", "comment": "Malware payload (AgentTesla)", "value": "421a4c6276bd2d23f77cf440c9018c5cabd46988ce219bdb83fedaaa6a976027", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717924, "uuid": "348dd8ef-3c9f-47cf-8134-1658554c3120", "comment": "Malware payload (AgentTesla)", "value": "187766c0d6e877629b1fc73a98f42925aa4cb846", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717924, "uuid": "00c09e6e-40df-439e-baff-f645b4805606", "comment": "Malware payload (AgentTesla)", "value": "d2ebf513f80006b58e576f2e235898355a4ea5b96ce9d4cf0ef2136628d7eac6a7b63bbf5c9474f02e8d8c9a81e18b5c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717924, "uuid": "a590f58f-3b7b-4d4a-aad6-c23a2087ffc0", "value": "T18974235A591D20F0861B4F6EEF6D2FB0CBEA150A8D6333109879B29EC4741707D86E7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717924, "uuid": "72715736-81c6-45a8-abd7-404bb5014b77", "value": "6144:NSth6w6vGYuRKA4Bag8iVx2hwCBhBVf8Ln1FteuFsI7ayXvSvOa2uD+8Mqyx4N82:ItxdRHKadhwCBhXfkbDsI+yXvSsuS1L0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674717924, "uuid": "ead7dae9-a0f5-48e4-9a94-dc37d4806f95", "value": 364798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674717924, "uuid": "ea6b8246-bdab-49f1-bfb4-7dac68459de1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717924, "uuid": "126ee10e-065a-41b3-8218-cbde0172dd28", "value": "Sales Contract.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea908ff-9d75-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1674736240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674736240, "uuid": "57f951fd-ba9f-43f0-abf2-376f54af0097", "comment": "Malware payload (Loki)", "value": "7a6e0d42129b3465d6405318de62a75d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674736240, "uuid": "d4f6daa6-c777-4a9a-ba38-5caf6e1bc04e", "comment": "Malware payload (Loki)", "value": "4339ebf2887db03e86b83f7108b649e724fd71795ab6dc47a4eb268a78d6809c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674736240, "uuid": "c172e4c5-6ba6-48bb-a3ff-0fd5b126343a", "comment": "Malware payload (Loki)", "value": "27cdcd92398cd72c27b0e78890191a00e2d8b4a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674736240, "uuid": "8e3ab857-95b4-4828-8905-4e7ac15295dd", "comment": "Malware payload (Loki)", "value": "34f866204b0c9ed01d7c796ef12a58597aa5377650b42a949d56a2039dc26c21db4c269f0f7e75c30380ddfb3016a2f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674736240, "uuid": "b3dfe311-e161-440c-b881-b8c99dcd4354", "value": "T1F2C511E5A5D5FFC7C1BB22756EE572081B178B4868241641ABCC690F372A9DF7380B0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674736240, "uuid": "cc452378-cd47-46b1-98bd-fb7ebf421de9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674736240, "uuid": "f9f1c2b0-b98c-41ab-b78a-5355808a2c7b", "value": "49152:rcE5eDLx9XZ1fbEn18u1HCc07g+Orf2BO0YZ/dV3TgFK:4eefnvfqQgrj0YR3Tg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674736240, "uuid": "8d939a11-e781-477c-9831-ef0d6e23184b", "value": 2540544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674736240, "uuid": "cfbc9f50-c669-4b86-9a47-c5218d1fa866", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674736240, "uuid": "a1e6730a-eb44-4005-acb1-d3445f90baf1", "value": "Pirkimou\u017esakymas(P.O4024282)UAB Alau\u0161a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da0ffeb5-9d55-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674722757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674722757, "uuid": "d258ad64-53eb-405e-a7fd-ca95bedce527", "comment": "Malware payload (Smoke Loader)", "value": "7371c823c4d39cf12db4603dcae1d051", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674722757, "uuid": "d380f956-9a48-492c-b791-7674159a49fe", "comment": "Malware payload (Smoke Loader)", "value": "45448aaebc6f1faebefa9c45caaa5ec439111867bd3c0caf59fd1179c9f3b789", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674722757, "uuid": "2ff97d3e-a1e9-4c4e-a196-7afa9d204a17", "comment": "Malware payload (Smoke Loader)", "value": "efd76d8ec4d321e95d10bdf301b83e40a80789ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674722757, "uuid": "16b9ca0d-ddbf-4e3d-9267-6c54288c723d", "comment": "Malware payload (Smoke Loader)", "value": "671f65afaca12d33c144208bfdcf065c9d5a4a35507b28af67a728200553e8a50df1397e494baabf4868cf843f933fb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674722757, "uuid": "ea1530b2-d3df-4403-9a6c-045db35a08fb", "value": "T14A14D0A17DA0C073C19354741822EB907FBBFD720A9588877B984AAE5F307D1673A387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674722757, "uuid": "614c514d-df7d-4e12-aaad-ad7cf2251ed6", "value": "2fb86d3afd3014d2e2e15a2dd2f620c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674722757, "uuid": "b75f8f99-51aa-4cb7-aaee-fce9105bb7c6", "value": "3072:SBN26KCP1sLGZVUkTIf5yKJxpMroDcr01ZO+4hXZsOT2m0V:GBsLiUaIPJvMrzrWq0Oa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674722757, "uuid": "6ba33dcf-7e03-469e-9669-7891a726336b", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674722757, "uuid": "04f606a4-f245-442c-8503-abbba19612b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674722757, "uuid": "3b84bbbf-7e73-43be-a18c-5d09808b5d03", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "024acd75-9dd1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674775653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775653, "uuid": "90f551b8-136e-495d-b35d-7101c7aa88e1", "comment": "Malware payload", "value": "863dc2735b6445ade4f169d2a1668fa6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775653, "uuid": "08ad4659-2453-43e9-bafa-37375031e2b0", "comment": "Malware payload", "value": "457522fb1ea00f7da80b3e212bdab12f42504bf25cde07ee7e0122e76ef89195", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775653, "uuid": "ca1b1d87-de63-461f-a092-97bd541a9a5d", "comment": "Malware payload", "value": "4946acd85b1b8306dcf1af4413803d476c112baa", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775653, "uuid": "d7e76cbb-3b39-4819-a893-7441c05d35d8", "comment": "Malware payload", "value": "6d4b85ec384400413c3d2f01cf1a9234d3fb6b16b52a79eec777a8c3aadd1937b911e0cab3fb53a5ad8dda8d27bb496f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775653, "uuid": "b8937cee-65e3-4e94-8d97-af5072b66494", "value": "T145D2B65F8C345CBD87862392E96B7A0BCB3B5437E240BC48F6CC85595BC6ADA133251B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775653, "uuid": "50aa4bb7-4650-4f14-a676-4cb7e1709247", "value": "768:fGV5fbEVPxZr9wCvwPGAq/JGAq/qOoU5IE0BVHsADIoTJ:OcZr9wCvw1q/vq/qOXKBVpf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674775653, "uuid": "6c798ade-08eb-453b-8d1c-0530ce07d793", "value": 29555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674775653, "uuid": "fa6498a8-b059-42ed-84ae-c39a37e1f1cc", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775653, "uuid": "50db7e4c-51fd-4448-aa8e-3f105bdaf3b6", "value": "4946acd85b1b8306dcf1af4413803d476c112baa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6420e02d-9d9b-11ed-88f6-42010a9c006e", "comment": "Malware payload (ManusCrypt)", "timestamp": 1674752624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752624, "uuid": "ed4b753a-8f5b-448b-a5f1-38d7c3ebe90a", "comment": "Malware payload (ManusCrypt)", "value": "083b5ff18230518a7726e0701b6cb24e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752624, "uuid": "c69e7a32-c5cd-41f4-a74d-195b7ff1c2fe", "comment": "Malware payload (ManusCrypt)", "value": "4640e5b9817fd35d92b0d0687003576c75fd4e0df34bcfa0008c6ca3450a8f6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752624, "uuid": "188b2390-39d7-43aa-b489-3c46f8781711", "comment": "Malware payload (ManusCrypt)", "value": "4f20797af1ac735c735a10f57bf5e643c5418265", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752624, "uuid": "d8389787-0460-4505-abdd-7397506c2807", "comment": "Malware payload (ManusCrypt)", "value": "fdba3ba7e2f1f6d938d7fc35ae7a6ec6ee2b8654fd362c61537b2e9d1e4343444f72772145c6865a1042717369460be5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752624, "uuid": "7ea2880a-c5a2-4206-87e1-a2bcf36bc2ad", "value": "T149957A19EE83A03DF55D30F226779AB651B5A8520E30534BA04B27CBDF221F2E6217F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752624, "uuid": "168e03f4-33b9-49b7-bb74-ebd61fdbc728", "value": "39a4439f8bc5e6e61317c81ff97d3d8f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752624, "uuid": "bdd6ff5c-a8b5-4239-801d-d357e7dda231", "value": "24576:Jj9GViAmhHq2cDn9d2QKnqEtmwIqNc7COKIYJjQDQke35GCBBtEtw4ZvG0b0/6N8:J97A9itGojQ0FCtdZ+0bHNUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674752624, "uuid": "0f6fae96-7ee7-4de4-90ad-a2b26ff73fdd", "value": 2049680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674752624, "uuid": "a0d63e95-3984-4e4f-a2cd-c6d7f05674dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752624, "uuid": "0f5e1762-1bd6-40fa-9ff7-995af7587a5b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40fcaece-9d9b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674752565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752565, "uuid": "89b77808-0a23-4582-919a-bdf1a2061ecf", "comment": "Malware payload", "value": "6c7704e4ea374671bbdf0a39261079d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752565, "uuid": "644cc224-f4f3-4421-8039-83b5f788181c", "comment": "Malware payload", "value": "464b3c1e096a481cc94c6947ac76ad3f515e8a7814f28067232832a9a6a6473b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752565, "uuid": "0cc23a83-ebcc-4bc7-8726-918fcaf3927f", "comment": "Malware payload", "value": "0ee0b2fab77998a55fa725314cdcee3e39728b07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752565, "uuid": "9c5d6fa0-73e6-4c2f-9e2e-51db961c4962", "comment": "Malware payload", "value": "261541a1c4a9fba80a3ea7db60ecc3fa435cc7040d847d8252514508bf432afd48fee0c36a999b222443a4f47f836e0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752565, "uuid": "b5f27a98-0e15-40e7-99af-2deb64c3f770", "value": "T1827633A235E14DF9C5A6643289E078C2EC72DC641F1296FB33F1822D9E7D0E98937E54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752565, "uuid": "da135b7d-e5cb-4186-91ed-4b72ea662ff2", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752565, "uuid": "10994720-44ee-48bc-9138-ea69de90de60", "value": "196608:91OW3o64EYkeLYCkkc5la5+/aRNQZR3IuzRbL5E:3OqoGxCYC/eYUtk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674752565, "uuid": "acd7dd86-9ea4-456d-85ab-381c8fb696a2", "value": 7627292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674752565, "uuid": "748c08cb-893d-4bed-a171-900a615c4979", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752565, "uuid": "34cd4862-8847-40cc-b28c-2ec2f9b2b047", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "291ed475-9d62-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674728044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674728044, "uuid": "800aae68-bc49-4b3e-8635-f2797fd75fbf", "comment": "Malware payload (Mirai)", "value": "d888658c315cd23ccc6e7136dea1874b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674728044, "uuid": "69044905-d106-421f-a0c0-f1d41a1ab748", "comment": "Malware payload (Mirai)", "value": "472be218cab3296e1455491b607e0a852398718640ec436595d126d086254cb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674728044, "uuid": "8337c999-ef87-46c3-b8eb-f1ab5dbe783a", "comment": "Malware payload (Mirai)", "value": "9e7573ec1b89d1dd04b0ec734f956136f41e9265", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674728044, "uuid": "1d455a6d-1057-4769-b2c9-dbcb92b7a842", "comment": "Malware payload (Mirai)", "value": "7809e9dd312924bec7dff8d905714176f80908d1d07c1f4343bc1747a86126bedb8c82927dc34bde92a8d6dbcea309f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674728044, "uuid": "51da74fa-e699-45ac-b249-ede2b0080587", "value": "T1ADF2E15E94902455EBBC9AFDE9FC07519868F0D4751E8E5D5B428C20CB3A106964E0FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674728044, "uuid": "5efc2ca1-8446-4200-b429-50df45823e70", "value": "768:2F/PZutwbmUEKl62rMjZp8s2rbJ4V8DUi7DfWxWM2:wxuCbEu7cZyshV8Yi7i4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674728044, "uuid": "e6092389-ba52-4613-97dc-7c9a0a3d371d", "value": 36304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674728044, "uuid": "014a731d-8360-4b9c-ae64-92719d24e0ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674728044, "uuid": "471b5750-a6a9-439f-b6e4-53e99cf5c688", "value": "d888658c315cd23ccc6e7136dea1874b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "876904ed-9d50-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674720471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720471, "uuid": "96c0c648-d781-4f28-a7e6-d0cdb5a7d29a", "comment": "Malware payload", "value": "34070a39ebdf7b82b84f98994f7a90d2", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720471, "uuid": "82cf8a15-77cb-480f-b948-9f330edcd003", "comment": "Malware payload", "value": "47afd77c306e6d00932bdafdf9c6d5118852021c21861ff5e2f6019900f56a56", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720471, "uuid": "729558b8-6747-4e4a-8347-7a3a903ffc07", "comment": "Malware payload", "value": "59634d7ce71d254d04b42fd99a2d043f1108b8dc", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720471, "uuid": "120ccdb1-0426-4417-ad48-3990c384cca6", "comment": "Malware payload", "value": "599f1a5024ac69f0dbf65998b0b84a93195e2beb3150bda81a421d9007a17731d709e090a7089b9b3d1c6c295fa0441a", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720471, "uuid": "f3c3df39-71e0-4d90-be71-e69d28d00fe0", "value": "T1F722BE4DB644E9CBD6E7012BA6470226B0521FEF988F7B8A053E10913ECE95C08997FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720471, "uuid": "2074feb1-c560-49d1-9ef3-f8cb12b4b165", "value": "192:j3tRN4eA/s+Tb96AI3uiC9aKdi7NvaIha+NBwreH4t+dw9/97D:j3tR2/sm9NI3tCBdi7NvaoZBwrLt+dWV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674720471, "uuid": "0b798c2d-a20e-414f-8986-52ec3dc85949", "value": 10736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674720471, "uuid": "2f1a95ec-2c82-4314-9537-7d0fcd71d5b1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720471, "uuid": "24049128-216e-4749-9cfa-3660d8d6bfb7", "value": "SH2G86543456fLOj1oxDUM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7016f270-9d4c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1674718714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718714, "uuid": "98c77adf-0683-45f0-a4a1-614315fca4f2", "comment": "Malware payload (SnakeKeylogger)", "value": "a8e42c745bfdb34e46258c9bb41c7cbe", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718714, "uuid": "676a0482-4d48-46be-a6e0-f30692e8de80", "comment": "Malware payload (SnakeKeylogger)", "value": "47b3c27cc19442278a032878ac5f46e5e0c6ac9fc730aadfe7ae06242f6a3b43", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718714, "uuid": "e888c326-5bb7-4a43-a2af-079b05e9ee85", "comment": "Malware payload (SnakeKeylogger)", "value": "6a72671d488c40b49219b075753ee8d5f8860eb1", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718714, "uuid": "62e6fef3-4b89-4623-a31f-6c7597fd86a4", "comment": "Malware payload (SnakeKeylogger)", "value": "e3bec195011fa8107e8c447a76326e372aa133054845943a0768ac0f872e0276df396157b3bc9b4e6eb10f849ba2be4b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718714, "uuid": "0fd3cec2-4275-4798-842a-7565a18866d5", "value": "T165B22A93F7E81338438200932B5E1BD9FB3ED53A23A155917C5CA2243396C66437BBE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718714, "uuid": "63fd8481-17c7-4e52-bd22-342555610e06", "value": "384:AQMmdOFNYY0aaaIswqPeOrka1+fHQJ+t3rQkRhZCNASt26VHEB/Kz1byfbIb+7vZ:cFx0XaIsnPRIa4fwJMV6pOCz1byfzP9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674718714, "uuid": "6d224b83-ea0a-4a3f-8192-8968892a71e5", "value": 24647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674718714, "uuid": "8792b9f3-1be3-461a-80e8-b61f89a9c416", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718714, "uuid": "f3a4c152-9031-4664-9edb-f49c0a5a322a", "value": "ANNEX 3 - SECTION 4 - Remuneration-rev.1-part iv - Service Reconciliation36.1kB.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "276854db-9d67-11ed-88f6-42010a9c006e", "comment": "Malware payload (Spambot.Kelihos)", "timestamp": 1674730188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674730188, "uuid": "3bac78a2-b402-45d9-aca4-59d61010b3f4", "comment": "Malware payload (Spambot.Kelihos)", "value": "dcb7e9769f8dd25d5a74aae91e7cae3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674730188, "uuid": "38f8c98e-ca17-466a-bd89-b65be956000e", "comment": "Malware payload (Spambot.Kelihos)", "value": "497251504b3852147d2fb7d333ff1f045a74ee4c3ddbcf80b700968a4a8863db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674730188, "uuid": "510c48fd-1f5a-45cf-9760-2f604640df6e", "comment": "Malware payload (Spambot.Kelihos)", "value": "839c2a484a9e016d1ea737d93d0a6091d7f03cfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674730188, "uuid": "8226f114-8908-4e3f-b3f8-26cfc36e4332", "comment": "Malware payload (Spambot.Kelihos)", "value": "b4594bc14bbc1a735d654f08fc4250e4b5ca58748cf2cf58325b576ef9e8767ed0aef425862abdba90668c1999bfaf32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674730188, "uuid": "a92954fd-489c-46e6-9a89-d5157413a851", "value": "T12546129A340F145AF232DFE594E4F38A8E8AA5E45A46E9CCA84304391317FF16DD193F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674730188, "uuid": "f3c5f5a2-b63b-4400-93eb-e1c32ca4b835", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674730188, "uuid": "320da650-1c82-4251-a3af-d640da2b2043", "value": "98304:agrPT1dU278yWEhtTo2BaizPwjxSqt/fyZ4Pzpq9Nym:agrTA2LWEhtHBeYqoAzUz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674730188, "uuid": "f2130738-133e-4baf-8560-994a28e445fe", "value": 5652992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674730188, "uuid": "c1604de1-f0ae-4374-8e58-7e785120e761", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674730188, "uuid": "f6a8128c-137c-40f2-84f7-a74f167480eb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "253e9fbc-9db6-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674764115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674764115, "uuid": "40ac313e-31f3-448f-b548-b6b5f736233a", "comment": "Malware payload (GCleaner)", "value": "a1f40c28a61d9cd0a224ec6c21032ec2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674764115, "uuid": "2cde45ce-6797-42f6-9479-18a089305852", "comment": "Malware payload (GCleaner)", "value": "49f22c6aed063ea583758182c4773c14cd14c25601d636e3a105760b8b4ee3d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674764115, "uuid": "7003cd80-7d3a-4590-8ef7-e825b529a41d", "comment": "Malware payload (GCleaner)", "value": "de8c5e9c5055376f5777e8b8f4704c26bf6eaf76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674764115, "uuid": "447a0f12-8292-4248-adc8-fd3078d87a32", "comment": "Malware payload (GCleaner)", "value": "d092c08c16e275e0a6f8fc6da958efda55900ffd683420d961879b3e86ee9ba2b3fdd191f1fdb91ce3ceb9fd4d62a89b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674764115, "uuid": "326ccd18-9f76-41a5-ba05-c121e25b35e2", "value": "T15E95334BF08781FCE5720EBB2D318080FB75FE8A607A3522375D739D2E3559068A76A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674764115, "uuid": "e4bb210a-51b9-4448-b65b-ca33ded7fbd8", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674764115, "uuid": "610d596f-5a6c-4ce4-affc-99bc4018fab4", "value": "49152:okug+fyScLbHur4Fi+AYTmp0k8yX4x7RdzWCIGMLCgv2MR:hug+6zLbOM3JC6ByXCRsCIGMv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674764115, "uuid": "2714e02b-ab67-45ad-a4a6-c47c7c0f6c93", "value": 1887460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674764115, "uuid": "572906d9-828a-4c76-81d6-7ae6435c2af0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674764115, "uuid": "437a9dae-b14d-4cd8-a3dd-65793ff1c446", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d00bc111-9d85-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674743356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674743356, "uuid": "2e26630a-3fd0-4d35-a9aa-dbcdc4d77039", "comment": "Malware payload (AgentTesla)", "value": "dad996ac644cafb4c238bbd162945114", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674743356, "uuid": "2f8a420a-9224-48f3-9768-4c2a4cb5bff5", "comment": "Malware payload (AgentTesla)", "value": "4a41861a81e4b094f22b2660ed6d0717892209452061d6c21668051651fe1763", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674743356, "uuid": "9924632b-e15b-4fe3-ad47-67d004f8e422", "comment": "Malware payload (AgentTesla)", "value": "eea9a8edf8e704c1fa1c7d1da8f63cabe5623961", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674743356, "uuid": "6caeb753-b38a-46cb-9f57-6214f118da5b", "comment": "Malware payload (AgentTesla)", "value": "1ff5124c91bfd5ceb5fdb116db0fe1976377f4ffaf8b0b84879bc7d043cf5c56b12c66961774a7864f13f9202c804214", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674743356, "uuid": "6b93ef15-3a3b-46e6-b865-23607d538809", "value": "T130235C89179F4327D3DE1F7CBC72064D5BB0A167F832E79969DCA0E41A227A106143AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674743356, "uuid": "a274704f-e4e0-4677-b828-14f5e22503b5", "value": "768:bBiaJBr3lg8aZubP7FMI544rr9OqkJ7aKSEqGtkuODgkATIv:bBxBr3lg8aZub9V2J7aKSN6QrA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674743356, "uuid": "da6842c3-d7b3-4ca3-8128-23720369fdcb", "value": 49664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674743356, "uuid": "fc1b65fa-3300-4cd9-be3f-1985c7d6a06a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674743356, "uuid": "54ed16d0-891f-400f-8015-5af54b47a8c2", "value": "TT PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "828d0894-9dd0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674775438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775438, "uuid": "15a48fbe-211a-4b84-99dc-3a024800a601", "comment": "Malware payload", "value": "d65cfffb905968873ae631add1be5dfa", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775438, "uuid": "118d8142-069f-4d17-ae71-b7484bdbeff8", "comment": "Malware payload", "value": "4a6b54ad4f91e9e8ba8abd0c8925b845f6f6a6803378ad8d583ea4edc034cef5", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775438, "uuid": "9eff87b1-d8c1-4cc6-8161-3a1b2ab742ae", "comment": "Malware payload", "value": "16925aa49307577aa585d7284b89f034a831a4dc", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775438, "uuid": "9a195bcb-811f-498d-8b11-d5ed14bd1be3", "comment": "Malware payload", "value": "6804f253d5da3974bfa327b5f520beb290fba59fd54f3f1a745378d7e5f55a94b2d5dc35168fdbf4a0f8251ae07d3bac", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775438, "uuid": "7ccd8f93-1925-4324-bb32-cc8046b16da9", "value": "T12A2197181AE62710D6E2CB3EFCBF7302D9767D46EA528F9A009081086864201B4E2F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775438, "uuid": "72d35d37-8218-478d-a3a1-bfd5189c1a51", "value": "24:8GtnHYVKVWue/CWnEC7hDYDs1OevYgKa5h+FaU:8wHaLd7hwWvAgKWqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674775438, "uuid": "7cb04c6b-c283-46cc-93be-60c6147c7043", "value": 1282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674775438, "uuid": "95871e56-cfa8-4325-b838-76cf2d6e4853", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775438, "uuid": "60435db5-e00a-423a-91f3-92acb13d4211", "value": "hwid.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f830a95-9d84-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1674742630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742630, "uuid": "4a52ab7b-3281-409f-88c6-29b8759121ed", "comment": "Malware payload (GuLoader)", "value": "6a9c80654406aeeb7be8724830121c5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742630, "uuid": "9c4456b4-8abe-4a0f-8507-a883a999bb82", "comment": "Malware payload (GuLoader)", "value": "4b7467ebfdefa1266b1fa23d79e46afc97246128ffd84ed2945e045a056c6cf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742630, "uuid": "b44207c6-359e-492a-9b7f-07a7ef2df23d", "comment": "Malware payload (GuLoader)", "value": "529e8a891e1f4b980195bace0e567bcb64b68b1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742630, "uuid": "a1a45609-8920-4611-b615-f4e8bbe02448", "comment": "Malware payload (GuLoader)", "value": "3256a5661142c9bebb0dc810f308a15b63c13bd2c6c23576ff6e5a10780c2668b8469e8a679f126d4b8bae5895b0afcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742630, "uuid": "88f4f49e-2f0d-4804-933f-8a590c265532", "value": "T129A4E0127F28ACC7ED2D237209A3C9277BB874780A95574B76E9BE5774023436D0E89C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742630, "uuid": "1f3df68a-e7df-42e2-8d2d-0b808b7c7ddf", "value": "7192d3773f389d45ebac3cc67d054a8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742630, "uuid": "40238ff4-887c-4bd1-ba58-7bb0003b376f", "value": "6144:pGYgXWlQwQXYABi+tekw7bBttfpUizKSdjmkiENGE2K2tIxYjx/GnO93U9EDLkxk:0DG07UImNfWMTb2tIKjx/GnO93hLGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674742630, "uuid": "51fff0a8-ecd0-480b-81c7-26359453f483", "value": 472744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674742630, "uuid": "894bb279-cf7d-4d37-9c95-64e62d3f2081", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742630, "uuid": "16e3beac-e30b-4c17-b168-46528de96646", "value": "PO \u201c011437824.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3189a947-9d8e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674746956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674746956, "uuid": "4629deaa-d693-4a7c-b15f-cc23644ee94f", "comment": "Malware payload (AgentTesla)", "value": "d774143f5100f2111c572bb9e8b5ea98", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674746956, "uuid": "248c243e-bb38-484a-b95a-4203dba93a7a", "comment": "Malware payload (AgentTesla)", "value": "4b9899d778c58bbf3a6822530b2fcc1ecba297049d74e84ef5dce30eac3c8ec2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674746956, "uuid": "15e01565-378c-4e4e-8f6d-95beddd50393", "comment": "Malware payload (AgentTesla)", "value": "d3bc9110990b7caad2d8a7791f0708e2dfebeddb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674746956, "uuid": "be0cc1f4-5c3b-4121-9039-d6d9f90c396f", "comment": "Malware payload (AgentTesla)", "value": "267b4567198057db16c028d234503d723b2815b0a0490e48ef57725deb3bf7f062ea4b9ad63db41586f8c759c043e11a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674746956, "uuid": "8ff2fc5b-84b3-4415-b219-15b0bae472fd", "value": "T1D615BF1423E9CF86F9BD4779C274524063B37866A532D7895FE1A0FE1CB3B108A42B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674746956, "uuid": "eb0a6b58-1877-4032-84a9-54279c1bbe5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674746956, "uuid": "5797565d-2b7f-46b7-b4fc-d25d6ec5987b", "value": "12288:otG7vV5zxPCRgFrfuW0XDHFqIGDLCL53uDQqZ/SkVaGFXEm7x4nqU4/WVlPDC/T:QNGDuLxuEc/qop+qVWVlbC/T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674746956, "uuid": "ddb588c6-181f-4491-9eca-aa45124dac96", "value": 907264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674746956, "uuid": "dc90634a-050b-4f2f-9a16-a60c40befa14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674746956, "uuid": "15382853-9d39-4bfb-938b-dd52ae1c0106", "value": "TT copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2deae922-9da3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1674755969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674755969, "uuid": "78206cd9-f4a9-4a73-b85c-fa9831adcfaa", "comment": "Malware payload (Rhadamanthys)", "value": "cfd8b40b2c17b7791c7811a74d6769ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674755969, "uuid": "b4bd7ec8-eaca-413f-b2fc-032bb15b59f7", "comment": "Malware payload (Rhadamanthys)", "value": "4bd5768bf8ac34cb8ad002ca21a490d6e1702175d8477c1dece3ede5664ae2ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674755969, "uuid": "8025fc2c-61da-463c-b12c-d5a7b14afb82", "comment": "Malware payload (Rhadamanthys)", "value": "260b051f2f457a8d8d5e887c1b31f001c98da9d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674755969, "uuid": "67c84e57-1378-4819-8ca2-7ab797151701", "comment": "Malware payload (Rhadamanthys)", "value": "4d4e8bef748074e92b02917fec5740d28afaa0a8e7f1baacbc9e5f9241efc13508987bcdcc2ac2ccaa2af54313c84aac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674755969, "uuid": "f71ccd2d-b36e-4042-8130-ba54b94901af", "value": "T17614E1317980C433C5A152784C24C3906B7AA93312A979CB7B991BBE5F716E1773B38A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674755969, "uuid": "33e8024d-e210-4e96-99b7-ae46382caa29", "value": "4dfa6309511cb75d1093a1ac55cf0bae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674755969, "uuid": "2d99f926-cd1e-4abd-9388-32bf5dab96a9", "value": "3072:QBN2b8J/OHLofEra5F1I5hXnpk641Zy+SE979:4HaLod5F1hn1ZyOd9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674755969, "uuid": "d5817585-126e-42fd-97c7-d4ca0114488f", "value": 202752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674755969, "uuid": "43db9a92-ed44-405e-b81e-be04bc5a3046", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674755969, "uuid": "29bea4b0-20ac-466d-af46-8be64aac5913", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78937d4c-9d15-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674695106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674695106, "uuid": "4f33ed4b-1baa-4952-afb9-5cbe5953d64e", "comment": "Malware payload", "value": "20b4f8c1aabcf39f5bd111b09c9d6895", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674695106, "uuid": "4dbf5abf-e0c4-4a61-80b7-471b2d2da054", "comment": "Malware payload", "value": "4c1a264be164ce4040cd7294d7a96d67016b45acf4aed3c800c232313e6c87df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674695106, "uuid": "4077c391-1b2e-4071-baf1-701fdf8f568a", "comment": "Malware payload", "value": "3216468f12c350bbadf87837a60a48e9aabcc0ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674695106, "uuid": "29fdbc4f-3059-425a-8e51-15f0109f448b", "comment": "Malware payload", "value": "512ccdb5b56529dd2d0fb9e2c450fa416d7d3e190d46856c87148bd4ccb3696250a002c8c2cb97f82a7732915ede4cba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674695106, "uuid": "0fa8a994-1001-4327-bd12-150aa3a62e7e", "value": "T11A24CF227690A8B1FC164A32CD5ACAD07E6EF5D34A55771733D8A62F1E302E1D63B206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674695106, "uuid": "1813d6fc-e18b-473a-b8b0-db1276126241", "value": "e5f35c047e0fdde323b83e51e689dfb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674695106, "uuid": "69a162aa-2566-4876-b996-32fd39dd3afc", "value": "3072:X3DAIlLOTDw8zGoAR00QtJf7jN3VfWpueOQDromDIlvY0+L4N:UmLEw8zD0QL9FWppOqkdY0+MN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674695106, "uuid": "57765b16-7a79-4dbb-bd56-44a07dcd0d9c", "value": 222400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674695106, "uuid": "d7acbf81-cf9d-48a0-913f-e5d9e28697f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674695106, "uuid": "a13d5f08-9d15-4fb4-b569-4a39fe1c4014", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b45c137-9d7f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674740449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740449, "uuid": "14305f31-b4e0-44cd-8b4e-76355286da1f", "comment": "Malware payload", "value": "c57095397ccff738bfb7a20237a69ee3", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740449, "uuid": "9a471326-87bb-4572-9242-8677a0b547d8", "comment": "Malware payload", "value": "4c34c4108df4d8c085aeea207ebe9a9811bbd83a9eb43d34a4b655ee7a69079c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740449, "uuid": "a8d11166-7019-484a-a912-049dcf395b61", "comment": "Malware payload", "value": "b14afb0f448e3ff1f8a985a7fbf453f806c47e6a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740449, "uuid": "b6f3963a-5471-4920-8870-fc74beff72fb", "comment": "Malware payload", "value": "1b3b4e9613cea6f3b6e26ae71fe546fbc93fd4dda1acc07d36a6b3501fe6f9e79f72ffb35454e5be25db26ca31edbae3", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740449, "uuid": "5ea38020-aeb4-4171-9bf7-34c1b99b6d9d", "value": "T1B455AFF875047DE6266F536BDE96ACEC03B616639ACBA4CD80A477C305A3375FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740449, "uuid": "54697701-6a8b-4fba-b078-ddde1930e155", "value": "24576:ojo/ZT4PMMls9NE1z1teF8HlYa5AxtP9onNmwQJQw4PUPE01XBUmJmCnvUxJd:i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674740449, "uuid": "aaff3fcb-793a-4454-95a6-8c259c9e7ecf", "value": 1312497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674740449, "uuid": "69c995a5-c97d-4b7f-bb8e-d8acb726a010", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740449, "uuid": "9ad2809a-954d-4b2c-94a4-16dba8d497c8", "value": "(RFQ) No. EXE-0804.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d704414-9dd3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674776638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776638, "uuid": "f6dae44d-a6b5-4544-864f-9ad3c759f6f7", "comment": "Malware payload", "value": "cede936f03c958032135eaaee5644b8d", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776638, "uuid": "13026ba1-3d53-4638-8511-1715b9ed3406", "comment": "Malware payload", "value": "4c4233e5b018a60d44067d4c5f40e18a06b544b35bbe2be95587b80bf2bf31f4", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776638, "uuid": "9689f563-6758-4764-96b7-e1a7324c4712", "comment": "Malware payload", "value": "e74704f4879a40d109b7d9113a4211fc62fa0daf", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776638, "uuid": "fd29b5db-8b6c-4b4e-aa8c-a54d3f09ad23", "comment": "Malware payload", "value": "e3e806395f51f0458e64ed27936df7dc78da1155fae115815c326bf78da7b24d73b023d9fe1af93ad072b5068077d4c3", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776638, "uuid": "1296370f-c414-4971-bb23-5850f9958604", "value": "T1E241212117F80608E3F39E7A6AFAA6214133B555DE30D2AD52EC42491B23A10CDB1F6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776638, "uuid": "f72578d8-4553-4174-b571-9b11022a5547", "value": "12:8nZMRduc+l+vGfdjpXY4z+if3+if40bdpYrn1Il+cPjjInk+UcCsvX:8Zt+vGfBX+S+Cdd+cPWk+/CW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674776638, "uuid": "f7a72a26-093d-4920-a10f-6fd6ed0f2f27", "value": 2146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674776638, "uuid": "bb2a9418-9e23-4fb5-ab54-0db590b56390", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776638, "uuid": "3e07ae56-c39f-4509-aea4-9efd06d72a38", "value": "SARS_REFUND_STATUS.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b078dee-9d80-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674740932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740932, "uuid": "53ccc700-dd3d-455d-80fe-d999f0593459", "comment": "Malware payload (Formbook)", "value": "e0b5ba1741b777e172f3c51d48768572", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740932, "uuid": "b13e03a5-d748-4435-be65-c18c78661cb2", "comment": "Malware payload (Formbook)", "value": "4c817012f18358469290ab2d534a7670dbd7769499cfafa327b5f7afca8c3552", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740932, "uuid": "8d67ee6e-d1b6-49bc-adf9-44b5a42ac0ca", "comment": "Malware payload (Formbook)", "value": "8bc5e723bc75979404f55481990afc8014b648b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740932, "uuid": "e83565d5-c820-4db2-b5cf-d07f36aaff3d", "comment": "Malware payload (Formbook)", "value": "8262d36d24667ac980936b19ccb1d77e130d19017a6c6cb8796b74b092e7f67ef85ded56af3d11be34aae16fad52f71e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740932, "uuid": "02a46696-b9af-4151-8b71-dfd18cce6c2a", "value": "T16B541245B1D4C07FE1A293319EBF872287B5B8126477AE1B23544D1E7CA87C1AB1FB02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740932, "uuid": "3a481b0e-2afc-4ebc-bf84-c6c9f94d0fdd", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740932, "uuid": "1a91e4cc-253b-47f4-8773-d28fd64b501d", "value": "6144:PYa6mJ/EbkFtG0rrQ6veLQDSZPUtSx2Jiee+eSou3:PYwyYFtnrrQ6WXUAxce+ku3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674740932, "uuid": "351c1dc1-7f31-4366-98c7-20168c201846", "value": 281254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674740932, "uuid": "464f254e-e0b2-4a53-b1c7-c98ad29a92fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740932, "uuid": "f6544e0b-665d-4890-b5d7-369ef6a3cf90", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a24c915f-9d8a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1674745427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674745427, "uuid": "15a198c1-3e8a-42eb-b234-bb67546c2ccf", "comment": "Malware payload (RecordBreaker)", "value": "0b532cf99be0f098be13127468244bdc", "object_relation": "md5", "Tag": [ { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674745427, "uuid": "a971119b-1ee1-4872-9cb9-2756b3480088", "comment": "Malware payload (RecordBreaker)", "value": "4da00e7d529be457c914b085d66f012c070bf6e3f85675303aa41a7689c08c75", "object_relation": "sha256", "Tag": [ { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674745427, "uuid": "6dbf8679-f8d5-455f-a9c1-d0e2be268a02", "comment": "Malware payload (RecordBreaker)", "value": "6623928aa81844da8890fcbc45c5388b99fecf27", "object_relation": "sha1", "Tag": [ { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674745427, "uuid": "254b8459-4106-4a83-bb1a-54130cdcd295", "comment": "Malware payload (RecordBreaker)", "value": "7378669824857dc593b978568a724d41ba8c2b5d436600384749ca0cbdf29685ac7faf3e0e181f9fcc55f89054c107c4", "object_relation": "sha3-384", "Tag": [ { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674745427, "uuid": "a20e8e50-9ba0-49f5-9526-157803d317aa", "value": "T16273F9D47AD56CDADA25923C41EBD332753DF8E046538F5B9630E6321E03EC07AE9682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674745427, "uuid": "98595fcb-2423-472e-811c-5506735a970e", "value": "5e9ba38c1ab09e4ba51db0ab0eba5599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674745427, "uuid": "0749586c-7a39-4a18-90a0-f2ded261fa7a", "value": "768:O0GAB/fys0sxOUKyZZGPAJUl93DwN/A1yagRcMh39MH+SnQbDgYi1ixBKQ:pGW/h0XUKyZZGPWUL3Dw0yF8+jBKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674745427, "uuid": "93745408-65c7-4ff4-8201-9e06a9dc4bb1", "value": 77809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674745427, "uuid": "cbaf5a66-3128-43ee-a1f4-ef2290532ea9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674745427, "uuid": "290304db-067c-4ffd-ab3c-ef19cf9100bc", "value": "BankStatement-1674745402.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0526a7a9-9dd1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674775657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775657, "uuid": "1caf477e-c751-4281-b532-3bb039301c5b", "comment": "Malware payload", "value": "2db5cfdfc0e7015460535f031f5c400a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775657, "uuid": "8811718a-f1f9-4001-8332-bd6be0011c39", "comment": "Malware payload", "value": "4e375ab59277fe3b2532011d98bbb6dec21ca2d722fe86e187052a5132befe29", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775657, "uuid": "11d37bbc-d6b3-405b-a42d-583a2aaeca74", "comment": "Malware payload", "value": "258fbce9bc1fd53ee5747c6490665d234969bdfb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775657, "uuid": "d0371acd-2064-4844-9d24-9721b61c630b", "comment": "Malware payload", "value": "cc069b7ed611d1ede6bf33d2c0d3798b8cad72f981ddc41d1cce54a40844d26dfcad22a8298c96188b68ebe38b9117ac", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775657, "uuid": "01b167b4-be15-4dc0-a3e0-a4c8b5fb5e57", "value": "T11C63E8AA755070769E13E0B1506B504EB27F503BF44E09ACE2A89DE1BFF28DE057272D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775657, "uuid": "c78207e5-217f-46af-ab03-be3d4549724e", "value": "768:f5/lZmHiFEscZRA1WfqvqoeFGMvFzsiOPNDD7BLQGrMqCDYRQ8JCPSjn5gfGTvCk:fxFETAvLNrBHstajN2BsuASF4COGfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674775657, "uuid": "deaaf1aa-4103-4f50-9932-2bb2f04964b7", "value": 73057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674775657, "uuid": "89622a49-5456-44a8-b446-b176d8e66980", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775657, "uuid": "62124ee7-9ed6-4c8e-ba93-1075c37c6dd5", "value": "view", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007a88a1-9d66-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674729693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674729693, "uuid": "e63a3bcb-2883-4778-90e0-5f38e7ec918c", "comment": "Malware payload (RedLineStealer)", "value": "8edc269873eb17d0c726919b0b2855d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674729693, "uuid": "4e69c3fd-7b0f-4775-a480-0ed50d9870ba", "comment": "Malware payload (RedLineStealer)", "value": "4f7b3295ab405b9f3b358088b83e90e28364b985685fcef2f370d874fc7444d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674729693, "uuid": "853861be-bb9f-473c-9850-ae8c20bdcfda", "comment": "Malware payload (RedLineStealer)", "value": "1ccb3faed9993c542e92f66f10fe2ec992408971", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674729693, "uuid": "5c6be090-378c-491f-89c4-f8ad273e95ac", "comment": "Malware payload (RedLineStealer)", "value": "e5077d8d774eaf031d7146e0212b9bd8e654f5259c6ba3195c5f6216ef4f697ae4c5b91adba4ef2e4ab237064ca7be9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674729693, "uuid": "d67dcbf2-7e3a-4055-b52b-c7c12b0c4d84", "value": "T16B14E0117690C072C0AF45384C25EA917FBEB93296A1996F3B540AEE1F707D05F3A38E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674729693, "uuid": "6f550f3a-54cc-45f3-bc00-c7e5eed9b11a", "value": "2fb86d3afd3014d2e2e15a2dd2f620c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674729693, "uuid": "2be64b09-ad22-4108-8009-e4737435ad7a", "value": "3072:HyBN2VJr5aLn9Q46S0531AWCA5VY62YO2ZPJaASEcIO1mFI4hHDkR:GcgLW46SWAWFokPJaAw1YhH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674729693, "uuid": "770519bc-956f-4e91-b464-700d4252fee8", "value": 205312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674729693, "uuid": "d2acc143-2da3-4beb-bb3f-82a0fc6eb7eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674729693, "uuid": "90da8a9f-92d5-45d4-9615-685f3b9ee216", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "413d5a9e-9d41-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1674713911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713911, "uuid": "eaa3afcf-5be3-46f6-8a4d-09ea00b6b8fd", "comment": "Malware payload (Gafgyt)", "value": "856b43868f78cdb1f4d654a7000a5cf7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713911, "uuid": "8782c379-bdc1-46e3-a7e6-2acbeea061c0", "comment": "Malware payload (Gafgyt)", "value": "4f8a74a6d00305ba2974eaf5b064d74a7c8e0cabd56f61757ce14c5e370b845a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713911, "uuid": "e844524f-b530-4d25-aa93-7b09fe31e5c3", "comment": "Malware payload (Gafgyt)", "value": "0a25ca2d59c756909821631c42cb9e0971407288", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713911, "uuid": "41700e4b-bbcc-41d7-9e83-fe61f71cd42b", "comment": "Malware payload (Gafgyt)", "value": "6b9c70ef3d46360028367d2c8a0958c9c64b66bad86cec0a161375d493834435d87b0b0ee19d94b5f8d9b6fbaee61d34", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674713911, "uuid": "070ea5ed-7704-46d9-8635-a1196fdb34d9", "value": "T13CE30853E2190797D45648F1296733E09F9A52BB45EB30C3F90A8E90AB72DBB1136FD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674713911, "uuid": "295cf40d-5b49-4b7b-85b5-a3aca1c7f1e5", "value": "3072:dEmaP3ZLpqnUnFzY21HnB4DmKH0PXVTfbNj:dEvVpqUnF0MB4DmKH0PXVTfbNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674713911, "uuid": "4dca13fe-1a09-45bf-b520-20961266b1f6", "value": 157239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674713911, "uuid": "67e5ab4f-b02b-4002-ba34-3e2beeb4dc4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674713911, "uuid": "572eaf3b-3970-41d9-b66f-be0da98fa69a", "value": "856b43868f78cdb1f4d654a7000a5cf7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a6c0568-9dd2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674776257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776257, "uuid": "3f99425d-40dd-49dd-9799-2da0557e404a", "comment": "Malware payload", "value": "fadc02361419018e406c6260200fa66c", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776257, "uuid": "81c70643-1647-4749-9347-77f39c480960", "comment": "Malware payload", "value": "4fbda5d7ac20f4ecef665c9379ea86f7dcc2ac7816c97601223f12a51a3e3e68", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776257, "uuid": "5737aebb-ea80-4239-bd09-dc1991211e15", "comment": "Malware payload", "value": "699e8bd78feaa75fbf411535a2f232038dc7af09", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776257, "uuid": "39f4e27a-bddc-4cc1-a443-81e69d690af6", "comment": "Malware payload", "value": "77f2007c1a7af21422db9deeac9904b30763e0be560e25b64e90025e32e84b2b945ee5436d58885fbcb76ff7681a1111", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776257, "uuid": "237d23d4-3daf-4745-a503-cdc77c21ffa3", "value": "T18941E96403DD1A44C376DC7D7CBDE1404767BC265B31C56D06845281DF14728E97A72A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776257, "uuid": "981575ac-c43b-41af-ae0f-bff44ae5519b", "value": "12:8x4erxzkMxUTYQ6xf1ydfVSCUfefqbcPl+Uc7c3Prfq:8x9txxUk51yqCpf8cPl+/Q/rf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674776257, "uuid": "90256f13-d94e-4f34-99fa-1159e673b627", "value": 1978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674776257, "uuid": "a220dcf1-cc11-4a72-83e3-25aec6c910fc", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776257, "uuid": "3cb599ae-07f0-4da2-8441-092609141c32", "value": "INV_Scan_Jan.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cbed3cd-9dd3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674776636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776636, "uuid": "461cc8f6-4276-4107-b7c8-d6700188b361", "comment": "Malware payload", "value": "5e3279c53c6487948d57c32480968be7", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776636, "uuid": "e790f812-f113-4bbc-98ed-806028e350a6", "comment": "Malware payload", "value": "504ded661268ffe0b930b1ded86f5d3b60431d54a50cd201ff1dded0478d0434", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776636, "uuid": "5b5d6a6d-3953-4d6f-b510-d0e6953425e8", "comment": "Malware payload", "value": "33349cb1966f7fa277f6abc74a46fc784ed39723", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776636, "uuid": "a85d60e2-d762-40e1-ad1b-c5186fd471e5", "comment": "Malware payload", "value": "4d3289f9e878b892fd96caf3be9803846423b304378e583ab59a0bd87df2e21b4a283e45c2107b90b46008ba7d5dc49c", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776636, "uuid": "4ed2c225-5059-49fa-89bb-b903f06e0f5e", "value": "T13A41592453E91944C3779C36BC78E14446BBB8120732C2AD028412C54F24729EC3277E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776636, "uuid": "8fa12fe7-6ac8-4035-a97f-3c92a6de5fa1", "value": "12:8GlCAe7NZgsDkkf1yUfqSCUfefqbcPl+Uc7c3Prfq:8GaXf1ymCpf8cPl+/Q/rf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674776636, "uuid": "4b0992ff-95de-4fdc-90c9-b4b5486760ab", "value": 1978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674776636, "uuid": "6d66283d-f157-443e-8eaa-b5b02efcbd5d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776636, "uuid": "3c804520-8fde-4511-9502-d2ce83abcdcc", "value": "POV_Document_01-12.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e1cb0b7-9dd3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674776639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776639, "uuid": "9d563c97-590a-4f12-8741-395babf3c519", "comment": "Malware payload", "value": "c506c64591a5bad7b010c0a08bb4f25c", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776639, "uuid": "80409e85-7e0c-4b7d-ada6-f53b1f0a96b7", "comment": "Malware payload", "value": "505553c68dd0be8cfcd9fac95234d904251ea470ec546d00398cf3440c7610bc", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776639, "uuid": "11ca5276-6524-4163-b0d8-5c8112d2e204", "comment": "Malware payload", "value": "f65263f53c5bab142120353ef897b31cbcf31037", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776639, "uuid": "5a1dda8f-14e7-44fd-b93b-03e8661c5de9", "comment": "Malware payload", "value": "ef61ca0a8e74988de6040dc97aea7ce0bf5277a18cef728bdb1afc2053b70d169ad68dad7c648b68a9b290d131baa030", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776639, "uuid": "352f5875-0539-43fd-b94c-abcf513431ac", "value": "T14D513A181BD91760D3B6CE3AA8FDE21189677C55EA328B69018153C55B14611FC72F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776639, "uuid": "e5827226-3a6f-4cef-a25d-fd4bab8903a3", "value": "24:8bJ/ByUGIf+/qV1yGCMf8cPl+/Q/rf25/eOP:8VdVRBdb4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674776639, "uuid": "b780d7ac-ccf5-4965-8866-40d5ecf33641", "value": 2548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674776639, "uuid": "91d5fba1-85dd-4a2b-91f1-3a67909eb1a1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776639, "uuid": "7dace599-ef6b-49e2-9168-d77e4fba9b9f", "value": "Scan_01-09.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "191eeaf3-9d79-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1674737895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674737895, "uuid": "19fdabb4-d452-4a61-b9e2-a75201058542", "comment": "Malware payload (Guildma)", "value": "29b7453a0994866f0325bcbcc343e921", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674737895, "uuid": "fa0a3820-073b-4439-8e2a-64b0778d23b4", "comment": "Malware payload (Guildma)", "value": "50a7d17afd178577bb4df07aeb3008cda6e807faab72d91b3642011ebf4262be", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674737895, "uuid": "01718d84-0024-479f-822f-29bc4922afe4", "comment": "Malware payload (Guildma)", "value": "caee8cda9b082b13c23a6572127df73af70ad01d", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674737895, "uuid": "53b8a31b-d325-42f0-9015-ae908fddcd5a", "comment": "Malware payload (Guildma)", "value": "6565e78c0c0c0686abf1df623de96b25ff169146e787b0b22caf1d4c69afbf27b8f252cefeb44f49e69953f8d3fdd191", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674737895, "uuid": "52ebd44d-9224-4d60-ae96-01fdf28a27c5", "value": "T13BF0AB4DF0802ED1D02E083B8CA21B841C5C784F4B90726B828D03984AB45887F4EA90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674737895, "uuid": "f628a96e-0db2-4fe8-ae3f-1d20551bfb9b", "value": "12:8rflM8OBE6ZGZgkstazRjdZtLT0Om9m7xMASabHjhpX0:8loGZFqalDtLwOam7nSa7n0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674737895, "uuid": "92350659-5d67-4241-9480-f182d8bd9617", "value": 489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674737895, "uuid": "d8f001d1-460b-43f6-8a71-b4d2350ad9eb", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674737895, "uuid": "671bb66b-26c1-4eb3-9cb7-8f80b1c0132a", "value": "29b7453a0994866f0325bcbcc343e921.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d194773-9d4d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674719111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719111, "uuid": "57512047-1a02-4ae8-b32d-96bf59f79fe7", "comment": "Malware payload (AgentTesla)", "value": "9789f3b1afc372cc8f27c69d8853ed0a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719111, "uuid": "60931aa2-0021-4be2-ae11-1d849acb46fd", "comment": "Malware payload (AgentTesla)", "value": "52d75db647f5ea1d671ff57cfebaea1f9a9c2cb86c309df172b28d07ec17329b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719111, "uuid": "332a80ac-8e48-4608-b358-45162d2e68be", "comment": "Malware payload (AgentTesla)", "value": "78102136cf303f828fe3673d61701ea651a0b5b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719111, "uuid": "626f6cbd-43ea-4dbc-8be3-91b4b8323003", "comment": "Malware payload (AgentTesla)", "value": "e9558c6f57e7ded001a0ef24078a7c06c155eb5f4fad1ca6c6cf1f7ab195623852029ba8575b4208efe5cb19be600849", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719111, "uuid": "111f5cc0-0edd-4fb3-b3c1-f52c47f91cac", "value": "T1AB74235A591D20F0861B4F6EEF6D2FB0CBEA150A8D6333109878B29EC4741707D86E7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719111, "uuid": "e123de85-7982-413c-a011-984fc3775399", "value": "6144:zSth6w6vGYuRKA4Bag8iVx2hwCBhBVf8Ln1FteuFsI7ayXvSvOa2uD+8Mqyx4N86:+txdRHKadhwCBhXfkbDsI+yXvSsuS1L0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674719111, "uuid": "d88a95ac-d518-4e47-a1ec-66fa78228c18", "value": 364800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674719111, "uuid": "93769a3f-8e56-4373-b1cc-a0add522ecc7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719111, "uuid": "af7bd246-5c16-49e7-abe1-37a98508b8a4", "value": "Bank TT request.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c85d472-9d36-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674709339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674709339, "uuid": "1c0aa752-bd27-493d-a6c6-3d8bd77aadfb", "comment": "Malware payload (Smoke Loader)", "value": "2d4761ec3898ec277d7d7e66264d5721", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674709339, "uuid": "3117ec10-bca9-4e8a-8608-00ecb6031f96", "comment": "Malware payload (Smoke Loader)", "value": "53ebff03a3ea0dfcea83bd0f62cd0592c202259493acae48443566a8470fecad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674709339, "uuid": "bdaa39a8-96ba-4f2b-85e9-f9ad3129a334", "comment": "Malware payload (Smoke Loader)", "value": "cd6a5a829f2f15a5c52eace79c71699479f4bbb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674709339, "uuid": "92d101d2-4b5e-4f33-b6d0-b50f2e509e56", "comment": "Malware payload (Smoke Loader)", "value": "0e8657fd79f48f708470d54106c72f51aa7c5e74daf702f61e8d0703f4986925e7b3aa5cc81ff3fa7b84b4b097834a3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674709339, "uuid": "dec28b9c-19bf-485a-a2fc-b1bbb66707f7", "value": "T11164BE9275D0FC60F91A4A35FD1ADBE4B92DB8928F3C776732D4A70F28722A0C536215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674709339, "uuid": "7f2a19e7-81b1-48a0-ac40-6dcd31aa3993", "value": "e5f35c047e0fdde323b83e51e689dfb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674709339, "uuid": "30405959-eef3-4058-b830-f800513c2319", "value": "6144:asLpt7vt+ecdACOxdlkBY3GDmJY0+MOKXPtUT:asDrt+ecd8dlAY3uWLtUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674709339, "uuid": "bc566f95-3996-4bd9-b296-36c1dd9cb3d5", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674709339, "uuid": "fe1f99e9-3656-4468-b045-346741578a6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674709339, "uuid": "a2e62942-8d07-4c91-b865-3c93d1b041c1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d73564-9d4a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674717728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717728, "uuid": "e0cc0f40-8337-4f0b-9227-28024444cb21", "comment": "Malware payload (AgentTesla)", "value": "3608143a86f9630e1d2509857a2fdc59", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717728, "uuid": "004ecaa6-940a-4211-9c8d-8ff0a607b42d", "comment": "Malware payload (AgentTesla)", "value": "545530bf9f4343f2d501469f12f7dfe0f02d27e9779353845e4af01b5f913878", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717728, "uuid": "b97e0718-3ef1-4e80-b750-a1e3ed1e897a", "comment": "Malware payload (AgentTesla)", "value": "db69c6598dc7bd56b66c9260cfe83c46d536265c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717728, "uuid": "ebf3b26b-2c26-44eb-855d-28612d31e80b", "comment": "Malware payload (AgentTesla)", "value": "0a3f8c9196157125ae701242d6ff82510e07e2541330b1505754f12c4a282c58f33d04e859a70362c07321056b07a893", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717728, "uuid": "2ecfaf6a-9129-4dfe-84b7-d30f135bf3df", "value": "T12E74235A594D20F0861B4F6EEF6D2FB0CBEA150A8D6333109879B29EC4741707D86E7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717728, "uuid": "2109a8ea-ca84-458e-8b26-bb4ee22393ec", "value": "6144:8Sth6w6vGYuRKA4Bag8iVx2hwCBhBVf8Ln1FteuFsI7ayXvSvOa2uD+8Mqyx4N87:FtxdRHKadhwCBhXfkbDsI+yXvSsuS1Lt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674717728, "uuid": "024fca96-a4ba-4020-a9e6-a93103f9e46b", "value": 364792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674717728, "uuid": "d5e4b307-151d-42df-a44d-07be511bf651", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717728, "uuid": "ebc4088d-3fcc-485d-8862-a849ba5c6e67", "value": "PAYMENT DUE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4107e3ff-9d62-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674728084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674728084, "uuid": "0c673858-907e-46b4-adff-31f0924fef80", "comment": "Malware payload (Mirai)", "value": "c67daf6d445e89f50ab435bc8a8803fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674728084, "uuid": "7118eca9-0b51-4dcf-9189-a8d119537823", "comment": "Malware payload (Mirai)", "value": "54c60e19a61c83e71391087fcfd3ebf96d8fe0afcb6c24e1c886aa99a5e8a2f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674728084, "uuid": "b9c3e73b-03fd-4eb5-bc1c-52f21d5006bf", "comment": "Malware payload (Mirai)", "value": "762d7bc6791b0c726fc7b365ef8fc9571abd4383", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674728084, "uuid": "78c0c56c-ccf4-4784-857e-9b46e85dd76c", "comment": "Malware payload (Mirai)", "value": "55566205f5eba57aaf42c3a2cd65838659f31623f5c3caa6fe8c98b2bab1bccde3f91bfbe4ee52b8f5939903e82619b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674728084, "uuid": "d3d8373f-d438-476d-9f70-bb47f74688b1", "value": "T11B73AEF2C4652DA0C2684138A5E6AD381B13F50196722EF04E168BE6650FEECF54E7F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674728084, "uuid": "2bbb0eb0-1646-4db3-8f77-cdc6455674f9", "value": "1536:E/jnwcbjpmuwJaFwtO/WlP1Y1VOCjQCUJy5MFaHUYG0NMxCSss0:ErnwmplwJCJu5i1QCJ+FaHUYGkMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674728084, "uuid": "c7e68447-6fb0-4d50-98b1-a5748b1ba6cf", "value": 74804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674728084, "uuid": "bb511cea-b9b8-443b-b2b9-e1a752c5565a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674728084, "uuid": "4911bfb7-aa37-47fe-aee5-6cfea0ec414a", "value": "c67daf6d445e89f50ab435bc8a8803fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e90a2559-9d5e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674726648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674726648, "uuid": "d07937bf-49d0-4a91-985b-30bd89b4f659", "comment": "Malware payload (AgentTesla)", "value": "e684d676defaa48b14b3f79050761998", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674726648, "uuid": "f20d54c6-ab22-4fb1-b000-f122209de430", "comment": "Malware payload (AgentTesla)", "value": "54e7a3ef035646bbf5fa3428726b3d79270596429936a831165f17c2650c1924", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674726648, "uuid": "1c866e08-064f-4667-ac99-716d1d623a01", "comment": "Malware payload (AgentTesla)", "value": "67dbe868b7aee0deb460fb7ecec3b048e30f26d3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674726648, "uuid": "2d6453e8-6bd3-4bc4-b5e1-0a4c14fdaafc", "comment": "Malware payload (AgentTesla)", "value": "81beb1f28bdcba4ea885f6a973903f8f3d2991be1176d8f0674977cc7a88ba0d7cf62e5249f5dd78926be9e24b574939", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674726648, "uuid": "9ca6b16f-e06e-464d-8fa9-7a0f901a1652", "value": "T1F5052A2C0D7693F2E474F97553E4A4B0FA9F489273A7C8A4DDD62AC05F222426DCE12D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674726648, "uuid": "c972de72-743c-49bd-ab45-ea0aee20f511", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674726648, "uuid": "b3f6729b-ff90-49d9-8e69-25c0b38d682a", "value": "24576:9T8irmdjXHNOrAe/IuSoVwrqhTPVcJmBDCxCLoojR3murPLm803K:XVwrCPVcJODiCJjR3murPLm8UK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674726648, "uuid": "32139751-15c4-4c7e-a0ce-0a8cb687a55c", "value": 825856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674726648, "uuid": "cced572b-3464-4cca-93c4-e919725a07de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674726648, "uuid": "46c60af9-2391-46c1-b432-069d20bda491", "value": "payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "678d6205-9d3c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674711827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674711827, "uuid": "f01a4853-c25a-479d-ba35-b3689e9a43b4", "comment": "Malware payload (Smoke Loader)", "value": "2638e10999a8fe23420b120c15c61e63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674711827, "uuid": "4da7907c-2e87-4b2d-8637-064ba7f97c33", "comment": "Malware payload (Smoke Loader)", "value": "558221f4783fff9fde5d264c09abf6ef68a45e1afe2af4a0264152a66c9b1e1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674711827, "uuid": "ab34645d-a6c8-42fe-874a-297668fffe7a", "comment": "Malware payload (Smoke Loader)", "value": "9efd6cc8d825c850ec6d042eaed74650b904b885", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674711827, "uuid": "eb0438f6-b6cc-4c1f-a158-7eb67c954cac", "comment": "Malware payload (Smoke Loader)", "value": "c4818970e70afbbf4daa308fad4a5d27b6c39cb85c53109868c9481a8244e05b82423d6fa49984f66d3385baf182ecd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674711827, "uuid": "f357ac22-ea32-4472-b925-43d1f104438b", "value": "T1ED14E1237A90D073C79B44341824DAA06FFAF93253A988877B980ABE5F707D15337396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674711827, "uuid": "94c9da9b-d917-47c7-adbb-c683c5bb4925", "value": "2fb86d3afd3014d2e2e15a2dd2f620c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674711827, "uuid": "c69f96e0-b881-45b1-b0c0-1607da799c1f", "value": "3072:WBN2IHefL5T0qUpy5Z+Bjbter0jYjs9Z5dXjiP9kSuUSVOL:qiLV0/pa+BjZer0jv9ZnjilruU4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674711827, "uuid": "c044f655-f089-41dd-9054-30d448f6faf7", "value": 206336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674711827, "uuid": "e3742239-5125-443f-a848-53a370e5aa33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674711827, "uuid": "eb000828-81d5-48df-a820-dede26f8e68e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9624192d-9dcf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674775042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775042, "uuid": "3e18c738-2137-45c1-8ce5-a01c449e7c57", "comment": "Malware payload", "value": "831e61a586e2f35f9acaae893fa68078", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775042, "uuid": "33b50706-1013-4c33-9e3c-528f4cd0a388", "comment": "Malware payload", "value": "559cc02d3a551469e40b74f999f4c6debd702ca19b0d003dd642225023d36059", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775042, "uuid": "311c6522-9e33-4acf-ae0a-4d18ae9bbc4b", "comment": "Malware payload", "value": "0a5a07bdae70a571cf433f03c660cb7083761789", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775042, "uuid": "ee16e01e-ebba-4cd8-9a83-9f9dec65ea9a", "comment": "Malware payload", "value": "55e76245ee22024065b30d354fcc827f1a32790ef1e7b8e8b71a347c2ce4f443bbc24a9c780cc969f58a9a937cd6845c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775042, "uuid": "c9e426c8-c807-42eb-b25e-868fafc67b39", "value": "T1DC14D03236B0C076C89B11719C75FA652BBFE4324265854B7BA917AE4F603D0E73634B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775042, "uuid": "1a2e194f-644f-46a0-857f-38f27f91d333", "value": "8112aba4cbddc2cc0c799fee8b497e25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775042, "uuid": "d8ad211e-a641-4aaf-b60b-209452eed7b9", "value": "3072:DZBN3fidDGMxUfqaL6OlGA+5OYvScTyeWFzp9G6rAnrmfA6L8gZ4Elj7CmH:L5oPaL6O0AwdTyeWFzpjsnqfA6Ic4mH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674775042, "uuid": "94d4d7d9-8725-4701-9d04-593eff527d8f", "value": 206336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674775042, "uuid": "25d07ae0-6cb0-4344-b2e0-1c283e15f647", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775042, "uuid": "19c9505e-a06c-4636-a44b-7571ce479991", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da7a614b-9d0e-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674692263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674692263, "uuid": "ec4263f0-90ce-43ec-ad47-c8738b199acb", "comment": "Malware payload (GCleaner)", "value": "7c74e3e97f1c87e7f743e9e1b77022c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674692263, "uuid": "269f657b-da75-4855-9a27-6e92fa0ed806", "comment": "Malware payload (GCleaner)", "value": "55eef726298ef8fd64c6336d04704fa564f17436c2c43fdd83e1a1fb6d2a966e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674692263, "uuid": "c3f77ae8-06fc-433d-a17e-29e140ff1171", "comment": "Malware payload (GCleaner)", "value": "e3ebf9d570a827a8bf8fc02a41b5c7d6800bbde2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674692263, "uuid": "1167eed1-2f33-40ae-94e0-7cee8993d5d2", "comment": "Malware payload (GCleaner)", "value": "ea471fb699edae7500b6ed41253ac19d3bb12fb3119da611d7e23980e319ebdc3d0b86ca1ef9d5038e343c7247d42b22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674692263, "uuid": "582bba02-898b-4332-b663-2934f0afc529", "value": "T14F853396D2A1C0B6C3D6CF361C3886599373F411287163046A9E191D5F7EFD2ACA3B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674692263, "uuid": "50c0b8fd-89f2-4ccc-873b-a72e78e80eda", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674692263, "uuid": "b9d331f7-dcb8-4580-9a84-55e97a6a37fb", "value": "49152:ZrRX+aXLUAChmdM7xCV/pnjT9+qn8LCgv2MR:vrAA+mdBov2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674692263, "uuid": "5c6cc213-8fe7-4ebb-8eed-df491e21a9e8", "value": 1791840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674692263, "uuid": "6eab8627-8f2d-44ad-ab93-070f69858120", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674692263, "uuid": "216fb2ef-2f59-47ed-b42a-cef691cbfbcf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0080275b-9d77-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674736995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674736995, "uuid": "cff78b5b-6f01-4975-85c5-c8b2750a8a26", "comment": "Malware payload (Smoke Loader)", "value": "41986b757d631798b82149143b1d0153", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674736995, "uuid": "4ab34b80-c625-4fc0-baee-db0129b9b5cb", "comment": "Malware payload (Smoke Loader)", "value": "56685393b3981aefb17379a63085fda7e014b50e084ac5a07b7e15a08eba7236", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674736995, "uuid": "84d67665-c581-460e-bd03-8efda97988fa", "comment": "Malware payload (Smoke Loader)", "value": "9492edf759b0eef7b5264c160661475ae80884bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674736995, "uuid": "7c064568-c2a5-4ecf-9ae5-faec48cb69dd", "comment": "Malware payload (Smoke Loader)", "value": "fa71fb53f4c5b611fb5d7cbf72341106e5b3f68dd205d30dcea688cb39a38fbc80bf876cdd92aba22360567aa26bd873", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674736995, "uuid": "81197f10-7a6a-4bb9-b3fe-3f953df28c20", "value": "T13F14E0A279D0C073C56A84781D20EAE17E3BB93246A44687F7941EBE1F3C2D17B36346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674736995, "uuid": "ea203cb0-ecdc-4e49-accd-4f068a0f8313", "value": "76acbc9b0e9b8516eed30a33559882bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674736995, "uuid": "6d616a00-4d3c-48b9-8f81-fca99c5659bd", "value": "3072:IBN2dmYVCTLY30LaE/5B8isdXaV2veR41QMlXxMdA5LD8iu+oiq:w9LeVEn8tdQ21QM4dYP8iy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674736995, "uuid": "078202f6-a741-49f8-bf7a-a486aff03099", "value": 206336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674736995, "uuid": "05e40be1-c132-4924-9dd9-178c4adf15ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674736995, "uuid": "dd207c82-7cf4-4d92-a710-041d23ddabb8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5efb4659-9d50-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674720403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720403, "uuid": "5c8ad2c8-8568-4910-9a5d-c748c24172b2", "comment": "Malware payload (Formbook)", "value": "884bf256520434bf9bdbd7a760176961", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720403, "uuid": "4876bd92-17c4-4e74-8e25-f724ed8d126b", "comment": "Malware payload (Formbook)", "value": "574fce61f6fcf5e16be3fd8a77a56aeeb4d7a8868e2dccd0225c9c8c426e2913", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720403, "uuid": "446ec744-4ab9-42ef-9ea6-c5d6fa93b219", "comment": "Malware payload (Formbook)", "value": "2c79b5ca06f153b41a93d8ace4a7713d59621d9d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720403, "uuid": "7ed02b21-4af9-424f-b0ad-5b949ee34cde", "comment": "Malware payload (Formbook)", "value": "6c012f85889cc70c377fcef35a570931777260de87e26e2c380fb2b89bd1db7af4cae168557a298fd6b202574e9f2a8c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720403, "uuid": "238c694d-948f-4c01-b329-e8bf4cdbeb79", "value": "T1AF228D3CD201F82AC112447DD556C2F2F7789557E222B92D7054339E0B611DB17DE6AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720403, "uuid": "fbec9129-f3a9-46d0-b14c-67350fe65f63", "value": "192:ScIMmtP8ar5G/bfIdTO3e/YnamWBX8ex6y3slZ:SPXt4ATO9nosMsH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674720403, "uuid": "8356e02c-290e-4006-a3b9-e9ebcf923914", "value": 10371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674720403, "uuid": "77003f77-dc37-4567-9935-2a555d6a3a27", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720403, "uuid": "b8addc39-6992-4ed3-b94c-1b3ecde9df6a", "value": "Sample.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "882c6572-9d12-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674693843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674693843, "uuid": "75cc1323-b19e-4d4f-a1d6-893db2c023db", "comment": "Malware payload", "value": "cee09b5ed516fd4aad3b851424cf1b47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674693843, "uuid": "95f305e9-f7eb-4aaf-b696-1c7d6518e665", "comment": "Malware payload", "value": "57f8c66b8fa36c24f30d1e73551512a8c1343a0f709b2254fe3ee0f7b259d456", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674693843, "uuid": "518fa612-438d-4257-9cb2-7bd38bb61c12", "comment": "Malware payload", "value": "6e57f7ce0f9e01af8c8f6411cdf4eb909d203ebd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674693843, "uuid": "954fdc6c-0d6a-4bce-b187-6ada7a629aff", "comment": "Malware payload", "value": "5d6edb4ecdfe97de67a5ee139836db6fa0f42e31ba28a3e297b4f8cc1dd8a091eb266c1313862ad95012912b607c275a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674693843, "uuid": "b1658e59-c774-4e04-8ac0-9868b732287d", "value": "T19352F906FDB289F3D96607BE64558E81AE9769B643F1C0110E6C824EEEA73D00737367", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674693843, "uuid": "f9e2ff03-d8b2-4bbd-b23d-e25a9f32514b", "value": "192:fXhGHr/Kmt8dnvnnnnnnnnnnLuk5iCwayTyI1YfU6a:5GHDFOFuk5iJay253a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674693843, "uuid": "79e0aa86-89ec-4334-8de6-b176729fe028", "value": 13888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674693843, "uuid": "8d79f538-dd42-429e-907f-3314a20d1c9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674693843, "uuid": "ed2c531d-ef61-4efa-b341-b9e2675adc1f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15512539-9d84-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674742613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742613, "uuid": "029b2ad7-9e45-4009-b194-4bcabf67729b", "comment": "Malware payload (GCleaner)", "value": "03a8bd77e1f3faba719839185d4501dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742613, "uuid": "9bedcc20-16a7-45f9-b386-dd653ae3625e", "comment": "Malware payload (GCleaner)", "value": "58118ad06181c01a26b112125811572fc538e30feac43d50e459e116849484d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742613, "uuid": "caa1ff8e-1846-4ce4-b551-c5fe9a3a3933", "comment": "Malware payload (GCleaner)", "value": "dfeeb61f87a6c25c193d0584847938bfbf394f9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742613, "uuid": "57412511-b94c-4166-bdc4-26298e90b38c", "comment": "Malware payload (GCleaner)", "value": "a3a07481b4fd281c21a49c32820b02ce51ad371750c63ae17ca2a1001fe6c3b38e4a99121a534e1f956b0c86d14ecd98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742613, "uuid": "77e701e1-b37b-47b8-8261-57c3340a5e79", "value": "T12485231FA2C092BCC8524BF312206144FF779E97507F5442766D63CD2F7A3A089E67AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742613, "uuid": "daaa5632-ceaf-4efc-9e1a-72f6b8bcd881", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742613, "uuid": "a087376e-cc33-40df-849c-8e1847e98213", "value": "49152:okug+xAwhgq4CtFv3N4h6/kj0kChmYlzwAgGxUEM8zYG2pgzLCgv2MR:hug+fh+UFv3N4gBBHgGWEMQD3v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674742613, "uuid": "61ae7142-3bcd-4762-9f97-a8accae716a1", "value": 1874558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674742613, "uuid": "fce684ae-49c4-478a-87b9-dafe5fd93655", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742613, "uuid": "9c81a472-7210-4cfb-a711-6c54225d1ed3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84684b70-9d7b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674738934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738934, "uuid": "df494a35-5098-4ae8-a45c-82caf0c5605e", "comment": "Malware payload (RedLineStealer)", "value": "691abd3b0536688cff0bced794bdf76f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738934, "uuid": "3ad75541-eb7a-4bc9-926a-b1a070cbabbc", "comment": "Malware payload (RedLineStealer)", "value": "58c5bdd58725bde8e93de886595b457295582fdd1848838741ec5461c8cdef49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738934, "uuid": "a011c021-c22e-4aca-8703-a8a37105642b", "comment": "Malware payload (RedLineStealer)", "value": "5a96c7a4a94d6680b805fb1dbf2d3c91dd273a2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738934, "uuid": "ecfdf8ed-59c1-4c64-bab8-2e79d8e5b3df", "comment": "Malware payload (RedLineStealer)", "value": "344f51aa64b578803c100da1e690de9846f0e7a535daadbe124fe92f9521e43ac597c3c74cba64333ddb7899216dc327", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738934, "uuid": "2fb436b0-d11f-4e41-84e5-cdc08734bd20", "value": "T1A114E0127A91C4B3C59A45782864DBD07F37B93206BA84CF37991BAE0F306D05B6B35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738934, "uuid": "0edad68d-0edf-4057-83db-4d3772239ee4", "value": "76acbc9b0e9b8516eed30a33559882bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738934, "uuid": "37e1fca3-ca8a-497b-98b0-8254e2f9c94f", "value": "3072:iBN2n8HGqLtVi63u5qma+V9DaFNSbIeyUUPdq:WbLzi63Nma5nSbbynE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674738934, "uuid": "6d1ca32a-61d4-4db1-8f0f-b13f20984618", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674738934, "uuid": "8fb4f33c-d9c6-488e-9379-37776dfcdabb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738934, "uuid": "93ad6a87-8822-44c9-bc8e-3dd73e790f43", "value": "691abd3b0536688cff0bced794bdf76f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b36749b-9d8b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674745656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674745656, "uuid": "f1f56121-d755-4a8f-b326-d3c44c3e0ce5", "comment": "Malware payload", "value": "b1d5c70027e084f56ece407a741a29ec", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674745656, "uuid": "04a232b9-5f05-4fbc-a1f5-ed24bebfb063", "comment": "Malware payload", "value": "59d2403b99c95a057e43dd25e3d58b66331d130b52c19d2919e7966023ede5f6", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674745656, "uuid": "1ce04b34-f7a5-4ddb-8b0d-0d37eecd753b", "comment": "Malware payload", "value": "990ce0c5d785f0349ffb6f92cf4b212e52ecd8be", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674745656, "uuid": "ba906be2-1cbb-46c1-9917-4e6ee9684bc5", "comment": "Malware payload", "value": "3d5333abf8c874c3db1c8d2f82372aa0317915f404b950e68c8dd8f3f79fbe571214c05a798164bb90c0651b8771fa11", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674745656, "uuid": "317bbd45-c2b5-4843-add9-f88a0d43d7df", "value": "T1572633647CEF41E2FA6BB2760C930F080F1C5554F1B1B80A9B4765D10BA67A9287FCB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674745656, "uuid": "1ce299f7-dcb5-44c5-8a88-a3d3bb825ebe", "value": "98304:M6iEe9cH+obKZCkaAIQz+E7tvKxtX0vr4w:Txe9ceJgkaAIwhedS4w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674745656, "uuid": "8d469fcb-e6d0-47bb-9c80-90e3915a92cd", "value": 4549323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674745656, "uuid": "760826da-8b8b-481d-854b-fb943c97d28f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674745656, "uuid": "d0810e0e-19ec-48fd-b514-0e9decc43575", "value": "filesetup_v17.3.4.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c9a7b94-9d38-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674710145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674710145, "uuid": "5763a453-9825-448b-a95a-6e988e70e8ee", "comment": "Malware payload (GCleaner)", "value": "12941f773f10939977a856af84e0211c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674710145, "uuid": "24a4f877-bbe1-429e-bead-c82b10665f87", "comment": "Malware payload (GCleaner)", "value": "59ebff2952142e4cb6490baf1aa934c20eb1db41ffc86ad6afbfb2301966a86d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674710145, "uuid": "2ab3b8da-dcef-43af-a8e7-2c565955bf38", "comment": "Malware payload (GCleaner)", "value": "335f2d36d64fca01bbcc3b57b2e71448700e9053", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674710145, "uuid": "2fcb20a2-77c9-43ac-9563-763bfd58d175", "comment": "Malware payload (GCleaner)", "value": "e8e81167adb1d4c6074d925c51162bf65bbf3791173eef778d4079990475a40fcdc525b632953ff0b41a461d19b0484c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674710145, "uuid": "7e2307a9-716a-493d-a7d6-4c4e71e081f3", "value": "T19595238B90A047BEC81357F72B318385EF31FE57607C06457A2D179E19F25602A36BEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674710145, "uuid": "a7b6b55f-230b-4095-a298-9d19ff0cc089", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674710145, "uuid": "7b263185-29a1-42a8-9450-9e9426cc8b47", "value": "49152:okug+OuX/bJi6yfTFOUJVsqdOozrymupEuLCgv2MR:hug+OuoRfTgUsJTv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674710145, "uuid": "246122ae-e256-40df-b52d-3e9d478c71fa", "value": 1894557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674710145, "uuid": "13c5b30a-43f0-4ae5-ba7f-00783da40b19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674710145, "uuid": "adaaf354-ffcf-481b-9a9e-f41457a7f6a1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e2b54c7-9d80-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1674740937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740937, "uuid": "fec53f91-b8c4-4103-aba5-d76d84670fb2", "comment": "Malware payload (Rhadamanthys)", "value": "35b41c0ee34cf74fb3f48b31da461bf4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740937, "uuid": "8936e3ca-25d4-4f0a-aba9-a06210128ec6", "comment": "Malware payload (Rhadamanthys)", "value": "5a3127cabc6ac0ce108f507ae985a1be9b0cdedb70a380e58fbf722138989d95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740937, "uuid": "bdf0ed15-e546-44d6-a057-6a12bdfc28f5", "comment": "Malware payload (Rhadamanthys)", "value": "13d3718da8a2cc5388422e6c77df12a7791a08a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740937, "uuid": "bd967fa0-c508-468a-9b3f-a97767cfa55e", "comment": "Malware payload (Rhadamanthys)", "value": "1de026b0671d5b473c2bf58b5482b51658d6638ee3078ce0898afc2be3d5e0092b14e7033f6d75378010ab91add000e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740937, "uuid": "819f3ebb-e58a-465a-a088-ab86cf45dab4", "value": "T1E044F121B69084B2C592487C4C30D7947FBBB9321AA58D4F77A01FEE0F717D16B6638A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740937, "uuid": "0bac17cb-8863-4f9a-a1f8-6c6d754f090d", "value": "76acbc9b0e9b8516eed30a33559882bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740937, "uuid": "bcc6ad3d-6330-47ee-bbd8-8c2f1b7f56c5", "value": "3072:EBN2Zz7JZWtL9+atP+F5vtbYtSpH4o/wSVnUGGECV30Mm2g+obb1MBYoyeOZpcTs:caELbtP+9Uwhp3VngS+obb1MWHpPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674740937, "uuid": "6af780e4-056c-480f-849b-24d7a27d3499", "value": 261120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674740937, "uuid": "908f3343-fa0b-4e91-b7e2-679b592a640b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740937, "uuid": "75c4b08d-1f89-4247-ad16-2cfb94a86dd1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d748c2-9d7f-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1674740738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740738, "uuid": "6d0242a1-58dd-444e-895d-ba44f06acddc", "comment": "Malware payload (njrat)", "value": "a2b1e3eab0206ae9d3eedabd0d2e5cd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740738, "uuid": "023764fa-e3ce-4716-94de-07f417c9fcc2", "comment": "Malware payload (njrat)", "value": "5ace19621489c3b49a59c73552fea0aed3cd4eae367ead58de6dcfe6bbd96fd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740738, "uuid": "6adc6f06-e904-429e-bb0f-f5a974f4266e", "comment": "Malware payload (njrat)", "value": "fc7914e0321fa724550067a69dd012a07e698ecc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740738, "uuid": "0c4924a2-dbac-49d1-ae94-e75d24d0cbaa", "comment": "Malware payload (njrat)", "value": "d14e52bb81ad3b5240ac230769b5d1f378e70406bb0228e817df2a56060a2bfe39c7a27e1e8af19ebfc29b5d966dea14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740738, "uuid": "b17dc54a-1957-417f-a402-9728dbce5a3e", "value": "T179C2E049934546B3C926477AB767A28465B451EE2E4B0D3238CC9DFAFEC33D90B74780", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740738, "uuid": "effbd13c-2b75-4176-a1a9-fabe687f36b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740738, "uuid": "b12152d5-b613-4603-9c33-4ff88bde2e89", "value": "384:sv3ZIFckP/00C/wuCGy0OE1iriQIQiGcoBlFu9wTeMN6U/XdWN5OpvuK1C74z+Hc:svpV/0TuCK1dLoBlFu9wqBU/XdyZS+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674740738, "uuid": "186c11f9-a634-48a9-9151-3e6562484184", "value": 25945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674740738, "uuid": "4386af6f-eca8-4917-a864-fae20ab2d34e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740738, "uuid": "41c9e579-6355-4fa5-9c56-b76535888ca2", "value": "a2b1e3eab0206ae9d3eedabd0d2e5cd7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "638d3142-9d6e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674733296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674733296, "uuid": "88e4963f-300d-4ff2-b2aa-dfc5304c4c39", "comment": "Malware payload", "value": "07c6b14122d1d53813326e080110d5e1", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674733296, "uuid": "60a6ea50-9d4e-4c13-8878-23f67afacda2", "comment": "Malware payload", "value": "5adb32a9f4ef06c65c205c2e1c2ffefd4c78be86250561f913808bc1d37d9f01", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674733296, "uuid": "b4ed47af-6df5-4816-8cfe-420b30e57fb8", "comment": "Malware payload", "value": "fa735a3e603eae5b3d7fe2469953b066074f49be", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674733296, "uuid": "9a7e6811-2af3-473c-a459-217146fdfbae", "comment": "Malware payload", "value": "da5ad77243b4c50551506c0c9c905ab74fcf1e3cb7cb83c3a2083978c1b9b0e8657aac79788c26d1a60637163cf523b1", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674733296, "uuid": "e9b96bce-79f4-4aa7-bf30-ca66d7bf2264", "value": "T1D031400B6F1B962441773A7164A3E549ECC96703BB3B2A1AFE08C4845F3064E8DC06EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674733296, "uuid": "e5fd9f37-b15a-44cc-bfb7-771a4856cf8b", "value": "48:oR3qMADnfzOiSBZndHD1OcLrkhEskw2khH7k4uAYaPC7:kZsybF0ckmsikNwvAYa2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674733296, "uuid": "db1abaea-235d-4b75-8132-5668628d70f4", "value": 1700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674733296, "uuid": "ac0ea053-6a81-40a7-b63c-7db7012c8b06", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674733296, "uuid": "2e575658-00f1-4ea8-9320-9d2eef057095", "value": "temp\u202eeno.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe2408f0-9d7e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674740427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740427, "uuid": "b5c4a21f-d7f1-44b4-acfe-eb200216096d", "comment": "Malware payload (Formbook)", "value": "3c2fa8d6c4bc6f5d655ee6421335bb40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740427, "uuid": "6171e7e4-f5ba-44d7-8a8f-7dfbdadb427a", "comment": "Malware payload (Formbook)", "value": "5b5f4c31207ebd9feb2cc1c2917f09bb82a820c5af6b2558bce95152bf41d26d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740427, "uuid": "e0808d4d-737d-4ac3-a642-d1fc2c3f3b16", "comment": "Malware payload (Formbook)", "value": "9365a8008d7f248cc9261cf0679fae35cff48c45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740427, "uuid": "7bfc5e3d-7adf-4c87-820b-1faed6810ca2", "comment": "Malware payload (Formbook)", "value": "fb0759e52dd4dfd1360fb7e8bb556956c7bb94cfa9bb164fa443a6052b6823f3045e7206b3c4a59e5cf350824489fbd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740427, "uuid": "a13d7f54-4ca4-49d8-9bd0-23506780cc1e", "value": "T1EE541214F66CE003E59A03B13D799F5AAFB5EE2334A4030F6F547344B93A7419A0D7A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740427, "uuid": "72823ff6-891f-43f7-980f-74f2f6a46428", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740427, "uuid": "fe259787-10d2-4125-a99e-d54c8f480480", "value": "6144:PYa63cnGy9XzDqXNxVApt2aU5Fs49IwpT36bCNn:PYtQGuPWNxctE/s49NT3tNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674740427, "uuid": "ddb033cd-cb9a-4686-85cd-fb40b9975d34", "value": 281620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674740427, "uuid": "f1a50c54-2cf5-4a47-b476-2f8fc4981a99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740427, "uuid": "36387af0-69ea-4d4a-8e67-50b85623d242", "value": "U\u00c7AK \u0130THALAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbeb7a1d-9d4a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RustyStealer)", "timestamp": 1674718009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718009, "uuid": "326bc31e-4e87-4568-944a-f34ac2eb67be", "comment": "Malware payload (RustyStealer)", "value": "4609d450445cd6b7e509b2ad17185c3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "libneoffice.com", "colour": "#1C57C8", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718009, "uuid": "d35f5fda-6f3d-479e-aa1e-a7d7317d15dc", "comment": "Malware payload (RustyStealer)", "value": "5d125153aa2e0c5ab1d56a64a85d1a406c5f4d1507457c51ca17ec52a71c0e46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "libneoffice.com", "colour": "#1C57C8", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718009, "uuid": "64336a4c-0279-4273-adcf-0ad30799484c", "comment": "Malware payload (RustyStealer)", "value": "b31152ea04280478836e2c98f5abb19a421ec816", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "libneoffice.com", "colour": "#1C57C8", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718009, "uuid": "c81f85ba-1a33-4b71-84e8-e147113c41ca", "comment": "Malware payload (RustyStealer)", "value": "7178d4269ed3e6bc1b3fbdaa0fd7e5bc2227f39b8b89e101a0a3fd0fba50cdfe49414509ea7579d5543a62a6c2c778fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "libneoffice.com", "colour": "#1C57C8", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718009, "uuid": "b8ff8bca-ab15-44b9-af00-8dff464a07b6", "value": "T154166B03F6A186E9C0ADC17887579723E772BC894B21B79B5BD05A313F22B605F5E348", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718009, "uuid": "f9d4c776-3810-4e61-a059-97ffb56182da", "value": "c7940ab09ba5db7694669621de3ef310", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718009, "uuid": "67745639-8746-43bc-bdcf-1023d1c7674e", "value": "49152:ZRCEPJ+YsXP2mv3dqAUrxpZe9hs/i+kyX0HF21Av/0yCQo0H1gI5TWIx/o1B:7MUPRZkp5T1gIkIJo1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674718009, "uuid": "ecef8aee-8982-4cad-95c2-0391efe939c9", "value": 4213760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674718009, "uuid": "a9422d13-b8e5-47cb-8169-cc85396c8e8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718009, "uuid": "1afdf951-fc2a-4fa2-9695-bf41fc7cb1db", "value": "LibreOffice-release.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae19b99-9d62-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674728020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674728020, "uuid": "40958e39-dc63-46fe-a695-7c9d7bc6d2a9", "comment": "Malware payload (Mirai)", "value": "83230c26ceea1add061c41c081625e59", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674728020, "uuid": "4b023228-4818-4ecd-8e12-a4060e29a87f", "comment": "Malware payload (Mirai)", "value": "5d57c84a1567df26290800e326774767a7764863a22b54abb97a8bad16e9fd21", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674728020, "uuid": "9a9a2d8a-ad09-433d-8a16-fc9002109b26", "comment": "Malware payload (Mirai)", "value": "b8ea476dd2c641c26ea2677b1d49a54422d99470", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674728020, "uuid": "dfdad5de-6a65-41c2-9838-6b1fca5ec099", "comment": "Malware payload (Mirai)", "value": "4ee32d6c1e5dcbca697c1ab53ac034471a1e351943dcca1e0897854bd485e5201a8e8c87fa0e402c74e057af665be30d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674728020, "uuid": "cdaa96bf-9060-4f86-b981-451b0a18f73a", "value": "T139736DD5B8004E7DF85FE5BD81224A0DFA2163045FA30F2BA667FC932D73199AE0AD45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674728020, "uuid": "fdc01bbe-caf0-4d92-b3b9-e6f3a99d2cf0", "value": "1536:CEpg5jlsELcdJgA4lIciG2LjrqBI6VT4GOM7QXrWhMi8f3WCT28sm/E:B0/agA4Dip/1440Oie3W+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674728020, "uuid": "3cfe5b5b-c736-475c-8565-40fb8a19b4c6", "value": 80284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674728020, "uuid": "ede89b86-0ef7-4442-bbf8-c7f2920d719e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674728020, "uuid": "8fc8a7b1-de5e-48fe-8277-360e69297279", "value": "83230c26ceea1add061c41c081625e59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23574625-9d7f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674740489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740489, "uuid": "362bf588-ceb4-4c6c-b7ce-ac9be3327f92", "comment": "Malware payload (Formbook)", "value": "7b41e553bb3702d29f3ea22c7ed5ef2b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740489, "uuid": "096cd177-c7be-4e8c-9a52-ce4452c93df0", "comment": "Malware payload (Formbook)", "value": "5d921144b27b3fda07574f917690ad355f83eb1ec2e57eb8aa8d5234102c5dd5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740489, "uuid": "88f2c728-5f79-4e17-81c9-bcc0a50a8560", "comment": "Malware payload (Formbook)", "value": "c3ec69f99184236d414987db359d542171aa4d9d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740489, "uuid": "bbda0638-422b-4133-ab7b-910b0af4fca5", "comment": "Malware payload (Formbook)", "value": "851cc12669f78b179da55a7a20dced8830d4c6d4d8d8b63d5727bdede39e1d5a8b554bb94673ed7e446222859c26e555", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740489, "uuid": "fa0ad9c0-c931-4df1-b968-9604a51585d8", "value": "T1AC4423C4CC9B4B8331A15B8771DC0C796ACD376A7982F6F3633915E58B32A422E546B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740489, "uuid": "fd4afbf0-e797-47ac-9ef2-eea9910137eb", "value": "6144:mdyEQ+/kcHovgmHQj/yMBi86uc2LoFdwJEcaxV35DWnjfM91LSzbFcyeS:2Q+/3BmHeBXLOpca80SzbjeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674740489, "uuid": "d134c48c-bbaa-465a-8d1b-3de456055c90", "value": 264514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674740489, "uuid": "1ab10b6b-3275-47ae-b184-7bb2af1848d2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740489, "uuid": "20c6f70a-cfc5-4782-bc13-368de6300dab", "value": "swift.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d9f38f9-9d17-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674695866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674695866, "uuid": "fa81cf5f-ee0f-4ac4-8bb3-57a5fc52f042", "comment": "Malware payload (AgentTesla)", "value": "203e0f1a80489024745aba6b46ba2909", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674695866, "uuid": "911bdc94-fe79-49e6-b082-740defa9f2c0", "comment": "Malware payload (AgentTesla)", "value": "5dd95385f904bef50b5b57a7ab6427c78df4b9a93386f0ca16ee484b67ae939e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674695866, "uuid": "e2147c4d-42e0-4773-9f63-ff093070b6ee", "comment": "Malware payload (AgentTesla)", "value": "8caf007415ab9747bc6f1ac04201c48f93257ce2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674695866, "uuid": "066e5964-4967-47eb-b57d-8769769bf890", "comment": "Malware payload (AgentTesla)", "value": "3b9ba6cc6b6fb188b5e90bbdac002a29fc1a9b4afee98bdab6b7fb1a25add77b47fc2ff3c3873aa1311c5dbedb48ec41", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674695866, "uuid": "56596131-ddfb-4126-8e84-12d9d31de103", "value": "T18B056B3C09B82ADAC97DF2BE6B85E4D0FE83805EB2658DDF4AD60441D94317222DBD1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674695866, "uuid": "2b56b385-58f2-47fb-9f28-ca3fd38e95dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674695866, "uuid": "0ab8b6d3-7a6f-4dee-a2d8-1f7fb40e1f70", "value": "12288:3Q5fM5FK4UMQcCgP7h47QBeGtoQwt3pDYdJQhyRY15/LvdMYJb2wzM1:XK4UZy7Bbwt3puwFnV2wza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674695866, "uuid": "dca83b00-a6d3-4462-85a9-beb40655b51f", "value": 873984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674695866, "uuid": "577c3888-9228-4227-a394-390a31bd3d0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674695866, "uuid": "d5ae4119-aa1c-4be2-9396-48e9a461e396", "value": "Bank transfer 23.01.2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2542c1f7-9d8f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1674747364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674747364, "uuid": "ce7d75ab-95ea-4368-84ab-0b45f9f04f5b", "comment": "Malware payload (RecordBreaker)", "value": "1f02c7d1d0985a9a8331926954112582", "object_relation": "md5", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674747364, "uuid": "1624a0d0-7117-4e99-9b6b-42c3535633d3", "comment": "Malware payload (RecordBreaker)", "value": "5e0a59418c80e8c6389a06a97221ecc710b9d5e93af97a298a09c48c5100ce65", "object_relation": "sha256", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674747364, "uuid": "0744c4f9-c8e9-417c-a8e8-9cc662209883", "comment": "Malware payload (RecordBreaker)", "value": "393a08d66a0f3103195862cefbb6ba111ebe941e", "object_relation": "sha1", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674747364, "uuid": "5fdc995b-0f81-44e3-aedf-7b2ec03e15b0", "comment": "Malware payload (RecordBreaker)", "value": "b4e046f71f896fe7146beaeb63cdb76d92df72673a422250d49543674a1dab4f5a3272f4838a14db121973d523669af9", "object_relation": "sha3-384", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2023", "colour": "#C041A2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674747364, "uuid": "dfed24f1-ccd6-4533-ab2e-4a603a11c481", "value": "T1345633F076EAB1A78C4CD35589DDC2344BBDA395C91498E39D5D2CB10F3784A2E821BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674747364, "uuid": "031a4375-ae03-4fe8-af0e-d53628e2e781", "value": "98304:CxesP/4NwxN2gRPSnG2zgs50vxHNgBg05apW+C9VUo4KDnUy3cHpTagex9psfYPU:2esPLL2oanG28z5uhYpW+CQo4K7UysJh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674747364, "uuid": "1d713b48-002d-42e5-9f33-4c6805199333", "value": 6262174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674747364, "uuid": "252b29f8-d7d0-4d8a-ab2b-b09e5968092e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674747364, "uuid": "432659e2-8d42-4615-851e-5c8821f68a50", "value": "Cracked_2023.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "067a7ada-9dae-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674760627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674760627, "uuid": "d94eb83e-f785-4a6b-990d-294b1d798ecb", "comment": "Malware payload", "value": "029cb0e5df05753f569851bab0a1d0ec", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674760627, "uuid": "f558f619-892f-47b4-952a-b5ddba2bb672", "comment": "Malware payload", "value": "5ef08be9b30e988280feafeb7eb1fb9e654f1485c92584ef876f43d8a52d765a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674760627, "uuid": "71bb732c-6a82-426a-b36c-bb244f55819b", "comment": "Malware payload", "value": "52ba31dcd19b192ba6ab8171d36746002f31d6fb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674760627, "uuid": "ea9a1aeb-e1d2-42be-86a5-d4296dd199ee", "comment": "Malware payload", "value": "8c24c7dce6b2dc8884f31f45bd9f6ce32d1f4e60bbee3736c5c383180483cab6d2285b6d97144e1e14b9c43a0cf4623c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674760627, "uuid": "1c6948d2-9c51-4e0d-b01d-3ab2754f23ef", "value": "T133A0022484AC66492A83D4D90091E149AC42706881878FDBEF5A44A460C50BE8635173", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674760627, "uuid": "3a6c9c4b-f46b-4829-94f7-b9a7df254b42", "value": "3:M/4WWUKlEIr9y:MQWWUKjhy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674760627, "uuid": "9154ad85-a48c-4d19-a261-d08316392572", "value": 59, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674760627, "uuid": "085194ce-9e63-4d15-b0a4-5dd98d734761", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674760627, "uuid": "6a8513af-2750-406f-831a-099dc1e2c97d", "value": "fe383128-deea-440c-9169-8fff2fcd3df8.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "089494bd-9dc9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674772227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674772227, "uuid": "5b6b85bc-cb28-4643-a204-95598804481e", "comment": "Malware payload", "value": "5fc3149bc6605b4b01ea0de55faa47f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674772227, "uuid": "ca2a4810-dbf1-4e20-88bc-8282a296d0fb", "comment": "Malware payload", "value": "5fd6fb46a4a69fb08b31d790d106d249290c3067eb3b47e2e60641f21e2cda93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674772227, "uuid": "567e51b3-8056-4948-bd31-cea48af31cd4", "comment": "Malware payload", "value": "c21350ca00ef7409a4d86dff2f275c5b68a5cdc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674772227, "uuid": "468069a2-e5e5-4927-b8be-5d66a98f1e09", "comment": "Malware payload", "value": "53236cfd6829e2a235d63595da8e1a00d94edcfd8ecfc88a676ccd3b777cc3c2b04c65e34b2e398477dec1f4f1466f77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674772227, "uuid": "dfd98660-78dd-4663-acba-4d1fbf915a79", "value": "T11C14E1F27690C071C4E755301875F7A56A7EA5324265888BBBF50BAE4F303D0AB7A34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674772227, "uuid": "af915285-5cd4-4b88-bb0c-8e7a9c8c13a5", "value": "8112aba4cbddc2cc0c799fee8b497e25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674772227, "uuid": "1e63229f-5700-47f0-820c-d52215c1a422", "value": "3072:OwBN3yCmCUXkyLa+QUu5G/4n8ZqZr92OGd7R0AquhHoa1429LAeMoH:v1yLa+QUV5ZqNUBRXquhHoELLAoH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674772227, "uuid": "d4832244-f2fd-4444-9780-75a961b7f2c3", "value": 205312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674772227, "uuid": "4ea8d502-e556-46b5-a1e6-5ce70760846a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674772227, "uuid": "bb155d1e-bf1e-459c-badb-4d7d67457892", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "973a49fa-9d4a-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1674717920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717920, "uuid": "e6081598-c0a1-4c65-8864-8bc7c16c4536", "comment": "Malware payload (NanoCore)", "value": "6ca00483caaef8e1c6b59d85f0b8a257", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717920, "uuid": "ff4eec25-bcbb-481b-bdc4-f33e6215dabc", "comment": "Malware payload (NanoCore)", "value": "60131e4ae461f3fb2c0b931ef05d57eb222aab87ea6f79c60ffb494be8fc5b60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717920, "uuid": "715906e7-2254-417d-8ff5-5f41389266b8", "comment": "Malware payload (NanoCore)", "value": "6a13ded8c1bf87b4fa2a27688eece45e22aeb181", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717920, "uuid": "12daa771-c648-47e9-b44f-a7ee818a3e0e", "comment": "Malware payload (NanoCore)", "value": "62286e6a2a900a0660f78199739384d4d99adcb196f850c25f7f2658635749964a0b075422d5a811da730d03c2090ef8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717920, "uuid": "9115018c-0820-44ca-92fe-c6a1791595cc", "value": "T1C8F4AD5023EC9F40F6BA5BB886B9505213B77C927533E21D8ED120EE4EB2F14AB45727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717920, "uuid": "c165f0ef-3090-46a5-b7a2-d48f7e97f2c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717920, "uuid": "08f958f2-e84d-4df3-a3d7-c265ae0418b8", "value": "12288:tSkOvbnR8ey/ZhD7XDmzFqIG1WBEB1k6XraTINk5GuP2oOU3yWECeO:BvDeXG1AEI2raMk4uP2h95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674717920, "uuid": "871efb21-b179-4cfb-aa19-7027375ca6d8", "value": 723968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674717920, "uuid": "ab3cb470-2db0-490b-a84d-5659bbe2aa8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717920, "uuid": "7048e6cd-493b-4307-b2ea-080662eb5326", "value": "6ca00483caaef8e1c6b59d85f0b8a257.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aee8a996-9d0f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674692620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674692620, "uuid": "77f3c4c5-ed65-42c7-9a78-21007bdd6895", "comment": "Malware payload (Smoke Loader)", "value": "d52aaf57805b95816ab8a9edc36e2604", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674692620, "uuid": "7eb0449d-622d-4df1-9f06-6483e2e462d7", "comment": "Malware payload (Smoke Loader)", "value": "6038167f344c565e4cf48cf24c9f17d23c7faf526db11590332d293cd2612df6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674692620, "uuid": "c952dd38-1ec9-49b4-9641-601f169b99e1", "comment": "Malware payload (Smoke Loader)", "value": "bb497787d8bb5d36d16039bcc47ffddff878426e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674692620, "uuid": "632aceda-dbaf-4f6f-903e-8178283513a9", "comment": "Malware payload (Smoke Loader)", "value": "66d6ffc52b68e1d4c453ade45b1b1c5e84406bf734a1485dc651685e296dab98b0d11fb6bf170a95b1a602c2d479ff50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674692620, "uuid": "40587fc9-4b19-4c01-9444-bf44a790271b", "value": "T11B64BF2271D0AC50F9164636CD2ADBD4792EF8D28F3CB35B33D4AA1F29B32E1C566215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674692620, "uuid": "c70d8d59-ede8-4ad0-b9a1-ba79c4642d98", "value": "e5f35c047e0fdde323b83e51e689dfb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674692620, "uuid": "967cd719-ee69-42a3-b10d-e04d093f6821", "value": "3072:hetnYMLfTitbProARvlLp/e5fBGEFBnwwD8JsSY0+L4Oi/XcLYBmUT:MnLutbPj9KPnwE86SY0+MOKXfmUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674692620, "uuid": "5187daf4-2443-453b-9e11-867c2cda0731", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674692620, "uuid": "f99d2035-9e61-496c-9ab7-0912ec0f4595", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674692620, "uuid": "f0d7f392-a97d-43af-aa36-afc3e4621128", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ffb87fa-9d6d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674732887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674732887, "uuid": "965d436c-d088-4ed2-ac07-bbb160ee3589", "comment": "Malware payload", "value": "d2acb47656b51c4cb0e02edcb3f07c72", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674732887, "uuid": "c91430ed-e944-41d0-8d8e-55db3bf3b1eb", "comment": "Malware payload", "value": "60706bfa438831d03a720b773165e8e002460a7cf8cacb0bfc87e9e04e6b6160", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674732887, "uuid": "bc3453ce-1257-4696-9de1-17ab5f509f19", "comment": "Malware payload", "value": "9704465054b73f2e3c7d4eaf314887dab5f5d68a", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674732887, "uuid": "10d95a62-02b7-4210-bad6-5b9499ce12f2", "comment": "Malware payload", "value": "a7be07981959394bd78e51f56fa8e73a41a49b73b48421a4a18e08149144bd973353ab6a8be5ca16c707d2d80200c140", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674732887, "uuid": "7ac9ba54-c204-4e83-b08e-9a8fe599d753", "value": "T1B6F50055A6681306B46F4DE1889C1963D99C706FEFEC2E50CB23CB09C3D3A6D7AB14B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674732887, "uuid": "74c7935e-268e-4b9b-b598-dae3b0244691", "value": "24576:S/w39o9LUNSUbj6jjkH75PlZg5n5pYY9PBMvoNkQKAq2ViZiVSpPVJkl:cUW9LBUv6jjYgtYYovoNlRqwgJkl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674732887, "uuid": "c56d10e5-4167-4897-8fd1-91daa7787f51", "value": 3542721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674732887, "uuid": "207a69d8-9843-424d-8bde-148fbc473a82", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674732887, "uuid": "54dde744-8bae-466f-a7b3-c4ac2b7bc325", "value": "adverb-clause-definition-wikipedia.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ea8728e-9d4d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674719194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719194, "uuid": "1bbcfc59-7378-4a3b-a885-4d19d67ce804", "comment": "Malware payload (AgentTesla)", "value": "23206ba4b91c92889d712499ea9697c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719194, "uuid": "05c55649-a255-4238-a8de-d5967c740136", "comment": "Malware payload (AgentTesla)", "value": "60d16ae1c022f3b697953c3f2fc1c83c1c914a8015e477ef62aa9e2faf57bbcf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719194, "uuid": "221df2e3-5c06-4cfa-85cb-e7d82f386831", "comment": "Malware payload (AgentTesla)", "value": "4426137a05a2e3578fb194ffd93825bb3d8d498a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719194, "uuid": "eb52a5ac-9ab4-4a4b-9fe2-7c221124b645", "comment": "Malware payload (AgentTesla)", "value": "cbe99d37fef0e7680a100a34415f5341c1ab20b1499e4889a69d83b2d0ae731af24a757bb3a912af5a1a6d537eb3e964", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719194, "uuid": "07d362e1-992c-4cc3-ac78-8d9f3fa7f2a0", "value": "T19BE49D0023EC9F40F6BA4B7896B9505213BB7C967573E21D8ED130DE4EB2B11AB45B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719194, "uuid": "0fc5451e-37b6-4ac3-b55f-ac7c8123d9a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719194, "uuid": "3b889512-e23a-4552-9367-4cc43eb4cf44", "value": "12288:OSkOvbnR8ey/ZhxAXDHzFqIGTwz1ArAPNhbZlaMsNoYF7gGT+H4i/q/Na:gvxWXGkAybKaO7gGT+4i/qF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674719194, "uuid": "4e0c80bc-dd5a-44bd-b119-938d52db0059", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674719194, "uuid": "6bafe8d9-5433-486a-b84f-b47a74c6aeac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719194, "uuid": "a3e21a90-a049-4ea7-8a17-b815ba6fcb49", "value": "DHL Express Receipt_20458298122.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0abb7fd-9d36-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674709346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674709346, "uuid": "cd5d0fd3-c59c-4d71-95c0-1096d959b029", "comment": "Malware payload (GCleaner)", "value": "8ae2266779a4dec75f81832038395502", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674709346, "uuid": "c4001920-53cc-4d9e-939a-7bc8a8bddcb1", "comment": "Malware payload (GCleaner)", "value": "612ad482705ca62b23ab8ef80f1e4bced9cd50bfa7b679f066cf78e2eb8fe9cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674709346, "uuid": "13b24223-f8cc-4693-9c3c-de0ce2ff96ab", "comment": "Malware payload (GCleaner)", "value": "50333eca4d01f26cec6a4947f42ca00462f49c24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674709346, "uuid": "a9cba410-7942-4cce-aca9-9394529e642a", "comment": "Malware payload (GCleaner)", "value": "27ca09f66ee4a85d2dc590d0dbf59e7d36d306ad2d743500cfe62facb4fbb372d18e6b56463bcbc11b936e2dd6fc1aec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674709346, "uuid": "5941f927-0ade-458f-857c-45578edab65e", "value": "T1F3A5334AB1A1E6BDC423CBB63934A991ABB2FE4B103D1146315E479E0E7123114BDBDF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674709346, "uuid": "ec39509a-ac98-4778-ad87-548697c50604", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674709346, "uuid": "b59bb5b6-9386-4e1a-8b1e-8f30b4c55c50", "value": "49152:ZQug+3rVWDzG6mBRoEby75pqz1jXJUvRAuLCgv2MR:Wug+3xUG6mBRDGNpqz1rJKAOv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674709346, "uuid": "db342fef-e70d-4189-bbcf-c5d39685a574", "value": 2141600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674709346, "uuid": "08c8ca32-cac2-4aed-b76a-2e214631bfb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674709346, "uuid": "ee4403fe-8d20-4981-9b29-3958be520a5a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e820db3-9d88-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674744373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674744373, "uuid": "84808de7-99d4-4334-8a4a-1ac34c0168cb", "comment": "Malware payload (GCleaner)", "value": "27b81e73fb6e4bcfa3ce2061918a02d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674744373, "uuid": "6b7841aa-0996-4b99-9844-c8ee00205b35", "comment": "Malware payload (GCleaner)", "value": "61328dd0e8eaad08d83da9c898a3a468157f8a74491417e9fe1ee25ae8fa8fae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674744373, "uuid": "3a9b0cb4-5755-41b4-8670-7be1571175a2", "comment": "Malware payload (GCleaner)", "value": "f1aa05a1c1e7c56d1cf7bf6b700e5f0794349704", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674744373, "uuid": "d837fcfc-a632-4a66-af7a-02a7d098ffe2", "comment": "Malware payload (GCleaner)", "value": "279bde05d8e8aefb433429e5e541917bc28495f03629a7599e862286533489951c4432d86a593604298d4cf9a01049ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674744373, "uuid": "c36bda68-0760-4f60-97df-0ea6ac014424", "value": "T11A85334AB092463ED5278BF726B440C08BB3BDC7783E9157374D136C2FB66B0A990B95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674744373, "uuid": "f71b92a7-0996-44b0-ac2a-693862f47f03", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674744373, "uuid": "5fd365a9-0740-44f6-a5f6-b875f0ac3fbe", "value": "49152:okug+bbfaiDtiprdGRquNzmANIiGSS66CLCgv2MR:hug+bbfaNprdGRquNzmeItSj6qv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674744373, "uuid": "baddcdbc-471d-42b4-8132-8dab09ab0371", "value": 1870521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674744373, "uuid": "41a21f64-20f4-4abb-8cc1-0b0297111781", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674744373, "uuid": "c847e8f9-8c06-42d4-b5e6-18dcfcef385d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "344ade71-9d4d-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1674719043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719043, "uuid": "5a84efcf-1e6a-41f1-9783-abeb3b17e264", "comment": "Malware payload (NanoCore)", "value": "d24b9d226e7c2bd4e6a76cf15a0618c2", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719043, "uuid": "91d6a9ab-4a38-4919-bb94-2fd3137b2e2f", "comment": "Malware payload (NanoCore)", "value": "622624a3d0ac661bb5f198a25976d5a991fce75edf656fc247d7bf8402c46049", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719043, "uuid": "3536a94e-17a8-409f-ad86-04d10f0e1ffa", "comment": "Malware payload (NanoCore)", "value": "47879dc40b75f1be83a2328384afc25b7796d248", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719043, "uuid": "363110d1-7922-4456-baef-f1f60a556008", "comment": "Malware payload (NanoCore)", "value": "00a1bb13990202922d01da14d5947774f228eb3db11db696004cc949291e3d89dcbca7240134f8788d94f567c9e3c8e8", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719043, "uuid": "7404c6d8-f569-4e78-82a0-3c42229a727a", "value": "T121B21B67FB98137C478601A17A1F1FD9FB2EA53933A095612C6C532823968BA43376DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719043, "uuid": "9077d974-2314-47ee-ae61-d23fb89d4057", "value": "384:BQMmdOFNYY0aaaIswqPeOrka1+fHQJ+t3rQkRhZ8Y5gEwRlTpkC7cgRxa9KS:PFx0XaIsnPRIa4fwJMaf3hRxE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674719043, "uuid": "f8fae655-92bb-4362-b5c2-87b65eb45689", "value": 23541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674719043, "uuid": "7ba1d18b-1808-495e-bcc0-017eed883220", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719043, "uuid": "62420900-19cb-470f-ab5b-7e39dc36d170", "value": "DHL - OVERDUE ACCOUNT NOTICE - 1301605313.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e422d59-9dae-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674760748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674760748, "uuid": "997f1e06-0e69-4bc8-a535-6cd2af32fddc", "comment": "Malware payload (Smoke Loader)", "value": "e404df6ac1484f13a54013b45ef6f7bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674760748, "uuid": "2c24dcb4-6735-4f8c-b261-0e02eaa6e8f8", "comment": "Malware payload (Smoke Loader)", "value": "62c23706dd4558eeffb03a139602e59ad524f2e204b8bc8a2c72805630930a19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674760748, "uuid": "504e47d4-2f24-4ea0-bd59-c0e61a46311a", "comment": "Malware payload (Smoke Loader)", "value": "060abc01edc2fd55f9a03c94771fcb5cf820f433", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674760748, "uuid": "f3039492-05b7-48eb-952e-704a5e7eb8f4", "comment": "Malware payload (Smoke Loader)", "value": "5f729f2b3c8ef3f96356fdac97b9d246edb7d7866d2c925fc25dac21c1ddb73d0ef7272a896a2ef0583ba00047b332a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674760748, "uuid": "675024af-2b66-4271-b11b-afe3e18dc7b1", "value": "T19714E1213490C032C0921D785864D7A5BE7BFA3255AD588FBB681BBE5F203F1677634B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674760748, "uuid": "b57b4acf-4af3-4108-b913-611e8dbf8a30", "value": "4dfa6309511cb75d1093a1ac55cf0bae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674760748, "uuid": "ecdcd00c-7866-4d41-bbc2-2d4fcbfef2ba", "value": "3072:pBN2K8gLTgLoryNrUVb6k/5GzeVlkdBCA5RR7x20OA8r6Wj5:vvcLorBVb6kG3571hWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674760748, "uuid": "f905d591-e39b-44fc-bf4d-ab06c81fd73d", "value": 204288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674760748, "uuid": "fe530289-dd01-4719-8630-e472f9564d6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674760748, "uuid": "f588e421-3984-4ad1-830d-043470008f3c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22a4c102-9d1b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1674697538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674697538, "uuid": "a08a81f2-3212-447d-b4d4-08288b446937", "comment": "Malware payload (Gh0stRAT)", "value": "e0ad8c0a4331e2ac25a294b2b55f241c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674697538, "uuid": "8659ddd7-3a78-469d-87bd-3696095ea65f", "comment": "Malware payload (Gh0stRAT)", "value": "63bec967484a7efed512b4812a4e86ca38d6865804a5f626e9c6207a52913001", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674697538, "uuid": "b1da65e0-20d5-4f9c-bba4-2950a8220ed6", "comment": "Malware payload (Gh0stRAT)", "value": "ce9805eb560b98f39ce09c11a0bed60d25449e02", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674697538, "uuid": "c3407e0c-5792-416c-8e9b-2a3c2cbc0285", "comment": "Malware payload (Gh0stRAT)", "value": "0bdec1b536614916f8f719f0e25c97a4cc3e9282376d0874e6a562e3ab08d9e286495298fd98855a53f47fbc3e488852", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674697538, "uuid": "d84872b4-c2e9-452c-9bd8-95f4e0126ef1", "value": "T1F5248C02E69045BBE9B720B444AF7B379E7A95A40B4C5ECBB748D7A104211D1FB3638B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674697538, "uuid": "fd43ced5-49d8-4a1e-896a-4f3dc39ecef5", "value": "a9208cbd352be04e687a14e0dfc18846", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674697538, "uuid": "9cefd797-f080-4fed-a2a3-167267ee861a", "value": "3072:MdQo6wtIptugitFof9zCPc4MH77IxZa39TtsAneb/eZJH3tt4TSOB3c7TLby:iQoPIHi0zYOH77aZQ10/6JHzWSOBay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674697538, "uuid": "6211f3f3-c36a-45ad-bd48-6e9e35253899", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674697538, "uuid": "e8ec22cc-7f99-426d-904a-2aa532389546", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674697538, "uuid": "5aebe898-ad5e-48d7-9aea-3b51766edc2d", "value": "63BEC967484A7EFED512B4812A4E86CA38D6865804A5F.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc377783-9d1d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674698682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674698682, "uuid": "7b124b85-fd00-44fc-b190-10e6289090b0", "comment": "Malware payload (Smoke Loader)", "value": "c506c4fac0809e0a8d7276fac481827f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674698682, "uuid": "fd44a75f-c44f-44e5-bef0-934bd3824c74", "comment": "Malware payload (Smoke Loader)", "value": "64337a8c626b1ce61c55d6d248035dde6d9b0a41448ee5dfc8ac9afeb1c98212", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674698682, "uuid": "3104a6c1-fbfe-4a56-9745-07b9fa56f1a1", "comment": "Malware payload (Smoke Loader)", "value": "62ce2e97d724be1d281f76993907d8308f065b7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674698682, "uuid": "e5ffee37-d333-4117-9402-8325bd458962", "comment": "Malware payload (Smoke Loader)", "value": "49f14931f344dcd2ba2e8710852ae560efc2239fb2ad1f5fff53006bb8ca8f0759f3e334ea8606c215abb3c2be35208d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674698682, "uuid": "6365a326-31dc-4e65-a2a6-6b611cae8d3e", "value": "T19464AF7135D0B854F91A4635CD1ADBD4392EB8D28F3D774732C8AA1F28722A8C5FA21D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674698682, "uuid": "2789409c-3c39-403d-b5c8-956dc4297f34", "value": "e5f35c047e0fdde323b83e51e689dfb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674698682, "uuid": "10e9dcc4-19b2-44c6-9c54-e67d034992eb", "value": "6144:idLFAcamNYbeAVa0BKgOPEBMdY0+MOKXVUT:idW7mSnQ0EgOPKWRUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674698682, "uuid": "d4fc4e53-25b2-4763-ac72-16bae003e2fd", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674698682, "uuid": "56c11024-ee93-4eb1-b215-dddb664e8856", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674698682, "uuid": "f94977a6-046b-40e0-b42e-b115665b40b0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "467b1abc-9da5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674756869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674756869, "uuid": "2452c8be-9518-414c-87f6-8ea8b18ffc36", "comment": "Malware payload", "value": "dd52c86df619a976db5e1a7c6dc14ccc", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674756869, "uuid": "409c9b3c-f016-4cc0-9228-bc9c681e55ba", "comment": "Malware payload", "value": "644577128158f00fcb93b0bb29f56d93d71f05660801732d26533d0f30e0a2e5", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674756869, "uuid": "d8aed4a0-84f3-4b0a-b591-f4ec6cd37faa", "comment": "Malware payload", "value": "45834fa56ddbf85988e859d42d829ec466106c82", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674756869, "uuid": "a6af3f1c-57ad-4981-b5fe-77c5c4329034", "comment": "Malware payload", "value": "6ec4ce7a49f8e71ff3076f42c5897f73d3f3126721fd19fe9311b1403123cf2b91ebdbdf4da837089a515cbc48fdc761", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674756869, "uuid": "8a5c59ed-c099-4c14-a3db-bcdae83b045a", "value": "T1A265122321E28F94C859463A85DF4B833B4CAF5A0947A35F4325E66FBEF76F4C925840", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674756869, "uuid": "7b345501-da51-4cc9-8796-3232cb1574d4", "value": "24576:zjnrm19D7zXgsX2qEq6q7Ap/UP/h1+SJ3h7cWocw8mz7TWNT:zj6HD176q7A8h1LJ3h7T1wFnG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674756869, "uuid": "38ae04aa-a5de-4469-ab93-2319c0f78eeb", "value": 1412481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674756869, "uuid": "c75d0f1c-175f-4048-b1a4-652ce6ac5e36", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674756869, "uuid": "fc1b8c2d-55fc-4571-a02e-9f2db449ee65", "value": "ID-.8072722455.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff77730a-9db1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674762333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674762333, "uuid": "645033d0-ab48-4546-8577-bf0439dfe1f6", "comment": "Malware payload (RedLineStealer)", "value": "093b0e9c84ad70a3c7868edb2d3365c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674762333, "uuid": "b2f01166-4c09-4bf9-b169-93e6f236d212", "comment": "Malware payload (RedLineStealer)", "value": "647e82f711d6f8f87d06d10f42bb1e2e46e10b6bc4fc56f168e5e03c75a55ae6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674762333, "uuid": "523982ec-17f6-41d2-b2e0-69932b36ebe1", "comment": "Malware payload (RedLineStealer)", "value": "e634da393917d038128034b0a74e76b4bf4201e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674762333, "uuid": "efbf6a64-074d-4cf1-beef-c35f172d3655", "comment": "Malware payload (RedLineStealer)", "value": "5034da5a5b9f7d941a2632d100499d23f64f931ad474fb1eba8f3719c649241eaf94d70054941123f85afb0e09496979", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674762333, "uuid": "bf470d63-bb47-4d65-907a-ea5afcf93772", "value": "T1E807F3DC32A435CFC867C1729A981C68FB50F4B6831B93039A2B45B89E5D987DF584F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674762333, "uuid": "f6d47948-1303-4d15-a14e-2c9b7f3bd468", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674762333, "uuid": "426b0c2b-55f8-464b-b003-6e12c7db1b48", "value": "49152:tPVKZQ+rDjlPUoR4JjgDro3gut4SDimSIX7ySjPPACo:+ZQ+hPD4643guamS8mSc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674762333, "uuid": "625b8793-2a8e-490f-a659-9743ed307bfe", "value": 17321984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674762333, "uuid": "6731e6a7-3ecb-4999-b8ae-794367cdea54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674762333, "uuid": "e836527f-6423-47d6-be3b-9d9156ad5c47", "value": "093b0e9c84ad70a3c7868edb2d3365c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b7a1ed-9d4d-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1674719018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719018, "uuid": "5baa0e8a-4271-4f69-8058-937b0dac38af", "comment": "Malware payload (SnakeKeylogger)", "value": "bb69f7eeeff6a800c8d9795df4a2a9b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719018, "uuid": "c635d4f3-911c-47b7-80f5-e219af187ae8", "comment": "Malware payload (SnakeKeylogger)", "value": "6494ef856895ef1493b027dfb923b7bb2fc6b77060c64a8fc2edf8a5e8dec512", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719018, "uuid": "426fa068-8304-4230-8095-81b7460d71de", "comment": "Malware payload (SnakeKeylogger)", "value": "a08460639e04170ecc82e3a005b6ba28575c754a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719018, "uuid": "f67f6b67-1ded-44e9-bba5-d5cc3d6b24f4", "comment": "Malware payload (SnakeKeylogger)", "value": "719884053a181708ed99be311bd5f527c047b04234655fe0ee2788d53440509d8162c16435c1596ccf54336f6ce74133", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719018, "uuid": "0e4945f2-20e9-4ea6-832c-213976fefe0a", "value": "T15094F130A505BE79E65B35320D1BC9400FB1CD87C715922A2B853FBB7876BF14AD292D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719018, "uuid": "5e421d4e-fc8e-455c-be29-40e6d8c6e21e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719018, "uuid": "95da1890-ddf4-4ace-b212-22cad4923c7b", "value": "12288:TgMVggAiPBnYe7Dr9lxlcrehdtnf88iF++t:TgSAiHVthTfVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674719018, "uuid": "e6e8534d-bf38-4db7-9458-e95a907b339a", "value": 436224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674719018, "uuid": "2e2a293d-b305-48b6-b651-0372db287dab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719018, "uuid": "41e4d3b8-f963-411d-9d37-7f41a5a3a89c", "value": "bb69f7eeeff6a800c8d9795df4a2a9b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1ddf540-9d50-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674720569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720569, "uuid": "60ae3417-3432-4ad5-bba7-844bba833840", "comment": "Malware payload (Smoke Loader)", "value": "e31d6922f033032e034482475375f6fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720569, "uuid": "df907e1e-9e33-47f1-a9cb-f58ac3a54d46", "comment": "Malware payload (Smoke Loader)", "value": "64ca0707e964b2734c0f96639b9bfbc03a6336bc7e95475ea4290474d9a40096", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720569, "uuid": "30c0fb9e-0170-4e64-928c-85e4da114b89", "comment": "Malware payload (Smoke Loader)", "value": "7b0083bad0588ad5b35110bfc3a64ad9a5ca0094", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720569, "uuid": "7bf26b80-f165-4c7b-a116-fc1e541d93d9", "comment": "Malware payload (Smoke Loader)", "value": "6f99aff620d38b51fef661aad088e488640c723e1da0a0813f540900d20dd9110b91d07b9dfe9d81e0c1193cfd6688db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720569, "uuid": "3efb72bd-39d5-43e4-924e-0eb3e984d5ec", "value": "T1F514E13276E0D072C49604341C60DBA46FFAF93217A5F48B7F981ABE5F706C15A2AB47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720569, "uuid": "a448bde1-b6f5-4269-a452-5df709479555", "value": "2fb86d3afd3014d2e2e15a2dd2f620c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720569, "uuid": "235551b2-c207-4f75-8183-637a25219382", "value": "3072:HBN2zhwuL21s9bts5rpP8p1CqKxl5horkUyGqvv:hcL0s9btcZ8avLgrhY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674720569, "uuid": "928625d5-81df-4981-9ab1-79e2116df082", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674720569, "uuid": "c2f0f389-4a05-48c6-a368-f64ac35e44ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720569, "uuid": "7203e062-ccf3-4b9e-9d06-251b1f077058", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60628bb9-9d50-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1674720405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720405, "uuid": "7acb6709-92d2-4011-a247-3203d1f408c8", "comment": "Malware payload (njrat)", "value": "aa02ffcdd9be18725d8692f63c417f60", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720405, "uuid": "52d74520-a1cf-4a24-b7eb-f003edd4ee10", "comment": "Malware payload (njrat)", "value": "65439e1ba65950fc678c09e45679444e67d02ace8bb4fbb6f7ac4dc1d12138e9", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720405, "uuid": "67228ff1-0dcb-432f-aa27-8bdb695a5a26", "comment": "Malware payload (njrat)", "value": "1400f890e08baab910770f881336ee9a98c6c95a", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720405, "uuid": "a296f89e-2c90-4b91-bba2-18c8790c98bc", "comment": "Malware payload (njrat)", "value": "f7629a02159206ff617428e8c0c8cf30f4b7f822932fcce348b42f7e31ad6680cff162096a0ebb632d6c1f4fbd21e848", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720405, "uuid": "2301e5eb-1ed7-4fe0-a5fa-9ca1e87c3668", "value": "T1D9E3C05538DE5C4D2362AB932FEBF6BE48BEF66340E921BD10415A0A47D1D10BE127F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720405, "uuid": "a2735e10-bbed-4c74-a695-aee11a6e8a2b", "value": "1536:tEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEPEEEEEEEEEkEEEEEEEj:rP+bhDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674720405, "uuid": "169f6f5d-7123-46d8-9914-350c908b5652", "value": 146160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674720405, "uuid": "94917068-a3f2-4c60-bc59-66c5e223e39b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720405, "uuid": "4648b516-b282-4f1d-9245-15efa79087a8", "value": "tmppctljblp.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a552f36-9dae-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674760822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674760822, "uuid": "10d0723f-23b7-4162-bf04-70c8d26dc009", "comment": "Malware payload", "value": "4741c9007935834a1c0d3bd1a944ea7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674760822, "uuid": "3fc2ab76-98af-4dff-8608-99149e2bbf73", "comment": "Malware payload", "value": "660cc0a60f288d45e501a2c3ab109318e7ad294e7edd2a0525ef5832ec04ec59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674760822, "uuid": "011040b0-d1de-475c-a65d-aeb1a74c4f58", "comment": "Malware payload", "value": "5d0480568510f03748591f1b0411f19d9314fefd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674760822, "uuid": "bba69ccf-99e7-4a1a-b6f6-b519739ce40d", "comment": "Malware payload", "value": "e0b4ff0f56df074c37833fd3a6953e8007d8a1b2a0553a4cc72973c9f333888122b22fd520596a7928252b748792c8a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674760822, "uuid": "e726bf64-8ace-4c68-925f-8b68fb46633f", "value": "T1EB76335137E0ECB8CA4627309A22CEE272BB65447E298CB3374C066F5E3D4D4D64DD6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674760822, "uuid": "7d65cdf2-d1f2-4016-9573-1b9c4fd2eb18", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674760822, "uuid": "4cd716a5-0dce-40d4-aba3-56c696933804", "value": "196608:91Ol7Oou5DV9gQvb7a1IB1wj7jPx9+q8Alt9jGuqbhLzd:3OlHu5YQ/ai+yxct9jGXl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674760822, "uuid": "1ddeb321-e839-4faa-a232-be9c39125583", "value": 7633338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674760822, "uuid": "56ff715b-36e4-492f-a691-fd87f5c98d4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674760822, "uuid": "05fcb344-ecbc-4dd4-a56e-a6295ad06299", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "801dbebb-9dd0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674775434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775434, "uuid": "2a96f1f6-9e94-466b-8032-aa81d172b35b", "comment": "Malware payload", "value": "121c7babd57ff4220ed0bad90df2e887", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775434, "uuid": "db233f4e-eedf-466a-85c4-de43d5365360", "comment": "Malware payload", "value": "66300b4bba3339dc6a30aa8e849c632badde59475913f7a5167f0c0a588c5e1a", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775434, "uuid": "6be90fc4-2663-437c-93fe-ee3456b44e8f", "comment": "Malware payload", "value": "732617281dd4c315407f1330f3fdde5f94a4c4f3", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775434, "uuid": "dd6aebde-4895-4cb0-ada8-a5358e618c77", "comment": "Malware payload", "value": "b0dbb6aad25397b33036842d1725b2bc188260b4839fdc7d2bf25876cc1cc3db70afbae5e5a77b79543c24c429be02cb", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775434, "uuid": "6fde3149-35a9-40f3-b3bd-d413386616e0", "value": "T18F31611417F12615D53885325C99A714CB71BC1A9757DB3F0DC6A4847CD43406E2EAFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775434, "uuid": "f0c761e5-c484-4715-bd37-e897a10eeb21", "value": "24:8eTpWuQOGUBll8neABC6F4o0cgb8ClWIy73jDMSF:8eTsQGSllDASomvl033X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674775434, "uuid": "2733f136-baf5-458b-9980-671921bc0304", "value": 1623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674775434, "uuid": "8015e2b8-420c-4184-b34a-6ee7742a09d2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775434, "uuid": "6bb81b6a-c6d3-4f26-b12d-ada89cdb6d87", "value": "732617281dd4c315407f1330f3fdde5f94a4c4f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143bf479-9d75-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674736169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674736169, "uuid": "89cf3359-7907-4d2f-a8d5-08097bd276f6", "comment": "Malware payload (AgentTesla)", "value": "802b89e1cdf76e51b9f082a05c3eaf34", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674736169, "uuid": "d4b24916-ade9-4864-aaf0-d7ca604b2420", "comment": "Malware payload (AgentTesla)", "value": "6688763571e1e1b2bf8e0aa07e10fde2c6c7882aa62d43b2fe049b539e2b8044", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674736169, "uuid": "2257b1fe-769d-45d1-a34e-716950e1e3f2", "comment": "Malware payload (AgentTesla)", "value": "5f5cf918964840a9c22c3f5fab1cc7403573bc1b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674736169, "uuid": "49ec4377-89aa-46c7-8deb-6ef5d43b6578", "comment": "Malware payload (AgentTesla)", "value": "a964e46bd441f968d8d5d1aa88ee73ab33b0424524f6b3b200542a3ed0cc928197fec60ac9eacd85675b4b4cae8affdf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674736169, "uuid": "15692af2-7dae-483f-8bc1-2fa80912ce80", "value": "T142E4BE722E03C055D9AE0FB1FD26E2C20F9A1CD915A8F2612DFCB2285CB1E9B564537D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674736169, "uuid": "21e55ffc-24fb-43f9-851f-f45865db194c", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674736169, "uuid": "daa0c342-d759-4623-893c-717fc6c01ef6", "value": "6144:WYa6mUeUcyeecOwMZGcFMvYDrGOvInXX4yxhmScgXR7bW:WY/5ebzRcFB5vf2cgXR7bW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674736169, "uuid": "6135d750-a2d8-482a-969f-ac18a7db30c6", "value": 679876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674736169, "uuid": "ef1e69eb-d8d3-43d5-acd9-a5b46ba50084", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674736169, "uuid": "d33298ce-c6a4-465d-bb51-a328d5086952", "value": "802b89e1cdf76e51b9f082a05c3eaf34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c28c5123-9d33-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1674708115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674708115, "uuid": "71c40ab3-09e0-4e4f-afaa-3554151137f7", "comment": "Malware payload (AveMariaRAT)", "value": "3b8487e22ee5ce7c2549ee960c88e2ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674708115, "uuid": "cf0e74a0-c6be-4b35-a76c-b9a6c827571f", "comment": "Malware payload (AveMariaRAT)", "value": "671a6e9cd09c116447784c4c85d6b755bccd9f6eb5ec23f6df79df92cb0e859d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674708115, "uuid": "b3d297f5-f60e-47c0-aca1-314c29e7c489", "comment": "Malware payload (AveMariaRAT)", "value": "301d0a52afbc697ecdc286636d1786fca58c8d0b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674708115, "uuid": "86e3c347-608a-4d50-8bb9-6004c168eaff", "comment": "Malware payload (AveMariaRAT)", "value": "529149f4c6a2d802f95689cbc8b4112c3377a11c6c95032648078658bcf63c3960121b5b5fc8b7165faf85ed1926ebfb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674708115, "uuid": "53bd4b41-6735-45d4-a663-e1261195b328", "value": "T1EB441214B5F4C0A3E5724E722D770B7589EADE210865B79B27840E09BE37392EF0D792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674708115, "uuid": "0837251f-f18b-4a35-8cb1-d5b3cfd8f20f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674708115, "uuid": "cd8be2b3-bd3a-4396-96a0-624d5127fe31", "value": "6144:pYa6b4V3owAaZlrL7jnie8pzPrpsDGPIYmMlDPT:pYN4V3LH7jnie8peDGPykPT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674708115, "uuid": "73b4d131-4a64-4db8-a87d-5628da7ca8a4", "value": 264239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674708115, "uuid": "7d2dba89-4b69-4fd6-be12-e9ced1f7ff14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674708115, "uuid": "2b6cc5a6-7276-4128-9f55-355fae1709e2", "value": "3b8487e22ee5ce7c2549ee960c88e2ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "accdc92f-9d79-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674738143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738143, "uuid": "01ba1e3f-624d-44ee-a5bd-8109aab9f3a6", "comment": "Malware payload (GCleaner)", "value": "5d89b74132c41479253e36f89da44893", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738143, "uuid": "f7e7b83b-a0fa-4b34-8ea1-724daf28c18b", "comment": "Malware payload (GCleaner)", "value": "673b6949615d94d76884fd5ba008f5c6479425ccaf9491394286cda8e5711778", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738143, "uuid": "0ce418bc-c161-4bf7-a169-01fd0a55d996", "comment": "Malware payload (GCleaner)", "value": "fa918f77be7b8ff6858828c6c7046c640dc3f261", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738143, "uuid": "5bcb3a6a-b40c-466f-80a6-661abb7b7416", "comment": "Malware payload (GCleaner)", "value": "d2080add016c9a285566dfbf2d365a6f92454688bebe8657ca791092a52cd64989c4510ba3cd9a1fefa4706bc8330163", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738143, "uuid": "d8e0f448-8d56-4fe9-960e-20c8455d47a6", "value": "T103953347B8D05ABEE46A97B33478D041DB27BD47A03C518572A5228C4FF1B312AB1AFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738143, "uuid": "ba4653f3-e38c-4489-9889-a6fd85f229eb", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738143, "uuid": "a51de9f6-b57d-42e8-9bfe-f4b3fabc1e53", "value": "49152:okug+0oKi40jPQmEZNTNpqTgF4CoxytCSSxwZ9DLCgv2MR:hug+Mi4MPiJW+4C+Kl2wZ9Hv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674738143, "uuid": "03124e1f-bbda-400a-a8e4-57f201bdca13", "value": 1907626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674738143, "uuid": "60a386b1-45f6-47f9-9a96-4fe6f10ce12f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738143, "uuid": "0f16ac4f-caf4-491d-8708-b9160bff1a13", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bcd8788-9dd2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674776259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776259, "uuid": "ca4e315c-499b-4675-8af1-ae0cf805018f", "comment": "Malware payload", "value": "12c3dd3fb878cb556498a6cf1358663b", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776259, "uuid": "a072c47f-8512-430b-98f9-7241641c3827", "comment": "Malware payload", "value": "67fec790c36ca34844e6a0ba9c49e1ab1f150905ff412cd9ece72608997a15d3", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776259, "uuid": "ec68ac7f-a474-4afb-a9e6-96be644ab888", "comment": "Malware payload", "value": "8f2467852737420b6a5cec3a5923c72e41c35f1c", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776259, "uuid": "a999383b-7e32-4771-b932-d8cef62e81d1", "comment": "Malware payload", "value": "d189985db288b149afda4882353204b5f4f05edc7aef346dca488f6be86145cf30f59371d04d1c0ee934b386afe68cfd", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776259, "uuid": "a7bef4fc-fc03-4a6e-8774-69216029c145", "value": "T1E641AC603BE50319F3F64E725536AB604A3BB855DE66830D0104D68C5862B18FC7EFB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776259, "uuid": "8563fece-3f1d-4941-a8af-d656b6282770", "value": "24:8WJKn4bRVMTbuA9Ax+/J+ZAl8YrXEmqddNXuHY86Rm:8Wcamb1io0AlhrXEVdLXuH+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674776259, "uuid": "93987971-d231-4f9d-9307-e07f5d5ec583", "value": 1996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674776259, "uuid": "1f7edbf7-eef7-4f01-9dfb-79803a999711", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776259, "uuid": "0051faf9-6ba2-4876-896f-3d722331bd28", "value": "PolSeg_AR.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b05b5383-9d36-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674709373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674709373, "uuid": "4dcac028-2dd7-4c7d-b73a-0d8e8746eb00", "comment": "Malware payload", "value": "cdb4a479c6d771ce2486dcd8a0710da4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674709373, "uuid": "205780f4-4191-4126-9ecf-82fdfec866b9", "comment": "Malware payload", "value": "6861c3e3e9df546ec9bb9b74e32fa73fa94ffd7a2f69a592c3bf52b0420f328a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674709373, "uuid": "335b4742-dbdb-4799-8b11-d3b6bc2a41f5", "comment": "Malware payload", "value": "0cabc37c527ba05152b7575362221d71c5dd5779", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674709373, "uuid": "151707f2-c0e3-4b54-a17b-87138e8c500a", "comment": "Malware payload", "value": "9c0ef005f30b0f81a5d939118451c79ff1be9b287bf4d5fd94d71ee967651f888a51f38b7fd2adc6b42118c59e6a60c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674709373, "uuid": "d42e5a28-1968-4ca9-9733-f47f9bec1fd7", "value": "T14A7633553EC6D876F580C4318928BF8CE49ACE7085269D6B63B94B7AEBF91B4D713030", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674709373, "uuid": "d900dab2-c0f7-47b1-8115-becc7f8b4f9a", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674709373, "uuid": "3516801c-64ec-4c47-b065-716bf87f502e", "value": "98304:91OpbR4sCDv0yAt5W7j8C7AaYIeO3MCKqbPV8JxOywdEMevfX3P1+RI6F:91OpzCDMyD7jn7AO3MkbN85n/3P1+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674709373, "uuid": "ef8eed87-7560-4f40-9670-8c45794e5cca", "value": 7580109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674709373, "uuid": "8856773b-7d33-469c-8bd4-d312c396c05d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674709373, "uuid": "c893c4ec-37a4-4fba-81b8-62a7a9289bf7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a2268d-9d5e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674726429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674726429, "uuid": "0dce0c9f-b860-4888-947c-1b640b620c78", "comment": "Malware payload (Smoke Loader)", "value": "8ae67836bd393794c0a8bf60753e96d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674726429, "uuid": "477f1403-b391-461c-bd4b-38bd5260e473", "comment": "Malware payload (Smoke Loader)", "value": "694b89284b851b51d65667c4ae7490c29ce1bee5a1aa0343eafc5aa70e09b5a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674726429, "uuid": "5d2b11d3-0d40-49dd-a46d-f634b87482ae", "comment": "Malware payload (Smoke Loader)", "value": "7775e65a5b7d4c8deffe288a5c9808b027167bc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674726429, "uuid": "6bbb43e8-bde7-46b5-9538-dd04a6cb898d", "comment": "Malware payload (Smoke Loader)", "value": "4d1f41bf006165d8892b87f1a24e4ec60d137b98f1d9c2d864b267fb9260373ad6d0d83a6fd93af876edcb427efc4c0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674726429, "uuid": "2f3d4668-6624-4c77-b20a-f1ed1ea2478c", "value": "T1E414E1617A90C033C5A644351C24DBA43FBFF932569489DB3B9816BE5F707D06A3A38B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674726429, "uuid": "5c359473-a1cf-4932-ab7c-a6b485c2da8a", "value": "2fb86d3afd3014d2e2e15a2dd2f620c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674726429, "uuid": "3431d95b-bc2d-42fb-9b8f-bcbe90d0bf21", "value": "3072:pBN2W4CJfLShTIJEf5n2hA3udosc7YByyt0LMMsX54Fp+rq:v1JLAIJEgheudPsIGLPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674726429, "uuid": "806d7c3b-dde9-4e10-9e09-260953c0c95b", "value": 206336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674726429, "uuid": "ed2fef1a-cb96-4d6d-a108-e3fdacf8fba9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674726429, "uuid": "a5b728ac-076b-467a-96de-f8cd255b98b2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afef9383-9da7-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674757905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674757905, "uuid": "6fe032f2-9128-4a97-a340-fdd7489d3fb6", "comment": "Malware payload (GCleaner)", "value": "aedba986bcb83f9b30167c344e42005a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674757905, "uuid": "952db788-7e06-4829-a476-2ecf17c1682c", "comment": "Malware payload (GCleaner)", "value": "6983cc86a386c04a383cfbeaaf06f97364fe43d42ecfdbba9aab98750fa2f472", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674757905, "uuid": "c21e02ef-74bb-46c6-b056-e02dfdb07498", "comment": "Malware payload (GCleaner)", "value": "1704ed0d489c13f71994e551c058143b8596943c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674757905, "uuid": "2a1e2bd2-14ca-4e51-aba4-02e15d1a0b34", "comment": "Malware payload (GCleaner)", "value": "1895300249318f67b91951281ca230a8bcbeee1992b2714209168832b42fd23f1e2aee97d48d5efebaa859c17e4ad032", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674757905, "uuid": "1adef863-13a5-4dcf-b024-dcf32ccb5551", "value": "T10C95234651AA89FEC612C7B66D3151D06BB1FD7B387D18283D4F238D0FB22607CB51AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674757905, "uuid": "bc5fdf15-41e2-40af-b479-08b96027842e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674757905, "uuid": "40f6dd5f-842c-4628-a115-89e5b431194a", "value": "49152:okug+wO797PAPDeUZG0XtHymHhUuQ3I7VnuWgkTNTVLCgv2MR:hug+V79gDesG0XJymH6uSI7VuiTJv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674757905, "uuid": "a9f96bf7-a4f6-47fe-9dfc-f6c062daba49", "value": 1884720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674757905, "uuid": "3e516978-48e2-4802-b573-06b84688999f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674757905, "uuid": "f856c15f-4953-44eb-bb73-c7101f521355", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a86a7de5-9d60-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674727398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674727398, "uuid": "73959dcf-5ba6-46f0-8be2-fd432cd8b415", "comment": "Malware payload (Mirai)", "value": "d251c3a7cfee658301ec66ba7471c71b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674727398, "uuid": "dbecb657-afee-47f3-8a27-e67c088e54d9", "comment": "Malware payload (Mirai)", "value": "69886639f6b9442a3488f9a279f4c90ef720179fea818e03463b93baf6e3b20a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674727398, "uuid": "e5bf8797-de73-4f89-97e4-746771e3f2d4", "comment": "Malware payload (Mirai)", "value": "ca1e142f5bafc8ae8eda036fb5b6338527d5d06c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674727398, "uuid": "b1c281d8-cd64-450d-8762-17f1aa09b671", "comment": "Malware payload (Mirai)", "value": "3ffe0a55be42030319626525fe152277de922713c7870c60613ff6362059c813ccebc2a9ce2f6c205ba81e61df959ad6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674727398, "uuid": "8bd13808-93d3-4b91-9ebf-cb291d919e4a", "value": "T1664302B389062BF645E01E35FE9F0333D3EF5B37912250E492251628085F6C5EAE64A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674727398, "uuid": "336801b2-e591-4e2b-bc60-f5ff6f5be3d1", "value": "1536:f74AWVHhn6sPEwi1huU3qK3eqZ0kDEc37cFqg:f74AWpZdcFXR3eqGc37Kqg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674727398, "uuid": "0f67a98a-52f2-449d-ad48-3268da533e5b", "value": 57920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674727398, "uuid": "cb7f8ef0-0c98-42de-a2b2-0e89ebc7bc48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674727398, "uuid": "51ef29f9-82cc-485c-9dca-bd0a39a9f3a9", "value": "d251c3a7cfee658301ec66ba7471c71b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ae70cf-9d62-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674728093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674728093, "uuid": "14a85dbb-dcb1-4d9f-a345-efaf8ea38ed4", "comment": "Malware payload (Mirai)", "value": "f2cc007763b159609c52e2b213f17895", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674728093, "uuid": "26cacd1c-2433-4cec-8e6d-5bd4417509b1", "comment": "Malware payload (Mirai)", "value": "6c21e9f5bea995cd3addc9439ad9b8a6ddf05531641718d081d09b64ef5ae067", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674728093, "uuid": "539537eb-854e-49f1-b81a-698304f1cbe0", "comment": "Malware payload (Mirai)", "value": "17696bbff57c9400a5ecf5942a463e88cefdcc8d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674728093, "uuid": "8a5e0782-2745-4849-8346-3a9d143324b1", "comment": "Malware payload (Mirai)", "value": "54f65963541505265e6774077e8b0ba3ce4aab5fa33f1aa947ec1933fe1a0eb39e3c68af6306627c1dbf3f2e28ab9836", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674728093, "uuid": "25db732a-b8fe-4060-ad41-8077df0e413d", "value": "T189E2E097E6ABC7D0E64CB4310D9EBD0E4E6A615D61AC42B3EADC057016E3FB0072B652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674728093, "uuid": "f11dca04-cd54-40b7-b436-52bcfdffc9eb", "value": "768:zddQo6DxGSZQGuGaCoA4pNDBNyZnMV7VGknbcuyD7UiyqO:MvFGSZQW4bpHkMVx/nouy8ZqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674728093, "uuid": "85b2b8b9-692e-4b56-83a2-fcf7b5ec8c4f", "value": 33016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674728093, "uuid": "c266d7b7-9f08-4c81-b9d9-d43894a40197", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674728093, "uuid": "8ff43f5a-0107-459a-8315-452c2b810079", "value": "f2cc007763b159609c52e2b213f17895", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc2fdc97-9d1f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674699568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674699568, "uuid": "e7b80491-54b0-42ee-90e2-ca0e05451634", "comment": "Malware payload", "value": "09e41b63596595e01d6353397379d4b8", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674699568, "uuid": "f47bdcf9-8685-4182-8d89-eaea52cfa113", "comment": "Malware payload", "value": "6c2593495f096600a182592fd6ae283227b7de36c28788998811ed05aa6583ee", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674699568, "uuid": "165ef0b3-9f5d-4320-b010-5f313049daa9", "comment": "Malware payload", "value": "c9735453ff438a43ecfeeeb76fcf8425e003e0c9", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674699568, "uuid": "8d9f1921-a628-43a4-8d05-0ceedcbe13c8", "comment": "Malware payload", "value": "d715343c074c640a7c9e2e2ed29c4f9e5d503ccb034b7557d4517ed1a5f1e2029444ddb400881359e2a98e8e60708b42", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674699568, "uuid": "f3a92f48-4a5d-4174-9d57-cee7f77b6c4f", "value": "T1382733A35C1A9DDAC132A435063F63456870CE2D3EE27B221458DEB7C5F38B5C9D9AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674699568, "uuid": "7c219fdb-6c7b-47b0-8985-8182f307f371", "value": "393216:+Ld7sJA35z7A79L+feF1mbgafiubcmZvbbT9i/zVN2I+TXARiKpPbNiRSKcsgJ8:+pIJA35z7c5/DmbBffc0vhi/zVN2IkQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674699568, "uuid": "6d4e5f5e-6617-41e6-a9c1-e09dcf096823", "value": 21502322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674699568, "uuid": "074d4acc-4d18-4416-8aab-c2acda87915f", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674699568, "uuid": "3dbe3565-5744-4274-9be4-3e2c40cc603d", "value": "prog.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86312990-9d4d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674719180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719180, "uuid": "3c60ca36-95e8-4dcf-9781-73f43a65113a", "comment": "Malware payload (Formbook)", "value": "f64bd40babea994f476af8ea75b1f273", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719180, "uuid": "65be3847-b5bb-4218-a93a-7639b1618e99", "comment": "Malware payload (Formbook)", "value": "6d4fce8c50efc17742ec19fc86a78d00e5907889459049f0492e5d9211a9a224", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719180, "uuid": "f3cdbaa4-9a8f-49e6-8a69-aa8fd3f11a4b", "comment": "Malware payload (Formbook)", "value": "23bf6cf8825c228c75c9b4a1d8b513fce6c38825", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719180, "uuid": "8e83567f-908a-444f-a418-a057e8f83efb", "comment": "Malware payload (Formbook)", "value": "c8bb920edbc02d32e49137a4d6fc5cfc208ebfa885def614cede76aef944d61875e3b7d44aa6e59a61008f951a49e4a0", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719180, "uuid": "a22ff086-91e0-42ab-9110-1cc8c7f8df6e", "value": "T17D34E1CC326032EEC86BC5769EA41CA9FA64786B471F4317D46702ADAE0D987DF150B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719180, "uuid": "9cd44bb3-24eb-49b8-b3ad-404403119ea2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719180, "uuid": "7fb2f783-165c-4b12-8d98-df88eb0800ad", "value": "6144:WtIg2FUT3TZpoWGSZJzplb4yah03SN7MtZ:4Ig2Fo7oWXJzjZW03SN7MtZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674719180, "uuid": "bb64cb60-85ce-4368-bafb-3e5cd5cd47c8", "value": 242176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674719180, "uuid": "a28dbfa0-a67e-4f4b-a05f-993415d45696", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719180, "uuid": "5f42c6bd-d448-4a6a-9b71-a7b300e51a28", "value": "DHL Express Shipping DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fa84899-9dbd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674767166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674767166, "uuid": "0cd2aee4-2222-4583-aa16-1c68319676ac", "comment": "Malware payload", "value": "6e7c5e1e726be5e49ccaf616a151666c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674767166, "uuid": "6e528929-a844-4928-85fb-08f409cedfe9", "comment": "Malware payload", "value": "6f00491ae0a8259acd4627f978e43935fdaec6b5f729c250ce685aba47116c33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674767166, "uuid": "4e1173da-2bc6-4edc-ab0c-ed42802c4783", "comment": "Malware payload", "value": "0bbe1f9ae6e18188f1785b9747daa9cd020f6550", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674767166, "uuid": "0f234c94-a254-4107-925c-3581b9c0107b", "comment": "Malware payload", "value": "0d30f688ea6c881d143c58d7a7084fc1942e0c44f55086c514f7752c71d3d1fdc14a57d694302a646963f68a54add8c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674767166, "uuid": "41497e8f-d033-424c-bdc8-f3f76a6f1054", "value": "T12776336072EDCEBAC19149F4E1A17EC860C9E905B65BC563A7C601FF7F6D3A0C019A1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674767166, "uuid": "34c16033-a8ae-4892-a16e-f01c1d96b9bd", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674767166, "uuid": "b66599e7-231a-420f-aef2-ded332b06b3d", "value": "196608:91Op5MscRvkH9cCJHf1j3pybLKzWwSDyF/JOZd:3OLSRWJHf1jbzWpm/Od", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674767166, "uuid": "9c9d30e0-660a-46c6-8307-a8a7bb13b26a", "value": 7581794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674767166, "uuid": "9089eee8-4a60-4e1e-aebd-d1d51d8001fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674767166, "uuid": "d274f94b-4892-4206-b85f-b5f3a2cf392b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35330cc0-9d3c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674711743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674711743, "uuid": "a520e2e3-67db-438b-9e8a-7fafd6128fd0", "comment": "Malware payload", "value": "3d2c5ac3f8c0956c5409bfd47e9d3c8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674711743, "uuid": "4d2cd0ba-9523-47c3-841e-e26cc43a94d8", "comment": "Malware payload", "value": "6f5f3fa6376a72dfa868dee7d240b278dff9d5ba1c8be4b50a4885e3dbf6a741", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674711743, "uuid": "61a46ddc-d365-4f69-a6ad-e4b104f7a7f7", "comment": "Malware payload", "value": "7dcd3bce697a708522d3403754e5858ab1b5c9df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674711743, "uuid": "88d9538f-3fc5-4a0b-8c78-549ef6938e30", "comment": "Malware payload", "value": "9893198e09f8f05dcbaa1aed9ab983b40c333a3ccbd16f00e3778f3649e551bcc40b7775e75d70c02568aa9491a65b91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674711743, "uuid": "cbc8f0a6-a51d-4247-83c5-80fecfa326f0", "value": "T1A54302125C1B821EF895EF7B4B09E4163B072375836109C12DE2502FD9E74F92715BBC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674711743, "uuid": "1a94703c-3500-4d05-b3a0-1ab245efcfc6", "value": "95e71cff07f4a18cbb53b590195f742d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674711743, "uuid": "c55e1340-73fd-40d3-bec1-24fd926808f0", "value": "1536:F4sZaIVAUDC6x/XxkmsdOEp5UjSS9D2VeJginz:FBC0KzOEpi9DVgyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674711743, "uuid": "00d00f8c-d259-4956-b880-40770d6d0ac2", "value": 55808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674711743, "uuid": "40d92035-9d8f-4dfd-b8f8-85fdcfe8bada", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674711743, "uuid": "1d9c001e-792b-4d38-adc6-d47a80c2b9bd", "value": "document914228096.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45bee4cd-9d8e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674746989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674746989, "uuid": "ef5739e5-a6bf-455b-a1de-17580d581e82", "comment": "Malware payload", "value": "5652649ebbb1a3cb1f676e000a16fd1e", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674746989, "uuid": "c05c0fbd-67d6-405e-93d7-84d039a1a5b1", "comment": "Malware payload", "value": "708672c71424a591875edf339b33aee34b77577d2b4c34a265a637ee5c7dd339", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674746989, "uuid": "a5dbdb1b-1772-4957-a308-d2f3f99920ae", "comment": "Malware payload", "value": "dc48f076ca3fdcbe83944b0aab209c6fcd15ccd3", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674746989, "uuid": "807a562d-7464-400b-87c8-416af6475ba0", "comment": "Malware payload", "value": "e8dd66857fec247249414b00ac3964f2bc71be5f17a3405969b4a81b865f8041238b1c937d7c6e6055744ea3db989c69", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674746989, "uuid": "a5406335-efa7-47a9-bd51-91c0c66bfc11", "value": "T1841533076D9ECCCB892DABF798FF4F01C99E9EC202265A70E6567122FDB0614D137842", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674746989, "uuid": "3ed3056d-10aa-40db-ab4e-94e8a9380739", "value": "24576:DbVErbEDNenSUK7XAmaHAEBBcobWghSqFpa90QvIo:DbVSgEus5gErcobthSqq9Hj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674746989, "uuid": "36b06360-77a8-45ac-8b5d-3e032d0542b8", "value": 959688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674746989, "uuid": "98617aa9-dc19-45c8-8cc2-4e0a727a62a4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674746989, "uuid": "ad7c8da0-df27-4dc7-907e-a0b8cdbdaf38", "value": "RFQ 01.300.TRGVH.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61698c00-9dcd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674774094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674774094, "uuid": "a929d9de-2c75-42e6-a00f-1938715f031c", "comment": "Malware payload", "value": "7c41e390323a85268f86fad6e2f89de9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674774094, "uuid": "abcc34a0-6188-44a1-95d2-6d76a3831258", "comment": "Malware payload", "value": "70916c1c9d322c1d2ead7b2c1ac6c50620cea11462f81ccbb2cb181f60c5eb91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674774094, "uuid": "e729f379-c021-4415-9045-379967931837", "comment": "Malware payload", "value": "ed0652a295d5997842825560bf58a99d31d76f0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674774094, "uuid": "c2fc2023-b978-44ad-91fa-5db88ff98a36", "comment": "Malware payload", "value": "70d9163cf2e0b9cf1d42b1e03072618fd8d205ecd265e2ba4b831be8550d5d8162ec2dada410c1ab7eb7573ffc3cbe6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674774094, "uuid": "492b24ab-8ad6-4447-b80a-b16267bcca6b", "value": "T15A85334F9181C6BDEC6386FA1A3651808F72FD87907DA10635B96BDC1BB11702C76A63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674774094, "uuid": "228fa2c7-5ab5-4383-bfd9-5fc2b6a0436d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674774094, "uuid": "c3a36789-a75f-4e89-9937-412aed29e3c1", "value": "49152:okug+dohDcnG6K5Z/bA0R3ftI6MCR0rxtLCgv2MR:hug+y1cnZWqfCR09xv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674774094, "uuid": "ba4c90e7-8ef4-4250-bea2-31cc031c0b3e", "value": 1857459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674774094, "uuid": "49ea7bfa-d979-4b92-95de-c00b55bfadbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674774094, "uuid": "741c2689-6836-4c5d-bfa7-36e6326b1000", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17e64f1b-9d45-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674715559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674715559, "uuid": "3f08ee0d-4f88-4ac2-8afa-7d66f8001634", "comment": "Malware payload (GCleaner)", "value": "dbbcbdfa82878ba5572c9847beff5e74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674715559, "uuid": "899c099b-effb-4146-87fd-f8e268553e90", "comment": "Malware payload (GCleaner)", "value": "70c77ca8b2d9e1fdfc1dd7294312da1760c0930ae38816e85c732cfa1a9383bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674715559, "uuid": "6a0c5a67-29d7-4007-a87f-3809693a25b4", "comment": "Malware payload (GCleaner)", "value": "b17f6835c7adb68bc46d92d7c8567b16c1857036", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674715559, "uuid": "fd4e78fc-0359-4b28-83ec-fed6c71f0d88", "comment": "Malware payload (GCleaner)", "value": "3151075a78c64f0e63db44dcf1356a3fd1b0c03951178069422e04706a18111cd7503a7d6d5afd06719146f5633d2528", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674715559, "uuid": "69207ba1-af47-41da-85bd-8ce8d39f5884", "value": "T18795234BA081C1BDE186C9F637315091FF36FF8A917D5450733D27EC1A32270A9AB9A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674715559, "uuid": "85cd6f0c-220f-4e12-94b4-1c9cd066ceaf", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674715559, "uuid": "7ff8898a-e867-4ed5-acb0-2932371801e4", "value": "49152:okug+iaYHbM8NjN+EZGplYqM5zsvFjebUl8LDkftRLCgv2MR:hug+C7MWULPxMGg5819v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674715559, "uuid": "ba34faa0-069c-4b95-8760-05d719b80fd3", "value": 1908398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674715559, "uuid": "d29cfbc8-eeb6-4fd9-8ba6-ff29ae911b49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674715559, "uuid": "ecae3843-fbe0-4d05-aeea-2cadc954ff4a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07d83b48-9d7e-11ed-88f6-42010a9c006e", "comment": "Malware payload (zgRAT)", "timestamp": 1674740014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740014, "uuid": "e3549614-51cf-455a-b154-e2c1f7d74e33", "comment": "Malware payload (zgRAT)", "value": "9080db121e052df6612caac56b92289f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740014, "uuid": "ee9d65a9-0266-44bc-bfbb-31d8576148c1", "comment": "Malware payload (zgRAT)", "value": "70dc64ef58ae040539e03e7158c2f3ef142160276f21f57502e5dd015ce843ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740014, "uuid": "53bdc752-5e54-4957-a335-bafb7b39d3ea", "comment": "Malware payload (zgRAT)", "value": "57d403ad3d89c1b6f6b2bc8faa94558ec89b6943", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740014, "uuid": "677cbcd6-50f2-4eb0-bb7f-1cc3558cb247", "comment": "Malware payload (zgRAT)", "value": "e4884c450ab172ee1045c79073765af27f21ca7b583b9c5a7f19056bbb915bff4c5205aaee76e60f4510f3de6ffd7661", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740014, "uuid": "d012c5d6-70d7-4c12-bcfe-065b67cd44f1", "value": "T14995339896A4C496CD49CE3F63EF33550F6CECB40D83F26B1C3596E6AD84250D3A412B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740014, "uuid": "d348fa54-8f74-4e43-abbb-45e711542342", "value": "49152:ZjCLM6j9yY6Ilr6205zeSlEPOU1pWdk+awV8Vr:Z+L1Yd0rIVeFWUEk+awV8V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674740014, "uuid": "8d423ad1-3cfd-4086-826f-25b78969c313", "value": 1893376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674740014, "uuid": "2bad7cbc-0350-4e6d-a066-320bd036dadb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740014, "uuid": "7ea0177c-1806-4532-b241-bbb88c7d6d93", "value": "pen.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a607935-9dd3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674776632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776632, "uuid": "9ab20859-fece-44a0-9a43-e038bb316e92", "comment": "Malware payload", "value": "a5bf79eb941c6b46c54f1c7eeed61e0b", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776632, "uuid": "e0fd568e-71f7-45c0-b445-97f9e99ec94f", "comment": "Malware payload", "value": "7149d908813641a2262abf5d9904879f4336b66d0e62fae49dc79465a6058d14", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776632, "uuid": "c7213f2e-49ba-48f7-ad8e-ac3c641e32f2", "comment": "Malware payload", "value": "c3e4aaf8a1ead1b0e7839c23f39285ce6201a667", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776632, "uuid": "c7219dc5-8c9a-4cde-9acd-41b4c158eb35", "comment": "Malware payload", "value": "1c5ac217de2b0a410e161af4f9ea507c57100711ef7f780e518b921cb1a906bd921e6702987cfd52cb2427d9ded8367a", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776632, "uuid": "2803a949-23ec-49c1-bdd3-1f673fd87f41", "value": "T1D6412E2853DD1944C3B79D36BDB8E55046E7F8164F31C66E068452C34F14B28DD36B7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776632, "uuid": "a3a4e78a-8943-475c-a2e4-4888dc27df43", "value": "12:8HjGQ6lRaDQMX8LpOf1yUfSUSCUfefqbcPl+Uc7c3Prfq:8DQlRaDxM9e1yVPCpf8cPl+/Q/rf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674776632, "uuid": "a47e6cfa-0513-4a6b-ab13-b56684b5daf3", "value": 1978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674776632, "uuid": "85f6d9d0-c417-480a-9fe0-8918acc9c0fa", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776632, "uuid": "2f0965eb-3477-48a9-8259-38c23b2b5bb0", "value": "INV.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f21c648c-9d68-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674730958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674730958, "uuid": "2327c45e-33c7-4b03-a67f-55bfc857538e", "comment": "Malware payload (GCleaner)", "value": "2ead909ee4b1f2f08082d3f8aa02f2ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674730958, "uuid": "4f8ee53c-aeba-4dfc-b60b-e4dcd7efee9f", "comment": "Malware payload (GCleaner)", "value": "719e5c8b77653f46b6e6bdf719d227d34aafc16de0c9fa719e20d80b73cea924", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674730958, "uuid": "1dd39219-0e37-456d-a689-53eaafd19709", "comment": "Malware payload (GCleaner)", "value": "bd8cdb3dfc47fd29539e1ddbd1197265c248575b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674730958, "uuid": "35f03eec-8eba-4539-a467-d03bb96c443a", "comment": "Malware payload (GCleaner)", "value": "785ff8584c9a9c824391b3aabb7606e1480866e035b29e5b452d33e23267b9b56b92b283324e099be9812b3f1331e46e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674730958, "uuid": "32217785-fee8-430a-a406-57b4c9e116db", "value": "T14095234F5281827EC966C3B728319A01AF73FF87043D2652B56C66CD2E377A12D31B99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674730958, "uuid": "214f16ee-7050-4347-81f7-72a3ad987add", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674730958, "uuid": "2e48ec43-f274-4363-964c-ddec1f90b6e2", "value": "49152:okug+L1j0flMZNfzmlsAc7uT1HYr6ZaKKVZ5Z2H9OLCgv2MR:hug+5j0fl2qsFuxpZT8cH9uv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674730958, "uuid": "1fa51585-6b27-4ea9-b690-aa8c508f75a8", "value": 1913107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674730958, "uuid": "1d7c263f-3541-4c95-9c79-8f3d470357e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674730958, "uuid": "9ccee77b-4e49-4e54-90ef-dff6449dd702", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3761e419-9d41-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1674713894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713894, "uuid": "eed84b6e-46c4-4f29-9e1c-6b8b1f0ed734", "comment": "Malware payload (Gafgyt)", "value": "4d6f7d044ee91f9b13025a1596c57d3c", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713894, "uuid": "032bab5b-0479-495f-84d6-80206005b79e", "comment": "Malware payload (Gafgyt)", "value": "72471ff6a5a4de04d57a5296ed977ad68d1fc18961a64200ba077bda4d82b412", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713894, "uuid": "93acd0b5-ccb7-4376-814c-e2c40a7274fc", "comment": "Malware payload (Gafgyt)", "value": "867909fbaf36b598ec8ca7b42ef3b66a9d8f21a2", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713894, "uuid": "43058ca8-08e4-4b25-adb2-189120a133da", "comment": "Malware payload (Gafgyt)", "value": "6f6cf54a05cc06a28e1377e841d0a153be5f6a96ee6feab96015c1ba51e8d8f258f967c73f3f249f218907730caee752", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674713894, "uuid": "21d3e41c-681d-496f-bab7-d29c02e8c54e", "value": "T1EFF3EA23F2928CE9C05549F122DF32909963F27F45BA3197FB551DA0BF5888B097AEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674713894, "uuid": "882bcf3f-f667-4676-8a7e-d3276d749ed3", "value": "3072:eopJpANNKmFrjSIWyUa7EDKrqZW32jp4zmFyVrpQrZsNj:XtAN8yCIWyv4mzmFyVrpQrZsNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674713894, "uuid": "e050dd09-6cbc-4a09-a5cd-492d924b70a6", "value": 161282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674713894, "uuid": "6d4e2779-d32d-422b-af1d-f2521492dabf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674713894, "uuid": "d12e90dc-098e-4fa7-9b43-5a293fde9f19", "value": "4d6f7d044ee91f9b13025a1596c57d3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36f902e0-9d80-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674740952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740952, "uuid": "debc10b8-8784-464c-bcea-e37d092b0b92", "comment": "Malware payload (RedLineStealer)", "value": "5f289e70fd770eff10d5300c180c7ec7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740952, "uuid": "b099f0c3-6394-45c2-8499-97ac22d1c8ef", "comment": "Malware payload (RedLineStealer)", "value": "72e13ee3f2b24d3832d76a9356b89d3b0b4eaf04cd53a197e56447d00d72e418", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740952, "uuid": "41081374-799f-4b3a-92a0-da7804591bec", "comment": "Malware payload (RedLineStealer)", "value": "d3164cf3921200cf40a00b49e0badbef8c45fb89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740952, "uuid": "cab04f23-04a7-461c-955d-61c45fb2f734", "comment": "Malware payload (RedLineStealer)", "value": "2a455c3eb7406d9a6153aaaea2b7b600a5685edb48b4e620dfb6a7f94d891717ebcbe11bd4bd82929df7495087591085", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740952, "uuid": "baab8cd9-0e7c-4182-83eb-e51028bf1c38", "value": "T10064021275D1C073C95604F89D10FA406F7BB9332AF1988F7B451ABF2F742D1666A31A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740952, "uuid": "37da1db1-67d9-4191-aa2c-40d45761464a", "value": "76acbc9b0e9b8516eed30a33559882bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740952, "uuid": "22a4f423-b1c0-4ff1-a400-f6334feecbc5", "value": "6144:45LoE1FeS9Q3QSJdfvImk/48qENz0SceN+qYiZ+Chp:g8E1FeZ3QSzfvUIENzVcFq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674740952, "uuid": "fa3c27de-53e2-4781-a840-c1f3a4b855af", "value": 318976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674740952, "uuid": "8f668bce-692c-45a8-8e4e-1128d8204c1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740952, "uuid": "4740a2c4-ac1f-4479-8b09-e136a191a8e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef90f232-9d20-11ed-88f6-42010a9c006e", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1674700030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674700030, "uuid": "1ce84849-f93e-46f5-8487-1e4278211881", "comment": "Malware payload (RaccoonStealer)", "value": "542f840a3fb2a7e1966aed9b9ea708fe", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674700030, "uuid": "fbac2ebd-8357-46c5-830f-6acb79f3b7b5", "comment": "Malware payload (RaccoonStealer)", "value": "7313d3ef41aa937bba4dff6b14fd5f564eb919864f1927056cec319122c37170", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674700030, "uuid": "fac0d1d2-a355-4153-931e-def7a5749834", "comment": "Malware payload (RaccoonStealer)", "value": "700287a5481d6f5c4138cbbc88bc9eaed679c2e5", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674700030, "uuid": "5fd4be2c-c113-4b2f-a9a6-92a6f09bcc43", "comment": "Malware payload (RaccoonStealer)", "value": "a8a783bc75d18e769ecee844e53233066c0461be2119a895261eb4cbb161cb54e01588762c9d901d69c07b76e46384b1", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674700030, "uuid": "54bd79af-8bbb-4914-b2db-693d4fecc760", "value": "T14B26F87B70DD0E12EB5917D4DA63A5BB5DB8F4B31389ECE8725ED080EC9A8189C13742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674700030, "uuid": "809d62c7-a13a-4396-8716-0271c14e5452", "value": "98304:BEjFd/umt99PLAX8426f4D1D5FaXqq0zWnAm943jvu0k:BEBlum1DAT2MevFaBEWnROCX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674700030, "uuid": "6f7ede22-c308-46f2-8168-5c6663c356dc", "value": 4802962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674700030, "uuid": "1bb3d180-b09a-45ed-a8e2-90a58dd00a5e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674700030, "uuid": "2d357d68-467d-40bf-ba8b-547e7c8fe544", "value": "setup_win64.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ed9737-9d56-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674722832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674722832, "uuid": "804b919a-a07d-41cb-8c9d-ee0f182981d7", "comment": "Malware payload (GCleaner)", "value": "2cf8d070a1a08522aba8229d3a2ab04a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674722832, "uuid": "e15beeb2-69ff-4b4f-ba25-6791d78461b6", "comment": "Malware payload (GCleaner)", "value": "750d5f3ff9765a6101dcc51b1b0ad3a37a4cd43934b5a878de29821f2b4658eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674722832, "uuid": "6f3a42b4-ac3e-4947-86a8-9af264617570", "comment": "Malware payload (GCleaner)", "value": "c1c7f207f5452f4bb7c696df4436e35850ecd9da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674722832, "uuid": "0594b6ef-0f75-44a6-8981-72aa9c015059", "comment": "Malware payload (GCleaner)", "value": "0346b5be28de02771aa9b98acca9ef91194f4156a9cf982cdc61a60a8242fb8c4d8d80c3c4584a14fdc4868a97a2d53d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674722832, "uuid": "913dcf6f-31ef-47c3-9c69-25e408061388", "value": "T14F95338668AAD5BDDA274BB71A30C540B77AFC9F103D106239BCB29D1FB22215C7176C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674722832, "uuid": "2b5c80a4-a7c5-4a52-b086-b4b07e4940cf", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674722832, "uuid": "4f0ce597-b7e5-4d2a-bf7d-4063aeaf5326", "value": "49152:okug+sWx34H6YXzMsnswgihnPVevo3+iuLCgv2MR:hug+sWCzXzMsQ+Qvo3NOv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674722832, "uuid": "a325c813-5e27-42a8-8f76-2e70c9af17e0", "value": 1928251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674722832, "uuid": "4539987f-ba30-447f-984a-d821f4b68433", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674722832, "uuid": "58c89b13-efae-48c7-84f1-62ad6300914a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "689e4eb3-9d11-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674693361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674693361, "uuid": "a48ecfde-2a30-4b74-af1c-cc922b8c233c", "comment": "Malware payload", "value": "760aae55f42eb1a88aa2832360ffbcfe", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674693361, "uuid": "965b3c49-3cb8-477b-a50f-88e0eb5b52da", "comment": "Malware payload", "value": "756555727f6fc4df2f382a955385f17005dbe3588b1b0fa25e6f47dff24a2b86", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674693361, "uuid": "2e9126ce-40d0-4736-b10b-1b7a3144a475", "comment": "Malware payload", "value": "ea1266b19d9942675e02fb2559ec1d6b139ee37e", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674693361, "uuid": "60fdd22f-a1ca-446e-bdb8-1676b33a3ce0", "comment": "Malware payload", "value": "de25c42a9c0af613fcedfce15ea96cfc7dfe1284ad3d0421f7537508ce209407fe83ce6ece5c8344f42592f7dd29f3ea", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674693361, "uuid": "946481d6-2d57-4572-bdae-a949026eb6b6", "value": "T172363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674693361, "uuid": "b9586f17-2c55-4bc1-b41e-46b60cec3c92", "value": "98304:6v4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXXO:6vpvFa+g8RWLdPk/84tCEr0RtNiC5eSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674693361, "uuid": "b3160f4a-9035-4e92-8467-bae80a4e2b21", "value": 4992000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674693361, "uuid": "491ae857-cf89-4195-a192-2f3f83269de9", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674693361, "uuid": "c0eb306e-fc1f-4ed6-a9b3-65e3f08da634", "value": "756555727f6fc4df2f382a955385f17005dbe3588b1b0fa25e6f47dff24a2b86.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccc5319a-9d66-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674730036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674730036, "uuid": "d39c202d-ace8-4d27-a25d-c6776153f52b", "comment": "Malware payload (Smoke Loader)", "value": "7ed80923ee2020d232526864a240eabc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674730036, "uuid": "5ab342fd-8935-4ce4-b594-0d459259a0e4", "comment": "Malware payload (Smoke Loader)", "value": "767d0097eaf452e9bf99a4428acecd1180f14889474cc8fe40073f4d61e06fc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674730036, "uuid": "0a87c3aa-ebf0-475c-8691-34c3f674e5aa", "comment": "Malware payload (Smoke Loader)", "value": "8b8199039ae47f78ef8ec36c83f161b4f77711a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674730036, "uuid": "3383d4f1-2b30-4833-bcba-e32963f56984", "comment": "Malware payload (Smoke Loader)", "value": "5c98c0955d60b7893345239bda2500d02d9c7cd3e8a1981992d0b5290f2f98944ac5febfaf40e7a44cfff0de736658ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674730036, "uuid": "6950176c-63e8-493c-ad74-1c30d5bdbd11", "value": "T12514E021BDE0C032C4A644715C30D7EC6B7BF93256E9888B7B545ABD6F703E1672A34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674730036, "uuid": "8b248c50-c8ab-42db-8152-734c90f29de9", "value": "76acbc9b0e9b8516eed30a33559882bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674730036, "uuid": "ea94b5bc-9b60-4418-a130-b38449837e2f", "value": "3072:DBN2W/UFqLf0n+4Ai59ycIXenJzKv7Fj8bqIR0pMeyn6HQ/3Yqbq:NzLt4AoJ+v7FvA0e6HQJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674730036, "uuid": "3001ea89-52be-4849-b273-0769149c93f7", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674730036, "uuid": "faf9a5d1-7d3d-4560-8e55-a61579be9112", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674730036, "uuid": "1466f30b-40b7-4c3e-98df-74e1b1f360a7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33503452-9d3c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674711740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674711740, "uuid": "b2cad0ca-5069-48c8-9ab7-36c3ad1de856", "comment": "Malware payload", "value": "efdff21e774b5a456dd9aa44f3027aa6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674711740, "uuid": "cfa63aea-6e59-482c-9dee-f1caafa8d516", "comment": "Malware payload", "value": "76e105ffd7f49482dad0c73adc27df4273d204dd44f3e70faae0408cb801d6bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674711740, "uuid": "c59efbe9-b3ea-42f7-8f1b-3206d32e0729", "comment": "Malware payload", "value": "f47cfcef1770dd4217c92b2dd840a57cb7e459db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674711740, "uuid": "477582f8-b015-408e-baf2-b643ef8e545c", "comment": "Malware payload", "value": "0373d820dc213845b3a835934728ce2b88752660ad68adcec7e2ab0de2c2030b8ee13ea672e9d3fc919aa96300e42944", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674711740, "uuid": "9f806a7f-5c5b-438e-938b-fc953e739e4d", "value": "T1A5B208882BEC0626F7FE5BBC94F716825B71A567D813E34D0C89109A25673D08A50BEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674711740, "uuid": "a15572c9-6f31-46e4-8fa6-342dbdedd745", "value": "384:/MSnjZVjMfnyfXGFzpAZkYLd04/vBoKQpYdpUjdQYezMDvrHDt0okjbK3EQ8kuIm:/tjUaZ0+vBoYdpUjdcwnHxbUkWq9mnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674711740, "uuid": "8b883710-d37b-4438-8d42-55a24309eead", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674711740, "uuid": "f25dc9bb-14a2-4f04-9f32-a818a7aee977", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674711740, "uuid": "3dca77e4-4c89-433b-a93a-c10c12287015", "value": "Draft BL Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05e58df8-9dd1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674775659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775659, "uuid": "26c02149-73fd-4215-95da-d1480b24ab38", "comment": "Malware payload", "value": "ae0b67d92aca040b70000c36a227197f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775659, "uuid": "96167422-718f-4abf-a099-d268214c2833", "comment": "Malware payload", "value": "77040011bde9c6a10076c7293b5d06a3a139a6dd6b70365cb970b574f388ad4f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775659, "uuid": "5083f6b6-c49f-4108-884d-24bf1a2b3f79", "comment": "Malware payload", "value": "5120d5383008087acf89371c1f603afcce8e04b4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775659, "uuid": "4726ffe1-ca1b-4d6f-806e-9e6b7a01e478", "comment": "Malware payload", "value": "a8238239d12c151912762e9b40a281a59b157fb94fc6c4b98137e8cd1f128db900488ddccebc84f1c0d95fe4ddf82921", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775659, "uuid": "6dc1b357-1d01-4702-9185-ff9d81313de0", "value": "T17063E8AA755070769E13E4B1502B504EB27F543BF44E08ACE2A89DE1BFF28DE057272D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775659, "uuid": "3e1b8a3b-0edb-4d42-afb8-192e4c403b12", "value": "768:I/lZmHFDcyE/WfqvqoeFGMvFzsiOPNDD7BLQGrMqCDYRQ8JCPSjn5gfGGCe+U22+:NjEFLNrBHstajTBsufBF4COGfX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674775659, "uuid": "247477e0-e669-4fe2-a3f6-a10e638cf8f1", "value": 73065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674775659, "uuid": "b363ea00-1d99-46db-89d5-aa57467ea9de", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775659, "uuid": "5da44d15-ec9b-4f73-880e-9d8b82c268f9", "value": "view2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "833edd04-9dd0-11ed-88f6-42010a9c006e", "comment": "Malware payload (IcedID)", "timestamp": 1674775439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775439, "uuid": "496d0a94-7bb8-4857-b567-a61dcd956a79", "comment": "Malware payload (IcedID)", "value": "601b3a5450d6e5eaaa98d6e57cdb8ba5", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775439, "uuid": "423a1188-ca3c-4d57-af6b-ec580db39d38", "comment": "Malware payload (IcedID)", "value": "77ed0dccd237b248c1ad2f0eccc4e4ac97417f6d5b1367ee489ff441d8100eca", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775439, "uuid": "5e7356c2-7a8a-4642-9415-e2be756c85e5", "comment": "Malware payload (IcedID)", "value": "5ec471d1c200a5133081e11ba5e140eb4099b57a", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775439, "uuid": "f92abb29-5425-4aa5-bfc7-8857159458f2", "comment": "Malware payload (IcedID)", "value": "2c204c795f10b5c788d0f758a802af23d2524fd4a3dc3031f0b8c4517774a73637bea0e99cbba42ad09d6e52cbbd8dc6", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775439, "uuid": "eb5abff4-5ac8-45fe-ab91-81852a707972", "value": "T12C31142E57D54216E1F34272A8FBF215C313F915D9678A2A41C0A18E9961210FD25B3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775439, "uuid": "a440a4cc-f910-4493-8547-172f2a3bab5e", "value": "24:8XWJR4so9oDlss4yMpBzbSt+/U4I02Gd+dsT+m9l:8+gAlszp/IEIUd+dC+Gl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674775439, "uuid": "c8a050b1-93e2-4755-bf53-5f29566cafab", "value": 1800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674775439, "uuid": "7b60611f-e993-4497-8e77-e7b33b24be97", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775439, "uuid": "bfeb66c2-dde5-4e1a-9738-4e7238973f75", "value": "LUGGAGES.LNK", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9ed1522-9d7f-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674740742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740742, "uuid": "288bbdd8-cf22-4f14-9336-0e0b1e752e65", "comment": "Malware payload (GCleaner)", "value": "69c53d208b15d92b0779c86aad137807", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740742, "uuid": "670df292-0c14-4fcc-80c2-30cbe7c46581", "comment": "Malware payload (GCleaner)", "value": "7814064b65bf34bf2e4b43497ee1bfcd8c61b73532751658278aaa8c2c554496", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740742, "uuid": "d5afe5b6-f163-4ac8-959b-22c3d7da6b68", "comment": "Malware payload (GCleaner)", "value": "0620e2937af3732b92f5e5777dd6010d07c8ee2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740742, "uuid": "c69d64bf-9be6-4a11-a60d-594caf26dd96", "comment": "Malware payload (GCleaner)", "value": "79f8bde958465c5dff264f727f512155935e999367ae48b380981e64d5c2aaf10564a711e39b11eb50fcac38c826dbdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740742, "uuid": "96c95895-53be-421e-9b35-9473e1be9446", "value": "T1EC95234661E148FEDA6689F732304480DF72BDCB703D4411765E53EE2F362B06EA668E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740742, "uuid": "fe1cde3a-2e4f-4a52-a006-2e0a7951a691", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740742, "uuid": "ffd461db-2bc8-4a47-8751-8ed768566af1", "value": "49152:okug+hbExLlVPuXyBF0mVppqTIlg3+4mvykTQLCgv2MR:hug+2jF7qT6gu4I34v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674740742, "uuid": "07ff89e8-f61b-4c44-94d2-d0176532a4d4", "value": 1879138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674740742, "uuid": "1dd7c554-7a89-45b3-bea4-3a011d888c28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740742, "uuid": "d8d06731-2694-4099-a3d7-e8fd3c6fb08a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "132ecaa9-9d62-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674728007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674728007, "uuid": "466c5ed5-1333-4723-b597-7ff6dafb10e6", "comment": "Malware payload (Mirai)", "value": "8f155d7e2b87d1ff33269814851ea666", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674728007, "uuid": "3b01d35a-ba50-4cf6-9d01-afaeb758e643", "comment": "Malware payload (Mirai)", "value": "78962d0497c62984f0327a51ad719cd44ae201716c4752faa873ef1b3467363a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674728007, "uuid": "9226ba57-5932-452d-9b34-f4c45fefdece", "comment": "Malware payload (Mirai)", "value": "bff86d6e3d9a6435e1fb16114856d9ff483228a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674728007, "uuid": "bc126188-caa7-445a-88b8-d406ee682747", "comment": "Malware payload (Mirai)", "value": "94ae51eed4d439a12c60fff1a5c79931c433a57da641b57caff8b18c042c663a8e2e5c1151cdced69b5d08fa0d7f4618", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674728007, "uuid": "86acec72-13e6-4e4f-9975-0915abcf85be", "value": "T1EC03F13F510A4250BEB040BFFC2A8A0753BD67B48A9E7693615C1395BAE304167E4DCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674728007, "uuid": "b20a6c00-afb5-44a2-a535-c125c421765c", "value": "768:qCtJ2UxFZ96ezh3WSVHGhpw3Df+ORosu5ILIFrwEi/OoMOwq3UIRP:qGJ2UxFZMIxWSVH0w3DfJRxDIW3rFN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674728007, "uuid": "55fd086f-2c95-4112-b1b9-c00408c5b1de", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674728007, "uuid": "cafad5c2-9f9c-4beb-a11f-d8441928444c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674728007, "uuid": "dc300545-8c7a-4dfa-9190-db046a61b70e", "value": "8f155d7e2b87d1ff33269814851ea666", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f3c7b4-9d34-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674708360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674708360, "uuid": "5a938309-1911-4209-959d-34dcc299d1df", "comment": "Malware payload (GCleaner)", "value": "1fcd27d46b52c04426a52f6c35c988bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674708360, "uuid": "34ecd55b-128c-43ad-b2ea-39cf41f55f0b", "comment": "Malware payload (GCleaner)", "value": "78ded76f4294bcc49261feb819ef5979be8ab661dcc0cf553c90e14f52e73177", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674708360, "uuid": "6c3f6715-654d-473a-b936-bb27a582ce0e", "comment": "Malware payload (GCleaner)", "value": "f5bba6f32a9fb21ff7daa62cb2ee497457f8e54b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674708360, "uuid": "dbe804d7-97cf-4e5d-958e-42cdfc7c2f58", "comment": "Malware payload (GCleaner)", "value": "d5f50d8c17f5763d58bd0a07b40825cb965c8da45d7725f994a1311583cb6de3fb54e7b06f96670aa449c2b014f4f37b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674708360, "uuid": "090306a0-bbd0-4a26-8f75-39c98b9fb8f8", "value": "T1F1A533A9B49048FAF411C6BE7A309991FE72FDE3202E0205766E13CD2E756B049537DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674708360, "uuid": "2ab31327-a139-4723-8be3-fc81b6cdc62a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674708360, "uuid": "e10a5623-a4a7-4fb5-8261-4373900dfa53", "value": "49152:ZQug+ncA/0WZf1sm/roppbcuck0us9bR93XzDSG2qLCgv2MR:Wug+cA/Ffim/roppYVWs9nzuG3v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674708360, "uuid": "2dc2442c-b681-4789-aaa7-c7a4e014724c", "value": 2176327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674708360, "uuid": "648bd347-29e7-4e10-9add-65f011d93a21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674708360, "uuid": "02e31273-0f03-4297-ab14-4f8f49608ca7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbfb0d58-9db8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1674765334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674765334, "uuid": "a3d4cfdc-f379-4404-944c-2ca86f10ce61", "comment": "Malware payload (Loki)", "value": "a0c1eee76f19d04eb95679242a5d2ba2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674765334, "uuid": "79eca497-cfd9-40ae-a07c-a6c2d7294707", "comment": "Malware payload (Loki)", "value": "78fbe00d497dc9ee0fa4dcbd83d5b04928bb6c952adedf721e9c577548ce8c12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674765334, "uuid": "c91617c0-7bfc-4198-aafa-d3adb241b707", "comment": "Malware payload (Loki)", "value": "985fab934a3291ccdd65f3b6ff97ddd6b4f04174", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674765334, "uuid": "2ab967ab-0a07-4f9b-a792-1ffab8a018cf", "comment": "Malware payload (Loki)", "value": "d1c89592a19682ce5bb6b2bfc759a5a04593748dd1a6409994e1f366b61945af4aebeb4f92a066892ebf782406eaa417", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674765334, "uuid": "917d8718-03e9-4027-b4cc-b5f7ede0d3b8", "value": "T10525E1E37D00929ACBB45FB220699DB26379BD6DFA940437B098736F4877067031AD27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674765334, "uuid": "be9b7f50-98d8-45cc-8120-73a1a0a3b7b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674765334, "uuid": "dac91a0f-44c1-4565-a737-64587a18a332", "value": "12288:4m7tnnKUsQH0gVm7tnnKUsQH0gnzNdewwY/wgoe4fLYwLcfCLFSLfmJ:4m7ZH04m7ZH0sfwfecYKcqZSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674765334, "uuid": "98ca44c5-b0bd-400d-ab73-fbcd1717a2b1", "value": 977064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674765334, "uuid": "b6288725-32bb-496c-ba37-ebc0d5558e4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674765334, "uuid": "3adc5d50-b167-4255-9c10-8d97dc69fa05", "value": "a0c1eee76f19d04eb95679242a5d2ba2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a53558bf-9d65-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674729540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674729540, "uuid": "1d1a66d2-6830-49b0-9ba0-a886e6efd556", "comment": "Malware payload (AgentTesla)", "value": "3a8d2d60fc4327afde4102331506f918", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674729540, "uuid": "08857ee9-7757-47e5-9677-7e89899bb336", "comment": "Malware payload (AgentTesla)", "value": "7a6edbaf562665871428580c21db293fadb243554b5c160519fe456543360fcb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674729540, "uuid": "c46f0a9d-3592-4405-8712-cb702d4607a8", "comment": "Malware payload (AgentTesla)", "value": "6a3a4f917992355d00b1c39359a2d32fa0cc1aba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674729540, "uuid": "d239aa01-7478-4c82-b9c3-5fc851f4bbc2", "comment": "Malware payload (AgentTesla)", "value": "cc8358d020c9e0704a7242ac9dea9e332f752551355fa8c878799795b3de5f7aa8573e85e43c6df44ec7e7e75e15d888", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674729540, "uuid": "ce1b26a6-fd50-4295-8aa9-f79d9cf43593", "value": "T17E15AE1423E9DF82F9BE4779C275524057B37866B432D3895EE1A0FE2DB3B008A41B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674729540, "uuid": "e7b8ddd8-7965-4f60-a40b-5ec59e050848", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674729540, "uuid": "2fe6fc9f-86c8-45ce-b193-ba22e6d9de83", "value": "12288:mtG7vV5zxPCRgc7WUXDoFqIGCqhn3YUWLz7OZOwfwcmnQYFHc5FGDl2bsq9s/4nl:KiGCqNWLXOZzmQYmfGDJlwqVWkpQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674729540, "uuid": "0ceb1e67-3580-428f-90d0-5a71d20c36fd", "value": 944128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674729540, "uuid": "792aeca8-3afa-4fa7-8ed5-460d32178ae0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674729540, "uuid": "d198adc6-9e8b-4c00-8265-1849fb6e79cf", "value": "ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac5417e5-9d7d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1674739860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674739860, "uuid": "2426d739-7d51-4df4-830c-77167014363d", "comment": "Malware payload (AsyncRAT)", "value": "a3ce964053c5f9359ed53986186a132d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674739860, "uuid": "375e20e2-6131-4cde-9852-4047970a19cf", "comment": "Malware payload (AsyncRAT)", "value": "7b03f0fe3597c3129deedf5a82961f6efb97b9bebdfd5c0821e9603b7d4a7174", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674739860, "uuid": "74940087-2757-4a40-b7c3-ff2a3644e1a0", "comment": "Malware payload (AsyncRAT)", "value": "50126e82cef309ac4f8aedbadcc849f6517cf24d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674739860, "uuid": "254998ac-c515-4bb3-93f2-b733cab6a2c6", "comment": "Malware payload (AsyncRAT)", "value": "adefc922a2f0d46a3cf74ea4192fadeb3e2ddc5a423abf60577cdb62baccb9528ae22382d0834f0c891d989184edb989", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674739860, "uuid": "72cdb886-9cfe-4e6f-b668-e463f30f8fce", "value": "T1D0A4234D74D24E1DC213897942D04FC24975BB63683AA21FB05820AF6EBA7F259F1F34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674739860, "uuid": "6805a0ad-5cd6-43c3-9389-abf5e8bc6384", "value": "12288:qB1ojZvVXMW0WDRHxFdgqqE6VQCrBrqROGx:e1odvVCWHTdiE6VQCrh7y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674739860, "uuid": "53dae5c8-336c-4ede-a071-ddf420bfbe85", "value": 473088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674739860, "uuid": "086c6ad9-cd41-42e5-a58b-468d9d6a97fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674739860, "uuid": "89ae21fa-782b-478d-b294-f301ea768031", "value": "pmine.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae180ecf-9d81-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1674741581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674741581, "uuid": "8860aa4c-f465-446b-a23b-2ed4d7c25335", "comment": "Malware payload (AveMariaRAT)", "value": "6d53b19f0dc345f723ac4a002c9e8a94", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674741581, "uuid": "94c592e3-0c89-4224-93ac-7dcecd67dfa9", "comment": "Malware payload (AveMariaRAT)", "value": "7b0420db5a46d37459394685fcb0acf67f0a3c4294e3f9247f1ed03b4c18ae80", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674741581, "uuid": "5f053cbd-245a-40a2-8d59-c64f8c5aeea8", "comment": "Malware payload (AveMariaRAT)", "value": "89cd0a70e056bd2009f8293cc6aee41cbf7c58f8", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674741581, "uuid": "d0524295-52ee-493a-abb7-5561ec125523", "comment": "Malware payload (AveMariaRAT)", "value": "d5b3d0c5df4be3a02acb1eadb883b799db426c464392466e45bdfe4227bdcf5ea45d2bf25ce94e9166a51e78dce4add8", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674741581, "uuid": "310f44e3-6b9d-4ded-a878-b359aad7e8e8", "value": "T1E6D4F20B8EC35FB2C8584E31D3A619AD5BF0472B9451FB672DD402F4CEC9B8E560A1E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674741581, "uuid": "22f9ac6c-1fa9-4774-844c-bb1101539fbe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674741581, "uuid": "97922aa7-91bd-4095-a139-b9e2b7b20641", "value": "12288:MMjmOVDf3DES1C0MY4A/8GIGZ+F5IBRKYWTHgtk:MMlD9CI4G/Ru", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674741581, "uuid": "1e673eab-480c-4909-add9-0d440d23d069", "value": 603136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674741581, "uuid": "709307ed-c015-4836-921e-b0281777b19e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674741581, "uuid": "3c1729c8-4f3d-4a67-94d1-6b3fb2c23a02", "value": "7b0420db5a46d37459394685fcb0acf67f0a3c4294e3f9247f1ed03b4c18ae80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec87c412-9d7e-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1674740397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740397, "uuid": "640a8b05-ff62-47c1-ac69-bae22e92c8fe", "comment": "Malware payload (GuLoader)", "value": "8119655554ce9046d0d71af8a7752e90", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740397, "uuid": "473d0b75-df34-48b3-b4ff-b6422fd041c2", "comment": "Malware payload (GuLoader)", "value": "7bc5d2424c94a9b13c375e513455ad4c71bca0ad85524a71b58d9736d8e96752", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740397, "uuid": "c3a1df08-6996-45b1-8c4a-9e8f5654dbad", "comment": "Malware payload (GuLoader)", "value": "e5fb52dd6a858d6c2e35facf0aebc772dce9ca44", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740397, "uuid": "b306154d-c91c-4b1f-9d77-fb12cffe2420", "comment": "Malware payload (GuLoader)", "value": "2155da2baa367b613d0ff4a3ba51aa34787e8ec4f641cb9679f04271756212dbfcec77d58fc6ae3f43b365c576631d62", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740397, "uuid": "a5d5683b-5801-4ee1-a2e6-9056da7b738e", "value": "T1D18423C7798A2AC46A6FB0C42421D8E3D8AE0F32E867FBD1E71DB3D1B56B970441146D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740397, "uuid": "8987d47b-3d53-4235-aac6-0f5bbe6c9b42", "value": "6144:EIQKlwFjBQIF0sc87Lp2GB1CnOH+vNM4EEbmsmuP2LfkmISOMqaEqaWEbmCsK:EIrUmu0s33oG3+xbmw2LfzISOMBNaWwV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674740397, "uuid": "506ea54e-e7b3-4846-b799-e07396e63da7", "value": 393639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674740397, "uuid": "0c0c3762-f536-4b6d-ac96-fff30d741fc1", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740397, "uuid": "f5809738-8127-40d5-a297-748226f6b398", "value": "SWIFT_MT103.JPG.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd52dff-9db9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Phobos)", "timestamp": 1674765362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674765362, "uuid": "28a0d080-6fe8-40ec-88e3-3e3b0a9bc6b5", "comment": "Malware payload (Phobos)", "value": "e3d064afc3476b131db81cd483a5c87a", "object_relation": "md5", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674765362, "uuid": "8ee72840-b2cd-4710-921b-0659f9cd2532", "comment": "Malware payload (Phobos)", "value": "7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1", "object_relation": "sha256", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674765362, "uuid": "87999d84-6193-4cec-9379-56c063b5bb0c", "comment": "Malware payload (Phobos)", "value": "600fc81eddb1a44ae97e9565cab9d22363dd3711", "object_relation": "sha1", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674765362, "uuid": "86ecb380-a5a5-4c4f-82d2-41bb9581c6bd", "comment": "Malware payload (Phobos)", "value": "41073a23c6e209c116319b6c4032167d0b8d35fd593ef1ca502bc148070a3dec80b54b5b1af23229b60b7b3d10a3168d", "object_relation": "sha3-384", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674765362, "uuid": "60d258ec-062a-4ee8-a8fb-2229dbcb5210", "value": "T14543BF17746D80B2CE7285B0253A2F6B9FBE650580B444574F395E863FC5432DB3A3BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674765362, "uuid": "62ccd28a-46c0-4ee7-8833-678da4668e7e", "value": "851a0ba8fbb71710075bdfe6dcef92eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674765362, "uuid": "fba648aa-faf5-411e-90ef-a74e0ec65530", "value": "1536:eNeRBl5PT/rx1mzwRMSTdLpJ1/4aE2i9hfVxOD+H:eQRrmzwR5JV/E2G5VYD+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674765362, "uuid": "6b0be974-8842-4997-a482-83de5596f9d9", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674765362, "uuid": "70c82e3e-7a18-45f8-86fa-cf745d9b82a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674765362, "uuid": "ae61e079-a7fb-406d-a925-742107567fd3", "value": "7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3763c3d0-9d8a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674745247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674745247, "uuid": "3f1d2c0b-cbeb-4c2d-926d-75765f435959", "comment": "Malware payload (Smoke Loader)", "value": "917fe7b784f863195d6f98c41825e3e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674745247, "uuid": "5fb55013-fbca-4151-b78d-ce66a5e7a3fc", "comment": "Malware payload (Smoke Loader)", "value": "7cb736abdc30a33fe7387988e57d04fd117b985d5f3cb76fa4ee8b8a0a559b9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674745247, "uuid": "eb9c6f71-1810-420f-93a8-34235588f449", "comment": "Malware payload (Smoke Loader)", "value": "73afad5f89cb6a41b423410b3ca7c6562f821ebb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674745247, "uuid": "a9b4ab07-8c4b-4684-9ed3-b99e2f2c733e", "comment": "Malware payload (Smoke Loader)", "value": "ad863beb54b17a679abe56d03824e266ed8f1a894cda0cb63a4d8d7bf39a74439dd6ef4f82e5560ffa57f1cbdda443be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674745247, "uuid": "27a0cda3-2b95-4843-af03-7dff81b5491d", "value": "T1B314E1313481C033C56618704864DBC5AB7BB9323AA588B7BB970ABEDF316D16779387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674745247, "uuid": "288c02fa-efc5-45ae-bf40-15bc07ac7987", "value": "0cf7da7ba6041e7b7038cd2e90d72093", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674745247, "uuid": "bc7d3bbd-8463-4610-ac4f-29d27024f8ad", "value": "3072:uBN2mdZcLMdjUz/LvQs54LdoSowMB+9X43GBfTrgb:CWLMFUjQXdwz+JeKT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674745247, "uuid": "0f8558eb-eda2-4c53-844b-09a2d6358467", "value": 204288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674745247, "uuid": "96831a2e-29cc-4058-bb1a-f7a49740e6e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674745247, "uuid": "eaf19a55-a4f6-47f6-bf50-070e999957a7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fdf3229-9d21-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674700326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674700326, "uuid": "32d7acf0-913a-4fa1-a580-fd5fcd18ab99", "comment": "Malware payload (Smoke Loader)", "value": "9d1e9d088036afdacfb2f89ca29dd137", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674700326, "uuid": "8f10aa0f-871d-4c27-aa11-10f496466bb6", "comment": "Malware payload (Smoke Loader)", "value": "7d2d878a5f13a3445210e6b5a6e675b266e97dddd3cb750ebdc5c0d05f1ea92f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674700326, "uuid": "0d155c84-caac-4e5f-b306-1193164bb998", "comment": "Malware payload (Smoke Loader)", "value": "1743eb444c948dbdf2d58508a72851daee0b6d69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674700326, "uuid": "40a2ae38-65c2-4557-9cc7-4b9033ba84f6", "comment": "Malware payload (Smoke Loader)", "value": "85e6abcc7c55800b39347cc347dcdab7a53c770998285093584460b9afea438fa34bd5a347cd93d2f2f92db8b5167e62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674700326, "uuid": "8e22125c-0db7-4b4e-a0b1-76be3709a282", "value": "T11D64AF2275D0BC50F95A0A36CD2ADBE4392EB9D28F3C775732C4EA1F1C732A0D566225", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674700326, "uuid": "a6cd501a-b85b-438d-bd21-5ec52b00b2fa", "value": "e5f35c047e0fdde323b83e51e689dfb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674700326, "uuid": "82688913-c34c-4b54-bb5d-3c3aec2eae4a", "value": "6144:zgqLKjBGFSm5VWea3RiHuIBkp0KlwY0+MOKXy7UT:zgqsCSmBaAHuIBkp0WbWIUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674700326, "uuid": "f3d64d64-c36a-4311-8568-6cc06f8225b3", "value": 331264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674700326, "uuid": "21860323-b19f-4c10-9f29-5fc1d14886c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674700326, "uuid": "4d9993cd-bd63-4ffa-a2dc-0db0b475996e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1132dfa0-9d4e-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1674719413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719413, "uuid": "6c14faf6-ea6a-4bae-8d15-e8f9d5708c08", "comment": "Malware payload (QuasarRAT)", "value": "1450546db9a8bb6e52842606f03b4ea4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719413, "uuid": "790d8aa3-978a-49d3-8159-c77391f32679", "comment": "Malware payload (QuasarRAT)", "value": "7d634d0e72cf25b8a305b16a5ce905d772b98bbb2cd2af5cb848b6473ad94741", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719413, "uuid": "e4a67bcd-1711-4cf1-8305-c3d9bd69dfbd", "comment": "Malware payload (QuasarRAT)", "value": "1d6fa59860b0e9c46ebcfb88118247764e7f931d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719413, "uuid": "2b2c4690-d3cc-431c-ac52-b02bdb25fdfc", "comment": "Malware payload (QuasarRAT)", "value": "6d924d6140e9037178d4721520ccb2b6b33ba4a2576e414d674c5db26febd7888d27877f79ed44c6775aa20810911f59", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719413, "uuid": "f0969697-08fb-4d84-ae32-a3f33cb0a19e", "value": "T121751251E791C4B5E4630A399836EE31587BBD381EB4996EA38C3974DF333826036E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719413, "uuid": "76664542-7b72-4242-8e93-05ef892355da", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719413, "uuid": "c2a738e9-e336-4689-8d7c-19492314be13", "value": "24576:0NA3R5drX4PYbkyDv/+NcI0inzuAi0/DJCOTybO8z9rREGRiV6O/ofDbqWaCnLeW:V5NfnPE5X1COTCRjEGw6sS/BnLejk5f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674719413, "uuid": "9e2e133b-354e-47ca-ad4a-488de51420da", "value": 1634050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674719413, "uuid": "dbad7b2f-ed7b-4d78-9789-c5ce5d5c27c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719413, "uuid": "d91482aa-8cad-43fb-b099-502a0651d8cf", "value": "1450546db9a8bb6e52842606f03b4ea4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a620d1-9d9b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674752752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752752, "uuid": "2409710b-c47f-4ad5-8331-bdc20cf44aba", "comment": "Malware payload (Smoke Loader)", "value": "fd7012700cffbae5bd6dc1fe93737823", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752752, "uuid": "21bf5e9c-dbaa-4e8d-bc48-4893fabd4bcd", "comment": "Malware payload (Smoke Loader)", "value": "7d6d27e2ab1a511ca10b10093e8dbe5a10713a7b1de5eb407e88740842f32e2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752752, "uuid": "9a7ae628-0639-42e0-8698-b736e42ace4b", "comment": "Malware payload (Smoke Loader)", "value": "b49e819f689f27ee45a858b5d5c687a94ae81e34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752752, "uuid": "37517c66-d9e1-41f7-aee0-1c2f737aabe9", "comment": "Malware payload (Smoke Loader)", "value": "d8476f20aa8a6a52cae7d5cc455e9bfe53beaeba7b7e8a264d54eff7ab670107db9b1274dcfe61f0900be4ba238ba9b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752752, "uuid": "3802aa49-c36c-417c-8448-962d1bcb1770", "value": "T1E414E0217490D073C0A616755428EB917B7B6A3356B8884BBF981F7F5F703E0627638B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752752, "uuid": "8789286c-eea1-4395-a58f-05b925984d0a", "value": "3441d27f999e45e989c5f0204be01528", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752752, "uuid": "e989128a-413f-4cf1-aa36-45aad6308299", "value": "3072:NBN2+N1RvLC2rJqY55Q+0Cud4aDsE15N0du//QTk:T/LCIqYWCuGssE1b1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674752752, "uuid": "594098f5-aa54-4a7c-b7fb-d19d2c2f7337", "value": 202752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674752752, "uuid": "72faeff8-2c5f-41a2-8c8c-6f6044cf51f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752752, "uuid": "14f40724-73b0-4cd4-a890-5007b247ed3f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "158f841f-9db9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Phobos)", "timestamp": 1674765377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674765377, "uuid": "bc5dbfdf-1ec6-4e20-8b78-6188503bcbd8", "comment": "Malware payload (Phobos)", "value": "891671a3dbedc9f31325acd29ec912bf", "object_relation": "md5", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674765377, "uuid": "50ee57aa-3419-4219-8728-1731b5c74198", "comment": "Malware payload (Phobos)", "value": "7d9c97a133997396b0625a5d2b762fb8b333f5152d4dd893c7a463cc41372ab5", "object_relation": "sha256", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674765377, "uuid": "8a2895a0-dec1-415c-ae56-5236679c346c", "comment": "Malware payload (Phobos)", "value": "9d0f4cb30fdf9cf55948306190e3f71a72cff9f0", "object_relation": "sha1", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674765377, "uuid": "97fb2787-5356-435c-9365-87ca4848441c", "comment": "Malware payload (Phobos)", "value": "71301cc7c72284cfd608fb3f4c59587461e7de87c39020992cfada4b8c58ba1b52d285796734a8b1a9c1e2453c8347a6", "object_relation": "sha3-384", "Tag": [ { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674765377, "uuid": "09eb6dd7-8397-497f-bd66-420c707b9aa1", "value": "T1D143BE06346990B2CEB246702A3E6F5F5EBF950540B484478F394E863ED5433EB2A3B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674765377, "uuid": "548205b0-1398-40f7-99c8-152fd1c694ec", "value": "851a0ba8fbb71710075bdfe6dcef92eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674765377, "uuid": "4113d359-ff58-445a-b698-084fb815a181", "value": "1536:CNeRBl5PT/rx1mzwRMSTdLpJ/VeHOR8ZJ+EJ:CQRrmzwR5JdeHG8ZJVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674765377, "uuid": "4fa5b4f3-e982-4723-8bff-5d9072253dfc", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674765377, "uuid": "639d1cfb-da5d-47fd-9ad7-74d57c4d6169", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674765377, "uuid": "cd097cd7-c8ef-47cf-b82a-b5d831e1d62e", "value": "7d9c97a133997396b0625a5d2b762fb8b333f5152d4dd893c7a463cc41372ab5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aad4f33-9d9b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674752527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752527, "uuid": "450b318e-8167-45ba-bc68-16d90495b870", "comment": "Malware payload (Formbook)", "value": "35e24f240fdfe92a728ab0e989186749", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752527, "uuid": "8cfb3623-625b-4f53-a847-5a06ae164999", "comment": "Malware payload (Formbook)", "value": "7eaa5ce6781d0539bd307b79d3e41b3dc57f8d7a8d7f35fa3e0fa9a9d8a467c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752527, "uuid": "c4def643-ba53-493d-8313-243eb754e682", "comment": "Malware payload (Formbook)", "value": "90ca7795e2887f39c41f4e240d517646c3cbe61e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752527, "uuid": "fa3a9b71-cb01-4d7f-bac6-2dfdb6510243", "comment": "Malware payload (Formbook)", "value": "2ecef97e41ed5ff0dc64f592ff6dc9924a7e13db2d39e3c2047d27a68ae0ab5c4f9957dbf6b4ac1ddffe1f3d9789388e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752527, "uuid": "ccdd9230-be7b-4e7d-b2da-721111f5ffc5", "value": "T1C8057C411A7B87E2D4B90E78163CA5142BA15CD147ACF23ABDC67DBA9CE734F0095B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752527, "uuid": "88ce1ab3-cda4-4ce1-87f6-26a3a1fa1272", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752527, "uuid": "24243263-6840-4344-809e-838094dac6e7", "value": "12288:rTu2PGi1VGA5Sw+nu0bQrlht7J8t5UYG/57riarFCDyxkNoexY/tTll:new+3QLt96Ub/Vrlrk2kNNx8tTll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674752527, "uuid": "c9845142-5860-4017-a4bf-e7e1660fecb8", "value": 801280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674752527, "uuid": "f498f008-517d-475f-acf2-23f1bf2ed579", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752527, "uuid": "fd664b0c-3f5b-43c5-9fa6-e0a45a2de84f", "value": "Request For dicount Offer0170123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0e386e7-9d7e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674740378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740378, "uuid": "ba4b7772-24d6-4e3f-85d7-a63616d47169", "comment": "Malware payload (RedLineStealer)", "value": "e4b1522d45dba298c7597510499a4e04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740378, "uuid": "f88ce697-20f4-4990-a6b3-796884fd8083", "comment": "Malware payload (RedLineStealer)", "value": "7f03e073aed2a3458a76cf000cd58342e34ddd785cdb5947321d904dfb2d4dfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740378, "uuid": "c7407194-ea2e-42d8-9cb6-0b63e2d347ee", "comment": "Malware payload (RedLineStealer)", "value": "a0ca15e8a53e3fbf0b874550a3f2d68179931b54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740378, "uuid": "68799dcb-8213-46c6-a2c3-df436a89d300", "comment": "Malware payload (RedLineStealer)", "value": "9b59ebc149582989025d4a0895c86e80740d08193b781d52cf52dff68ad15390b4fc075882113548ff0a5ed1591e0dcf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740378, "uuid": "44971e2b-7dbc-40da-91b8-6d317603c1f8", "value": "T1CF94B4C212857132E1EE5EFCA9726A43C0E07C512A73869B166476BDCA70FD368D0BF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740378, "uuid": "54449661-f755-4eef-b185-12a4639b4909", "value": "6144:w3HnpVp/EdBd3Q0DCPdpFHhN9ndwZMvovdQ:KZ/E3dB+Vb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674740378, "uuid": "dfb85650-aa22-4ab6-8383-9c8e834cd34d", "value": 410112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674740378, "uuid": "40ec54ac-c764-40d4-a2bb-ddd8da7875ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740378, "uuid": "2b244f14-d8fd-4129-acb1-bdaf8d82bfd8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7e4d038-9d5a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674724954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674724954, "uuid": "cf18695c-104e-4fe3-b658-32e9befb6dc8", "comment": "Malware payload (AgentTesla)", "value": "cb955628b2f259a25a31b6011b213b4b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674724954, "uuid": "45190c87-4868-4c95-b10a-ad23a2083837", "comment": "Malware payload (AgentTesla)", "value": "7ff44d45a56c53a3d17a71568b260c1bd51304609d7bcf85c04c4aed40aff555", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674724954, "uuid": "62805286-d8a8-48a1-af4b-2c3bba2ba447", "comment": "Malware payload (AgentTesla)", "value": "86a8b71e9594a9c3a8ca93f55d73df7b8f2e0482", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674724954, "uuid": "5be457f9-f09b-4de2-9903-1ada30588456", "comment": "Malware payload (AgentTesla)", "value": "bd77f2604d86f59fb15780436657d7aadafe0301c0308f9af14f60d1ebdd2337bb38fe8c9c1f49cbe660135d6ad523c6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674724954, "uuid": "d2dd4964-f410-4c6f-8171-7b815b6a7d10", "value": "T10EF4D11D23B82B12EAFF43FCC451600453F5E113A29FD74D2CC6B4DE1AB27A09A69697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674724954, "uuid": "4e24a8db-3973-47dc-b0d7-4693a393607d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674724954, "uuid": "6965a0d0-e9b7-4efc-884b-ee74a58ab894", "value": "12288:RxEOxdue3FiH2iNUdrQJG0JodhvW/bWzCSuy+gf7eH5TJacOw2HX+oNa:RxEO7EH1GFQJMhVzCSuy+A76T+wJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674724954, "uuid": "e442f247-c1ff-46ee-99d1-df1e1b06e2ae", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674724954, "uuid": "e5616208-6d60-46b1-b316-eb6254733a1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674724954, "uuid": "f69c15fb-0835-4ae7-acc8-7b0e526d8c2d", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b3b7e6-9d5e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674726669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674726669, "uuid": "1a21dfa4-c3f6-45ff-bd9a-cf0f60b6728f", "comment": "Malware payload", "value": "58b0697a384dfd0541d474149a4982dd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674726669, "uuid": "39e83b43-1a37-4f34-8e85-14e78f50d789", "comment": "Malware payload", "value": "803d3f2312f2f771384f94a6f8553d402f68cb73a5a6b07ec88442ae963072ce", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674726669, "uuid": "b15e725a-8913-4ee5-a8d5-d682758f4481", "comment": "Malware payload", "value": "37073763978194901541a9207607ffe8d4a5d050", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674726669, "uuid": "7c83167e-bee2-4c58-a02a-c4fb890e8d3a", "comment": "Malware payload", "value": "db6aa2e56cf6b0ec8e3ea4a9b7d52daaff60cace909cd1c6f0693efe3eef2bb596a60a70b7ac3530ee411cc1ead8f7ce", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674726669, "uuid": "d86d7d54-eeec-40d1-a314-3c21f4f2bf80", "value": "T10144CDA8A44F0572D294AC4D64D572146D76FED230C8A87123AFE472CFA6FF5ADC009B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674726669, "uuid": "a2f74aaa-af1f-4735-bf87-46ff7f658a3e", "value": "1536:i1jmUotm8YL5L30EvXLhaMGFyeoCpaOzl9/OtxVbUxZVzFz76mAg5eeVhMDw5wfY:iFL55sIbKVzFtr5RDAw5wfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674726669, "uuid": "60e88907-a21e-4ddb-a1dc-5463b207d1dc", "value": 263316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674726669, "uuid": "ac481ab6-2692-43f2-b376-27ef65629e39", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674726669, "uuid": "94560cd9-12bc-496d-8cf4-6e9d2ccf1f00", "value": "RFQ.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f39a4300-9dd1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674776057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776057, "uuid": "2ee70199-e916-4af0-9e94-90f406668ca1", "comment": "Malware payload", "value": "21fdad906f21e03d354ba35538c4636d", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776057, "uuid": "c4b8aa34-a6e2-4b64-b159-67cf43294859", "comment": "Malware payload", "value": "81bd283fb09674b89d0a25e3b73c4a6cbcaa3d476a4dfe14bf1724f84d594479", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776057, "uuid": "57c7b265-a7b9-4232-a436-86324c8141ff", "comment": "Malware payload", "value": "1c47b434c6043e94fb0a585f22ab36652f91d7fb", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776057, "uuid": "776806d5-e6c2-450f-b0c5-daece42e0ba8", "comment": "Malware payload", "value": "3737a9314806034b1d05c73d88772e03ddc3bc324a77a8aea5cd348d9488e784de7a122a3e359a8d785e18b76d5513b0", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776057, "uuid": "2749e9c7-5492-4d44-887b-ec8ae5947e5b", "value": "T1A2B2677EB68B4E8CEA17D399041A7EA9166DF41D63C444C1BBBCE7307D1C94B8B22538", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776057, "uuid": "5d89b7aa-c170-4f63-8adb-8d2f6510b163", "value": "384:5HLm5imWjYw/AE5Gxswr7+fXK1qpUfR8KlOibF6Flzgwqewuv6CWkHf4lcma5Co:5UimkYZEIxJoXK1qpUfR8KlOibIFlzmU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674776057, "uuid": "52768ee1-4dd5-4e3f-9546-9d21e41153a4", "value": 24403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674776057, "uuid": "666af639-8ddb-4bdd-92d5-c4be7f5c6e63", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776057, "uuid": "f40fd9c9-d840-43c8-b6cd-65b2965b08da", "value": "81bd283fb09674b89d0a25e3b73c4a6cbcaa3d476a4dfe14bf1724f84d594479", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35b013f8-9dd4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674777027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674777027, "uuid": "f8e4ed18-ca89-41e0-b27b-3e923bb9d1c8", "comment": "Malware payload", "value": "9a63ebbe04d1e745d56d5471a824970a", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674777027, "uuid": "37bbc54e-18e3-4f32-b4f7-48bcdd146575", "comment": "Malware payload", "value": "81c71e2a858877eb04089c288ba0c9b7fd60c7ea24390a0dc6e402b9b6818cad", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674777027, "uuid": "84ce5638-576a-4deb-9ef0-61c17b180a8a", "comment": "Malware payload", "value": "3c0949ccb291fde831778d7079f244fc96713ff5", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674777027, "uuid": "767690d8-3822-4dd8-aede-1e6f01fcca4c", "comment": "Malware payload", "value": "29306f80a380242fadbaa9a94f84d1f1ca8f13c4e19bbefd2969aa6687c64e8e95aaf1343f6a320e6d66830d8aa8d5e9", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674777027, "uuid": "449d69f9-b70e-4114-9395-e8535dac1a9c", "value": "T1B3427E559B11DAEEAA435C9FC265BC4094D00DB79A96B198BB2FE8B7407BF4CC0DC183", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674777027, "uuid": "7d9d5ec5-fb77-4623-a77c-fe301b341de8", "value": "384:PhCPC83JC+CxX+C1CYCDC7CSCevkbo1/eJXswgn0c:ZCPC85C+CYC1CYCDC7CSCS1/as7V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674777027, "uuid": "2f210e8b-6fb3-42f0-9e13-5a725315143d", "value": 12833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674777027, "uuid": "34ccc69c-489a-45ab-9126-740ad12dac9f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674777027, "uuid": "7930f43f-347a-405e-a027-a4aedba9d768", "value": "systemAppExtention.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c2e9d34-9d41-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1674713902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713902, "uuid": "4f7af933-bfbb-44f1-9834-26ba809c98b8", "comment": "Malware payload (Gafgyt)", "value": "75870775df69ce9c1733c7b7b840aabc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713902, "uuid": "4d9a2331-d737-4081-a349-cb5461750572", "comment": "Malware payload (Gafgyt)", "value": "820d001c27a8da7be7fe7492f7be30d74f0ca72ef58578e211575d188fdb51fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713902, "uuid": "f1c9ddbe-5951-48dc-95ca-5a14b3477de9", "comment": "Malware payload (Gafgyt)", "value": "4b04c6970b829df5d70d4c0aa4275e7509bcdfc8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713902, "uuid": "e0de820e-bd84-4551-9448-440d0e93328c", "comment": "Malware payload (Gafgyt)", "value": "c30d162c0608640559f413302a21307e3be1bc65d29f72d4f82395e4c8e12e7cc21b1b704abe207c4f0ac1ae725907ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674713902, "uuid": "df19d1cd-d318-485f-bfe8-b1f60340dda5", "value": "T144F3E903E50545A7C29316F2725A23887B66437F87DB3343FA294DB07FC5A5A193AED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674713902, "uuid": "feae3b9c-0d46-436c-a81b-90773a30ca68", "value": "3072:yJX+sviufJHCYmei/w/00/HmFmDQFbxGXpgj:yJv5JHn1Mw/LmFmDQFbxGXpgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674713902, "uuid": "3b090df3-3014-453a-ad14-3958543a0627", "value": 161557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674713902, "uuid": "0b477286-706f-4bbe-b945-81c706d372f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674713902, "uuid": "e7da38c8-6c1d-4434-89c3-4555544ed3c4", "value": "75870775df69ce9c1733c7b7b840aabc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a98be46-9d84-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1674742837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742837, "uuid": "0cacdd1b-0bb2-4801-8e6d-697ddbb0cb73", "comment": "Malware payload (njrat)", "value": "c1f09a54bdcff4c2abbe31e4bb8ca6fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742837, "uuid": "b05c14a8-adb9-4246-8cd6-64560d550489", "comment": "Malware payload (njrat)", "value": "8365995c1be6e002b9789618a09a1561cfd29828bcbadce0212570658a632db9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742837, "uuid": "70208a15-4f3c-4dbf-92e9-9696e6373fad", "comment": "Malware payload (njrat)", "value": "5e8c7c25dee03d4eb45f10dba6da56c70567df03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742837, "uuid": "f420f6e5-1ceb-45c0-9b5d-75090d299d40", "comment": "Malware payload (njrat)", "value": "f656460431e2454bd30cdb82ec01b5d366eb516845a2d95eb9022999d321b5d8ec8350333e62f78cbf05f71768151e97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742837, "uuid": "120d1e18-680e-4f14-b8cd-4cc67729b3d4", "value": "T18D231B497BE08569C4FD067B05B3D122077AE80B5A23DB0F8EE15CAB3B636C18F509E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742837, "uuid": "d7d109ea-1653-4817-959c-656e60fcbbbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742837, "uuid": "d4ab7024-2124-4d47-bc25-9ed14a0cdd70", "value": "768:cw0DwODZX8fc0U1cMrM+rMRa8Nu/PteSq:cdTZMk0Uaf+gRJNUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674742837, "uuid": "513f44d8-50ae-4cd1-926e-3f53df85226e", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674742837, "uuid": "35d75b52-fc94-4416-baca-e02c81877008", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742837, "uuid": "9787aa9a-8efa-44f2-aa20-dee108065379", "value": "c1f09a54bdcff4c2abbe31e4bb8ca6fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c3438f-9d84-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674742700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742700, "uuid": "a80f3683-cd3d-4327-9066-c0f66f500822", "comment": "Malware payload (AgentTesla)", "value": "a845870f81437cc7ed8c215801e519da", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742700, "uuid": "9808568f-cd1a-4b41-b3ef-0c3be465e76e", "comment": "Malware payload (AgentTesla)", "value": "846b3104f6b082695e157b7cb2349854466fc5415da34a9fcd03bd69e6aa4a5a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742700, "uuid": "7ff55895-6f61-44b8-97a6-61b27a8dec46", "comment": "Malware payload (AgentTesla)", "value": "2674b2d26892141c97a5b3c2d189b93afe5384a5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742700, "uuid": "64287ec4-fab7-4339-b423-27d38e76c13e", "comment": "Malware payload (AgentTesla)", "value": "32d30e3cb5fdf84376df637f2cf7239fb4e1932cab882d152ac17b2b4eca424ef350b56fbaee948c6a87169396285cdc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742700, "uuid": "038876f8-5a77-4dba-9a56-5865bcfedea8", "value": "T107A4EDB4202B4531D258EC4F54A1791C2972FED3A8E558E0939EE871CFA2EF16ED064F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742700, "uuid": "29e78668-122a-48ce-8f9c-3ee90d24ef12", "value": "6144:ssBvxGaxUn2+Na96cHzi5TmOhVzFt1RDAUww:ssBpXSn2+Na96c25/hVzFHRsUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674742700, "uuid": "ec3e9aaf-4a51-44f7-943b-88376fb2de39", "value": 488854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674742700, "uuid": "89c1fc39-f761-4bed-b94a-0db767465401", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742700, "uuid": "1f12b6ba-3837-4039-8259-e95e33d4358c", "value": "New Purchase Order - 0xN3.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71450e41-9d20-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674699818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674699818, "uuid": "bda94616-1ff1-444b-99ee-a76bf75a23a6", "comment": "Malware payload", "value": "b67e22e8d78abb005c50170d1542cc16", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674699818, "uuid": "e601dc9e-e526-4a30-baee-ab7a199594a3", "comment": "Malware payload", "value": "84e9af1667a144a1d1379228a0f2005926f2ee4b970a77cd259d88c563ec8d30", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674699818, "uuid": "def1f310-0b12-40ad-9a01-a136830241a1", "comment": "Malware payload", "value": "7f3218b1d4c7d554ecae76e89a43065382aba5bd", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674699818, "uuid": "29d6c95a-9c1d-4eb6-b211-45310a0e448b", "comment": "Malware payload", "value": "6fb556d1c093c88b9f01c5edfd5c08b577448cb25994429387d2f0d5a863d706b30f35308430fdc1f138060b38d8ca90", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674699818, "uuid": "798609a1-d814-4b4a-89e1-1c83d57416f4", "value": "T1B846F086F7195A2ECCB314734DA6923256568C878E839B477948371C387B6F80F99BCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674699818, "uuid": "cf9f50e2-a9a5-4d95-8a21-892543509e4c", "value": "98304:Nyuy0xPySGpLb5VcYOtgQ2a9ft3WSSXMqUI2DVl0FccGws9RtusCCE2Zrbudd:wuyWQ9a3uXMqUlDLws9RMsodd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674699818, "uuid": "bb8308fd-6538-4ac6-91ed-16e529acf719", "value": 5799231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674699818, "uuid": "47175bc3-2aec-44a1-b1e6-4ed382dfa9e9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674699818, "uuid": "961f8eb2-e66b-4312-9793-f35f5ab29a3a", "value": "app-hidden-release.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a67e66a1-9d50-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674720523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720523, "uuid": "db452baa-1fef-456a-8048-21a991e620cf", "comment": "Malware payload (AgentTesla)", "value": "c5306decf19fb03f88c93f8087651abb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720523, "uuid": "f68a8ed3-0437-4cac-bb68-3ac9330883c6", "comment": "Malware payload (AgentTesla)", "value": "850420d99dfc22b2b7ab17643520130f4faeebf056d4d81a1064fed5d6859e8e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720523, "uuid": "9deb3e3e-e45e-43fb-8ce5-9e022ff2dddb", "comment": "Malware payload (AgentTesla)", "value": "22cc784d0d94aa7a0dc480ee69d149c8a147620e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720523, "uuid": "e6f9f42b-a764-460d-8a3d-e75ef8e45472", "comment": "Malware payload (AgentTesla)", "value": "a09f0128b528576cac70a42533ea07b52e4604131632f6f7312eba712f68ae6f45b4092d2126d3446752d2cdd33cb585", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720523, "uuid": "1d382a0b-f5f6-416f-8aef-b1ade95d7da0", "value": "T1BB442342C9EF26C76BCBAC230D8C658D65ECD621BF6B7B50914202059C6DDA2FF0653E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720523, "uuid": "119cf1ce-e9da-41f9-9483-f961225340b9", "value": "6144:7StjYHP9HGUZOkzg4Mf4okFWyMDF23zPWjoGTBjkEAb:mtEHBwkzg4Mxbo3zPWjoGdwEAb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674720523, "uuid": "1343ce2f-c9dc-4c1e-b483-da884172b914", "value": 257672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674720523, "uuid": "5baf3ad6-f06c-484f-bee4-02af8beeb389", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720523, "uuid": "e78a059f-e587-4e85-b4d4-53608d08cb5e", "value": "shipment due.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56502ca4-9d7a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674738427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738427, "uuid": "eeab839d-5abc-46d3-acca-003fbb90daab", "comment": "Malware payload (AgentTesla)", "value": "447f1d5a645314beb0b1d6b0f2f5119f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738427, "uuid": "19c04438-1207-454f-868a-e8fef2f499ea", "comment": "Malware payload (AgentTesla)", "value": "850f818aca36188fff35a492275cd63ba81f6e48263faa669fb5e192165f2f92", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738427, "uuid": "57295230-a7b6-4963-9d7d-46f062c642ba", "comment": "Malware payload (AgentTesla)", "value": "23ee744fa24aaada6ab0a81166c2f5466d29d502", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738427, "uuid": "f698a774-469c-474e-8ca7-1315290b2eff", "comment": "Malware payload (AgentTesla)", "value": "0b0488f956dd000eff84b90df4568cc1639355d5ce8a29167d8cc2a264907db6c014c9f777dc62b385084b127281ff66", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738427, "uuid": "83f3bdf8-e269-463d-90eb-b3767809c820", "value": "T15EA4F831FC930E37E0747AF5020F08347A9A2EED64E4629C69D2BB361AF5F850766C25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738427, "uuid": "515a4c5b-92f3-4941-921e-5569eaa255f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738427, "uuid": "6bfb5ff1-cb46-4f0d-9ed1-2be02a08ce65", "value": "3072:N36LY3qIwBzFyIR+DSbhsR2OsHas+8yqB1LuiCx8V8rIiJzQvstptE8z0N:N36hWsHtlLv8EiFES0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674738427, "uuid": "d86e05ae-592b-478e-b66c-eb1c2607ce05", "value": 488448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674738427, "uuid": "ed2939b9-7517-4531-a548-f139faff56f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738427, "uuid": "72d6ad08-e7ae-455a-a32e-f67fb553fc22", "value": "Doc20230126.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7488751c-9d55-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1674722587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674722587, "uuid": "4f38e075-e5a4-4f28-8188-e48302331716", "comment": "Malware payload (SnakeKeylogger)", "value": "551778a1583222e984178592f1e53085", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674722587, "uuid": "7bfd6d9c-dc53-4385-bab9-16a9213da0f4", "comment": "Malware payload (SnakeKeylogger)", "value": "86505875cc0ff8433accfde666c6b6971efe12d750a599a85efc38c0066cf845", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674722587, "uuid": "43aab580-dfec-47af-b5a9-79c6a7d5d30a", "comment": "Malware payload (SnakeKeylogger)", "value": "09883103097e4be7453bb32987191f7fdd76d0ba", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674722587, "uuid": "c37dead6-aea0-4a8e-bcb6-e1a927eda45d", "comment": "Malware payload (SnakeKeylogger)", "value": "6e0c467c1f6cc90a78920262058d8912c4f58ef4689689f3c6dc80a83672de6c32080ab28334fe8ed1e68b2b6601b04a", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674722587, "uuid": "c5d0fd0b-dc31-475e-b446-79ecdeca8501", "value": "T16FC423BFD6132D4E1FC2008A9273949E36EC1687AB95F1921E852081DBDBDB79075B28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674722587, "uuid": "f19e8d89-0181-4280-8678-fb563a1a0794", "value": "12288:PdfDNgc+KDM0dlEKku8mRhJI2FIw6QwL1v70qnDkWr6077ppj3PrCpS6E:Fbh+KY0dlEW8mRhJI2lCzhFx/ubE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674722587, "uuid": "4bade607-f060-4f59-a3be-36ba923be833", "value": 567411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674722587, "uuid": "e7d6c403-1711-4f22-9a03-6f6e233ba827", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674722587, "uuid": "1f77cc21-7a3d-46a3-9c07-264a44791ad9", "value": "OFFER ON SPARE PARTS (NO 000236765453553667.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afdd7072-9dbe-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674767783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674767783, "uuid": "0c7a0408-9cd5-4a93-98ea-21055888b9fa", "comment": "Malware payload", "value": "6a9edb264441186a33b0d9bfd4ceec9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674767783, "uuid": "88c7d761-b0b7-4876-82ad-ab9c24d12784", "comment": "Malware payload", "value": "8657554a37ed9826f7e303bf3363bfb46416f4586d8d6d971a2b0ce86bfa3c29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674767783, "uuid": "b4ac6f90-3805-43ba-826a-bdf261c04e14", "comment": "Malware payload", "value": "bccbf0a3496191858a521ae21dabe4139eaecc50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674767783, "uuid": "fb32b554-53a7-44f0-b796-5853402877ad", "comment": "Malware payload", "value": "9fef7f8063d26edd847e811300dc5f5023ad3669cbbd460d3130b11ac7a139fdd9561627b15f89ab1a24f1fbda83f734", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674767783, "uuid": "73926abf-cc27-4600-aeda-4d2724a0a91d", "value": "T1C895338BF44284BDF65B45FB26359040EF36AD8E683D100175A672CE2E726B01A727FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674767783, "uuid": "40812bd3-92e2-4669-b045-a23b13e1082f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674767783, "uuid": "2a834c96-a97d-4d21-a2aa-0b5d5128fa82", "value": "49152:okug+hYu5Limuit8mpyppc8DqpFGeLfLLudeJLCgv2MR:hug+hYu52uVIpc885Lqelv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674767783, "uuid": "32be38f4-c983-40b8-b1ba-a29aed0107ee", "value": 1875768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674767783, "uuid": "4fb3ad7b-bfcc-4320-9af1-8bba4b110118", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674767783, "uuid": "f49c7d98-d3c1-430c-b582-9483073ae255", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99155541-9d60-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674727372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674727372, "uuid": "3df50fa2-aeab-417f-8ae4-1aa5e0bd52d0", "comment": "Malware payload (GCleaner)", "value": "fa9c52c93d694bf28bd82e64b21f1e3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674727372, "uuid": "804c8bcf-a90c-4e4e-94ed-33e6b47fbb0a", "comment": "Malware payload (GCleaner)", "value": "8672c71e3f58ea690ae2677694823b995d55b85791757aff5c9fcc34f4464997", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674727372, "uuid": "5a42532b-a784-4158-9f44-f27e2b7bc17f", "comment": "Malware payload (GCleaner)", "value": "13ccf67d38e8e242c9c3d7e3c138a4cf41b19357", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674727372, "uuid": "7d768106-52b8-45bd-aa81-209e26ab8972", "comment": "Malware payload (GCleaner)", "value": "7f1ded3f9d0ea954d7e0e94f5d1d08a0dd6ada60c608a1cb7b1c4c739d453855124b0ff7bbd45dede5410248862de01b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674727372, "uuid": "131aaf8e-0a96-493b-b4cd-d552cb4b0153", "value": "T17595234AA693C2B9E4768BF139389101FB32BE97703C1111A319218D3DF96B1AC757ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674727372, "uuid": "f3f3919b-f807-4ca4-bb9d-6c667be165c1", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674727372, "uuid": "d97a5d19-3515-41ba-99ec-57d4316687d2", "value": "49152:okug+jeq4Kb+QvE6ExuM8KTYVm+z5NZAcmW/v3/qQTmLCgv2MR:hug+jeqJvE6Exu1KTOzAcmWXPqQTWv2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674727372, "uuid": "322d9a1c-4f61-4063-b368-456fe39daa05", "value": 1900095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674727372, "uuid": "272b4453-d2bc-4959-9922-a9db010acf2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674727372, "uuid": "7bb7dd31-b789-474b-a823-78232923b43e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1bbea06-9d73-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674735628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674735628, "uuid": "4aa64728-77b2-43fc-b30e-57228a5e4794", "comment": "Malware payload (Formbook)", "value": "58dfadd1eff1ea17bff0f9f41722daeb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674735628, "uuid": "b8716d71-2ea8-4c05-b8b2-7e891dbe6395", "comment": "Malware payload (Formbook)", "value": "86f60d2c14f4619a25b6c552cb27ce84e7e181a00908c994786cda57ce8ebfb8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674735628, "uuid": "a9b0dc8e-e9e5-4764-baa7-b1b1a307129c", "comment": "Malware payload (Formbook)", "value": "ff9cc5353ecbb59214957cdb9c4ccf7bb5287e5b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674735628, "uuid": "ad329f21-7bd6-40cb-8e7d-f4d4e37d4853", "comment": "Malware payload (Formbook)", "value": "1c646edb74766ebd9b85679d33c355faa1ed69e69e446438103427142558e1f6c25792939378816d4650e7593156483f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674735628, "uuid": "150857e2-9d84-47cf-ba35-2f3af9420865", "value": "T160D4239338D2BFE3C52F4BE39773C95493475C5598302FE98C83B9061999F6BD20A868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674735628, "uuid": "ee8f2d28-621e-4e9c-be6e-e5ac445c4da2", "value": "12288:7FjqNLRGFxX1EFF9KVaXOwmVhuOjX4CAs6vm08m5JCRc33Gaz/loX:RqNLRGFrEFFcaXef4Bs6vmfQCRKvbl+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674735628, "uuid": "3db258de-5d0d-4cd4-927e-dda453954bd9", "value": 629132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674735628, "uuid": "d33c7b3e-0a9e-4bec-8196-cc301c9aeece", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674735628, "uuid": "29d84464-54e2-49cf-bf7e-e3ff0d965d04", "value": "AWBD 8127852.._Pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d403d14d-9d51-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674721029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674721029, "uuid": "900573c1-7c9b-4165-83da-fe1d05012bba", "comment": "Malware payload", "value": "d7340c7b27bc07edb2212bc1234c28ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674721029, "uuid": "25714c48-bc94-4ad8-9a98-4ab191694fd5", "comment": "Malware payload", "value": "870d2f6e52ba8fc669651501d9d86b05de87ed3fa63e2aea6463af3a3b343248", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674721029, "uuid": "4e1af82f-8a69-49fa-bc51-3a993726a3e0", "comment": "Malware payload", "value": "07e5c81aefd74472db4d018486e9f4365ad61d3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674721029, "uuid": "099cf0b4-18dd-4106-94fc-6e5e5516a121", "comment": "Malware payload", "value": "115aebf2f7e0be337e10788725c39302390bcc941fed9e90ce4876b476dbd642f3ab7e1fc3767cc8819600589daa4b50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674721029, "uuid": "af8b450a-d451-4bd8-843d-14bf7abf7dcb", "value": "T11E763368BDE0C6BAD1839037ED346F45E6A7E3522C32DDA72B9559CC3E5E4C2843E148", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674721029, "uuid": "c86fd6c6-cef3-4974-b288-62ac130eb125", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674721029, "uuid": "49dc6630-c58f-459e-bb93-139ee78e3028", "value": "196608:91OLI4V8dTbSagl/SOPFtUgzjMobegjwsJRFcCkFAH4OZRJDh:3O84aDglTU6wUecz36AHHLJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674721029, "uuid": "557bb9cf-36c9-4022-abee-6231088c1d46", "value": 7644192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674721029, "uuid": "05bb38f3-5436-415f-abdb-65a5f41f3ac4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674721029, "uuid": "0598b554-c4ce-44de-8324-56e47f4570fc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7863fd91-9d55-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1674722593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674722593, "uuid": "0b23c47b-74fd-4243-b036-94cc86d133cc", "comment": "Malware payload (SnakeKeylogger)", "value": "d272d25b3efc69af38bd135d4e140e16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674722593, "uuid": "a32b3431-5556-47ac-83ac-97db82db4feb", "comment": "Malware payload (SnakeKeylogger)", "value": "876f6337c556e06671a3e9afb7dc6a7b008ff3e88205d67111a9a89f8fc3e0b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674722593, "uuid": "49d3d0d5-6a04-42e0-882e-037d2c080e22", "comment": "Malware payload (SnakeKeylogger)", "value": "b01a30bd868035db96beb9998b890be33b2eacad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674722593, "uuid": "35b1e957-7a50-49c2-bc54-3637326edd04", "comment": "Malware payload (SnakeKeylogger)", "value": "3bd61d956f35ae2296bce3c425c738f6cf3a48c89a55ce27c2ee13edf88772c8b12ff135dba24c822a36f070a4caf9c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674722593, "uuid": "9e7c20b3-4035-4dff-a4aa-1569484e2f6c", "value": "T18305AE1063E9DF86F9BD437AC274524067F37866A432D3895EE1A0FE1DB3B018A41B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674722593, "uuid": "aea75df8-3758-4ce2-b294-88b08ed7323b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674722593, "uuid": "e08d57ff-a0ed-496f-b150-a8e264ecaae4", "value": "12288:4tG7vV5zxPCRgvZdVWoXDUFqIGWlcKcU8mxhJE2DYw6iwLT70EnFkoR60S4nqU46:AcWGWlcm8mxhJE23wJbqVWu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674722593, "uuid": "74375f2c-2629-49ac-8055-c276ed898e9b", "value": 867328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674722593, "uuid": "0b775b7f-1a23-423a-9cbd-0ab8d5774166", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674722593, "uuid": "84f8ffe6-ce84-4432-92be-1b4ff9d354ec", "value": "OFFER ON SPARE PARTS (NO 000236765453553667.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d80f938d-9d7a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674738645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738645, "uuid": "57f7c14b-df46-4734-835c-40196c45a553", "comment": "Malware payload", "value": "daec3088ec4a6a4d1c60859fbd1bb779", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738645, "uuid": "05c614cc-bd90-47e1-9949-efa9d9bd774d", "comment": "Malware payload", "value": "87a9a52901739befc81b1c7e9c9deec4222a8023ef8f4ee0068413f7e9076a54", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738645, "uuid": "555d77bd-3d7a-4192-afa4-4cbd3dc14ca7", "comment": "Malware payload", "value": "bad5da3f95d9e13af6baf9f03932443fcf12ca1f", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738645, "uuid": "a5ca6be7-3301-4437-825d-00ebe947eb14", "comment": "Malware payload", "value": "ff5f22e9657e6c932b5d9168ec314847d9c15f3a4490045d450598a2cf8609d3e4098609ac04c2f421b4270c9d96ee75", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738645, "uuid": "9c185f1a-1f38-46c0-9b75-17b959b34263", "value": "T18936E02279C6C633EA6F4334256ADB7B51F97AE0377380DB53D4852E0E719C08276E92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738645, "uuid": "1de00e32-a345-4d7a-8ac2-6b11bcb04391", "value": "98304:oYUMV39xAlAfwrty24veHjPMNaWPlhkc/4ByWYcQ8l8zAPHEQ0BC77EMLN/:zP/eH9SPHel8zAMQ0BCEMLN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674738645, "uuid": "a4cacebe-0b06-4f74-bd51-7bb76d57c1da", "value": 5002351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674738645, "uuid": "93585042-bddf-4a46-8d8e-5f52f3b1b891", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738645, "uuid": "1d2227f8-6ff9-4323-9292-532484a0abc7", "value": "sample.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4fca87b-9d86-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1674743740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674743740, "uuid": "42e8b3f8-4ec5-4686-8a2c-3a05972626c4", "comment": "Malware payload (DCRat)", "value": "c2705b8b9562a559b785e347ead070c4", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674743740, "uuid": "fa28ca0b-e2ac-4683-82e1-af50d8e255ad", "comment": "Malware payload (DCRat)", "value": "87ade58bfd0c4657778eccf90ffb4409c61012dcd2134c708bebe60a872599b5", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674743740, "uuid": "b33d5694-f911-40ee-84fa-de26af8d5200", "comment": "Malware payload (DCRat)", "value": "74e5efad74eeb3e80c689c2f2fa4c8e19d55b94a", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674743740, "uuid": "88b36c83-a653-41ab-82d9-318e03c30b4a", "comment": "Malware payload (DCRat)", "value": "deb92d2863c114a8fed184a56d5d1ee743c76e605ee2df37bbcd829dcee8cd93c9261f0d2fe35d3cd838e28ab11f5d99", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674743740, "uuid": "8bccb8f8-e63e-4111-8108-b6724524541e", "value": "T12B758C017E44CE02F0081633C2FF455887BAE9516AA6E32B7DBA336D55123A77D4DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674743740, "uuid": "87d9220e-775a-4d73-8489-9db457c570c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674743740, "uuid": "c9c5e200-ec40-4a7e-94ce-eb0cd1bd7d63", "value": "24576:Y2kx1r2DVrfP/LtFYnnq4xuO1N/EZbUtJSU5KlyR5:YV0V3RFh4g2N/EZ4B5KlyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674743740, "uuid": "9a0569eb-3359-42f0-82e3-e55dc70fccbc", "value": 1591296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674743740, "uuid": "36669a26-5722-448a-a7c0-8dcab882b7bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674743740, "uuid": "092e280b-b211-433f-8f46-e7fee6cc4010", "value": "c2705b8b9562a559b785e347ead070c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2d90204-9d33-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674708142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674708142, "uuid": "755cc0b8-c98a-41ce-9277-59bcb22de007", "comment": "Malware payload (RedLineStealer)", "value": "ab1404b8c8b1f3378921c5354d9193d6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674708142, "uuid": "cf6ad7d4-2be6-4382-8d8c-4e39a65d6476", "comment": "Malware payload (RedLineStealer)", "value": "886c6ed25bd4aad7b2d1e5bc8ae51f555a69facaebfd49a1df94573394a0f9a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674708142, "uuid": "c6a0808b-5826-4c44-9f42-c46bfd116f55", "comment": "Malware payload (RedLineStealer)", "value": "c8be54d74def9faabadf57ddf76c2b1a11cc36bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674708142, "uuid": "7b9278e1-e8e0-4326-bf98-55c563f511a7", "comment": "Malware payload (RedLineStealer)", "value": "b41338319ee96ac15ccd0168190e12bdddb45434ade6513c2e3b7fa6853f63285720c299b6f5d9a8681d7336724c6de5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674708142, "uuid": "8bf777ca-8b16-4ce5-8251-7f4a0ad7a16f", "value": "T19E04D52437FCCD11E1BA1A3F6961A05146BF9802AC42F25B76C767CD0E36B40F957AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674708142, "uuid": "17ff26c3-7ff4-4c2d-b4c1-5084b3258328", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674708142, "uuid": "15208ea6-57c1-4734-9b12-ac634c816000", "value": "3072:q9xqZWBJaHEDgXuhvcu0wDBeMO9PhebxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUwE:qHqZVuhvfHDsPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674708142, "uuid": "d79bfab1-3b81-477c-93ed-15299b5a16ce", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674708142, "uuid": "356a0ad0-c20d-4e33-8240-9f56b32b84d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674708142, "uuid": "238680c8-73a7-43ce-97a1-05e74580a63f", "value": "ab1404b8c8b1f3378921c5354d9193d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb778d00-9d5a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674724934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674724934, "uuid": "8f3c39f9-3c03-48c2-a334-11cfaf784183", "comment": "Malware payload (RedLineStealer)", "value": "5138399605906d20f0d997f76a455305", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674724934, "uuid": "2243bf58-c454-4a7d-acfc-dc73d581a848", "comment": "Malware payload (RedLineStealer)", "value": "8893d7689ef5ff71cfcaa7f5242caf2c80ead75171593c841ddffd799c388fb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674724934, "uuid": "bed8deb7-a502-4715-8b0a-b070d9064af7", "comment": "Malware payload (RedLineStealer)", "value": "1c3d6a4e2e3c06654cd6ce9a63df125285cc39ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674724934, "uuid": "f86c2edc-094d-4bc0-962c-c47d9a4c0522", "comment": "Malware payload (RedLineStealer)", "value": "aca3dea5507c0544ac02bb61603a010de29242a506194fb4deca06f58a6c86c95cc106fee46833d03db28f6ad940e198", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674724934, "uuid": "87c1532e-d785-4803-bd20-c6c54f310c7f", "value": "T1B914D021F6A0C032C566453C1870DAD16F7BFA721666C887BBD81BBE1FB06D16726387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674724934, "uuid": "860c8161-9c1c-4b68-95b9-87cf563e5047", "value": "2fb86d3afd3014d2e2e15a2dd2f620c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674724934, "uuid": "71dd5305-c8b5-41cf-b754-db050e67665a", "value": "3072:IBN2H6HZdLltm80Gu5LgBmFlBWnDvQC8IBMQEd81KPO0x:w8SLS80GqFvAvQ+BMQtq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674724934, "uuid": "5ad14927-ba79-438d-b7ee-1ea36f5ae616", "value": 206336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674724934, "uuid": "bc329528-d5e8-431e-bcd5-6c508af276d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674724934, "uuid": "4b2b83fb-d378-4cf1-a3e5-1346bdb9adef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28020e09-9d49-11ed-88f6-42010a9c006e", "comment": "Malware payload (XWorm)", "timestamp": 1674717304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717304, "uuid": "bc0e3667-0963-4681-94fd-0131fb0cf0de", "comment": "Malware payload (XWorm)", "value": "36240efa4828ea52e9c7c021ba2741b3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717304, "uuid": "6098a72d-67cc-48f5-a990-211b0998eaeb", "comment": "Malware payload (XWorm)", "value": "89509bc1d672890a38b011535d5ccb5ad5870cc6d111ae897c31f6f25aae6395", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717304, "uuid": "0fa29360-0e39-40c7-ac1c-3d9c090d64fd", "comment": "Malware payload (XWorm)", "value": "3d01a45bf4096d06afea061b3910982a5e178e74", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717304, "uuid": "7d4c4a6e-15b8-43a7-8f93-8783bbf5cf53", "comment": "Malware payload (XWorm)", "value": "4cb0df451c59b511258289ec36cb2ad8b80d7c3bbc58d38ef6d211e2d1a6ac734bb6585851353e8de243f3a1063769ba", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717304, "uuid": "be7ccacb-3bc4-495c-b93c-fb335da14453", "value": "T13E74238BE21EF52CD1F60E3965E6E8E6F36CC11621B75145AE40DACD0DC1EB94322EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717304, "uuid": "41984383-9c9a-4458-ae97-ec49c7fc20f3", "value": "6144:fF/cZmIju4pN0r4cqap/FZ7uWMOJ00dZRdmkR4kLkHTjUkLU2ZTyoseEp4FS:yZHPgjZ7vh02Rdmkfuj1LU2NyoseEp4k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674717304, "uuid": "d11fbb58-5a8c-4189-8a19-c42125826493", "value": 344760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674717304, "uuid": "77482bb8-788d-4714-8dbd-f7ed6111dbaa", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717304, "uuid": "43fa46b0-6986-42be-a383-f2304bd683d6", "value": "Booking Details.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0c256c-9d7f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674740531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740531, "uuid": "4e1b8a0a-3eca-4471-8084-58ef6d155a69", "comment": "Malware payload", "value": "f11c80f1305deff34214daeeaa4a171d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740531, "uuid": "78b78af1-0d6e-46ca-a487-4fe9b460b91e", "comment": "Malware payload", "value": "8a1ce4b0cbc560753e05856d2b5a1e1cda9c677ade8b9b3b25e1d068d0b226ff", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740531, "uuid": "4896ef2f-431f-4201-8beb-5105158ed6fa", "comment": "Malware payload", "value": "2f14cee2127fc6099ceb2a946278a0efeba18959", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740531, "uuid": "aedae012-b52c-47a9-bee7-979e10e2a5bb", "comment": "Malware payload", "value": "470f89a2a537219e9f8e9c63c9aed457f1140400aef6adce28af1f08c441cc74725f04de680d1f2b506249711d6a3467", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740531, "uuid": "c5d759e8-5251-451d-9d0e-28cbe9fd93f2", "value": "T1B355AFF875047DE6266F536BDE96ACEC03B616639ACBA4CD80A477C305A3375FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740531, "uuid": "cdeae059-d935-427c-8ec1-1782e867274f", "value": "24576:ojo/ZT4PMMls9NE1z1teF8HlYa5AxtP9onNmwQJQw4PUPE01XBUmJmCnvUxJc:j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674740531, "uuid": "3e529122-7273-4ea0-8a07-f0c6a77e6f23", "value": 1312497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674740531, "uuid": "e342ea40-6619-4e30-8eee-b0b00b2e171d", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740531, "uuid": "42bed52d-c621-454d-807e-0c7d1aba4afb", "value": "(RFQ) No. EXE-0804.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e05cae2f-9d1d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674698716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674698716, "uuid": "c3468611-c258-4876-9b5a-fc6bd224b9ce", "comment": "Malware payload", "value": "812b28bc3dfded89fd5422ed12991914", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674698716, "uuid": "17965805-b0d1-4653-bc83-a025620659d2", "comment": "Malware payload", "value": "8a605d48ac47ed63ec9b276aa6427b4b8bca82ea6c3c41304692d37fcd99d801", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674698716, "uuid": "48c1667a-7c47-496c-95bb-e31be934b50c", "comment": "Malware payload", "value": "2b63dafb3de4193a75f3b754a1a6804e26f5928e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674698716, "uuid": "8257a55d-d4f8-4d6c-a08e-81d0d3b3442f", "comment": "Malware payload", "value": "53a49b51804b1282dc7afe096931d100e5c70b685fea5b21464b14fab73488fcea4fed97b295ad05797dd328e71675d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674698716, "uuid": "5880a5ea-ecdb-4662-9c81-92b01c69c2d5", "value": "T1C3763312BBE1C17ED84A4432A6641FD7D1B1CA240F290397A7DE162C2BBF9D4C227B75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674698716, "uuid": "06ad2ab2-d239-43e1-ab92-1e61fa76d4f2", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674698716, "uuid": "c285f27e-80f4-4d62-a517-ac25c362c02b", "value": "98304:91OPSunZ8dtnFLAJlWT/KHhR+V0vwPc19ymhLGFvLOXiF9JvZqBHZ80CP0P/JL/7:91OKE+klhHs4wU/dLGF8iPlOHoSKE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674698716, "uuid": "70d7fb23-5aa9-493d-afe0-6004c395fe20", "value": 7598046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674698716, "uuid": "73dd16e4-b017-479a-a504-f17113744a72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674698716, "uuid": "8b2eba3d-ab46-4ebc-a323-f29d39a6b0d7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80ed45f6-9d60-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674727332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674727332, "uuid": "ddc8a15d-ee12-4b31-a0e0-de3689136337", "comment": "Malware payload (RedLineStealer)", "value": "09a0cb3a24b41bc88ad4e89bbc66b492", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674727332, "uuid": "82499ab8-d719-4c03-8d6f-9fa48c3c5ef1", "comment": "Malware payload (RedLineStealer)", "value": "8a9b94d66d13ce33d3b6dcec52fc74501bdf6536fdb438e11a66c00d3ed0e809", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674727332, "uuid": "d403c1d9-61fc-4154-b71f-328e46f4be25", "comment": "Malware payload (RedLineStealer)", "value": "4587378995be7068c587591933f38990fe5bee23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674727332, "uuid": "a9856cd8-8d22-4a4f-a3bd-d371fea90e4c", "comment": "Malware payload (RedLineStealer)", "value": "a232bac58a9d983cd14d9378475e023f0a6e96240ab32b1681f05d289a7d9ac11a5c7aaca3a5dd0ebe4e82adeb99026e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674727332, "uuid": "ba593e2c-8f62-45bc-8493-0d16ef626c48", "value": "T1D314D12235A0C473C19665745863DAD87B7BF933D2A5C88B3B942FAE1F306C06239397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674727332, "uuid": "9caab98d-db9d-4784-b08d-08a2251d5259", "value": "2fb86d3afd3014d2e2e15a2dd2f620c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674727332, "uuid": "245f82df-4317-48ab-8297-2b942fe9b2ff", "value": "3072:hBN2VpCP1sLGZVUkTIf5s7xAFiE7htP63Ovjt53mU50ov:HdsLiUaIYiFimhtC+vjt5B0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674727332, "uuid": "ff4e7f60-e0b0-4028-bc96-987ba40fc9eb", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674727332, "uuid": "52118a09-61b8-4477-af1b-caccd9243eb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674727332, "uuid": "fcf1eadf-a2ec-4e9d-b752-2c04c1298ca3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a093cfad-9d93-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674749289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674749289, "uuid": "8145b4d1-082e-401a-94ba-f771b64d9b51", "comment": "Malware payload (Formbook)", "value": "3ec38d637c96e2a5f605437a6909e7a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674749289, "uuid": "17f6849d-3001-4230-8250-1d9c525b2cc9", "comment": "Malware payload (Formbook)", "value": "8aa2c54c1258e329b48d9ec31b3b8872440fa4216d23887ea8e8b7d66ae2f94f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674749289, "uuid": "8fab4768-1819-4088-9264-2588eb5e5a78", "comment": "Malware payload (Formbook)", "value": "b2625c0407f0125eeb5295e3f8b9b405df7840b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674749289, "uuid": "9f9d79ba-682e-4bd8-ac87-92686a979086", "comment": "Malware payload (Formbook)", "value": "90742a1b1e150adef67b370733d68eb2483db846d0a7bd7198d78714e5279a0bddba23495af297f99aa7e457c1567965", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674749289, "uuid": "5a3417c3-44a7-4f5e-8b4d-0db69c4111ab", "value": "T120E48F2EF3A48837D5735B3D9C6F53A59827BD202828E5472AF53D4C5F7A38138192A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674749289, "uuid": "1629b74c-a4bb-4f3c-be2f-422827638ff5", "value": "c05cb71b1ebaa88101ae3ffa64fdd37f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674749289, "uuid": "31eb0f13-74bb-4aa6-b57b-22c89f754549", "value": "12288:iVWUxf0RAcduAXzftmqB1gNm56Uro1RkB0lEKjh4jiecC:6W7KAXLoqMMJmRkBPKhhecC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674749289, "uuid": "a0604c4c-26d8-45d4-8dae-8cc9bb06bfdb", "value": 678912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674749289, "uuid": "d2762179-9885-4e23-b553-1fa5171c1cb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674749289, "uuid": "2dcba80d-39de-4624-8ed5-b8fddb36b56c", "value": "Order parts list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a71d00a-9d7f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674740662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740662, "uuid": "897c9c9f-d570-4391-9a5d-891238466d45", "comment": "Malware payload (Formbook)", "value": "b7fc1a121030008ba99d9429db26b135", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Stealerium", "colour": "#11E29D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740662, "uuid": "e7cc19b7-52ae-48b7-b771-bb068e9e0a1f", "comment": "Malware payload (Formbook)", "value": "8c0b5fdbd82ea5095e90c7586cee8733d0d408f606cb2f1d2730e7ef57870ff8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Stealerium", "colour": "#11E29D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740662, "uuid": "25b98b30-73cb-4df2-bb3c-a14f4f7db4fa", "comment": "Malware payload (Formbook)", "value": "0cd4442f76ddda66cfdde9288dfb7c28a2f60685", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Stealerium", "colour": "#11E29D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740662, "uuid": "586ebe8e-6aae-462f-a831-778ef9fe9c2b", "comment": "Malware payload (Formbook)", "value": "2dbb5f8dfc8dbc27b2c9636d3ab5944fdd6bfaee00350989b464f282913cd528494e6387bb4fcf47e800b2fec884047b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Stealerium", "colour": "#11E29D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740662, "uuid": "751441a0-eb36-41d1-8683-1570b63d2bf4", "value": "T1E3751298B3E94E04F3BF7FB8ACF110549671F8179811D64E2885205D0F36B8AAD61B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740662, "uuid": "9366a962-4738-4ae7-8ba9-802f033d5bc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740662, "uuid": "1b23a958-eb87-444f-9ab0-e3e4dc9f70c7", "value": "24576:8Qi2Q9NXw2/wPOjdGxYqfw+Jwz/S/6RZs8nVW6k5JHkARt7DBAqnh:8vTq24GjdGSgw+W7SCRnVQTEQ/BA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674740662, "uuid": "01c9d68f-7a98-4b3e-b95b-1b17a42ae63d", "value": 1570304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674740662, "uuid": "dccb4e99-12dd-4e1c-8ffc-8ce5a3a9fb3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740662, "uuid": "ec495bff-8d8e-4ef9-ac2d-e2c18cdd607a", "value": "build.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b20959c9-9d92-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674748889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674748889, "uuid": "96079dfb-829c-490f-bd78-1703753aad5e", "comment": "Malware payload (Smoke Loader)", "value": "b791b37861610b791e26c5b900679183", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674748889, "uuid": "41d0e6c3-8429-4374-b50c-4ad98108026d", "comment": "Malware payload (Smoke Loader)", "value": "8c74fa5027dd3cb3cd95241dd5a11e3ddb54b276d301a2bb3d61db5119579935", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674748889, "uuid": "2bbf72d8-312d-4c54-a22b-8f8832077c42", "comment": "Malware payload (Smoke Loader)", "value": "dcab4a6e3252d8a46c70a8384235b9e348fb447f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674748889, "uuid": "4b071040-b52f-402f-99f2-38a85ff8cc1d", "comment": "Malware payload (Smoke Loader)", "value": "bdbba5bb43940fadaae1676d190537600dedc569a1a74f4985514c40ba60bc71864a580519ddc07ad8d0e8eae96f8a12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674748889, "uuid": "c75e80b7-276c-43e6-b86f-3cb5e283e89e", "value": "T13F14F1117681D872C4922A749C14D7915FBBB83215B89C8BBBAD0ABECF312D1537738B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674748889, "uuid": "a0f8b5fa-acda-4c0a-bf0b-8b42fa391f7a", "value": "0cf7da7ba6041e7b7038cd2e90d72093", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674748889, "uuid": "cf713862-8519-4144-bb49-f1288796c122", "value": "3072:qBN2+8CgLWi4gqEA951ujurOh0l3o0NHMyhm2dcri3xBG4B75bKNMY9n:+0LWxVEAFiuNZlhMrMxB95bI7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674748889, "uuid": "b55f0c7a-5de5-4935-ad34-02f2c4749ea8", "value": 203776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674748889, "uuid": "6d7fc427-8f61-4ae2-b975-b741e59de088", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674748889, "uuid": "d665aef2-41db-4045-a5af-2b43a71889c9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a416b63-9d50-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674720476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720476, "uuid": "c40f06b9-7ca2-4658-9acd-265e89c1e17a", "comment": "Malware payload", "value": "eb9fbc53ac2d966ca601df1f4c85d164", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720476, "uuid": "3f25d6e8-560a-47da-bdf8-7f63dd8c886e", "comment": "Malware payload", "value": "8c7c96a43547bf223fb10494eb5f5ea529f287a983607cfbebe23c45a01ec257", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720476, "uuid": "957a085f-baa8-4cce-ada5-4d4260e1f968", "comment": "Malware payload", "value": "0bdb5a6327fe8c8c43394ef8580e5fb092d173bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720476, "uuid": "19f0ee05-6161-41f1-984c-c9b1d324dbb9", "comment": "Malware payload", "value": "e196c37db2158389a80501ce4ce43bc1382a705dd3c086046df967bf6ebbd6284f94c66d2b5e03d36ef6dd4ad7907a74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720476, "uuid": "32bcfded-f7b1-4768-b000-8df4b9361526", "value": "T1FB824B5C1AAC9513DD9B17BCC5C78A538FB29377D841FA1629ACD0D8398B3D1252832F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720476, "uuid": "3e11a4a2-c1be-4e61-9922-93f0cd5cd5c6", "value": "384:QT9As28vSNZo4EGQF+7vqEE9JhcSbqtGmGovy8ZpHam:lNHeGqVcmqnyiRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674720476, "uuid": "326d6200-4741-44f8-99a1-8ea1d0578e07", "value": 18792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674720476, "uuid": "7612de92-6141-4284-aae3-b4fd840ff783", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720476, "uuid": "19c489eb-eb1f-41ab-a8d8-532f6f1eaf37", "value": "SH2G86543456fLOj1oxDUM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "315a85de-9dcc-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674773584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674773584, "uuid": "75d1a9cc-0616-4045-9e42-6c1b9682b7ed", "comment": "Malware payload (AgentTesla)", "value": "82e6118234443895eb55e6cfbe4dd50b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674773584, "uuid": "6f758a35-58e2-4fd9-af5d-59864d58b1dd", "comment": "Malware payload (AgentTesla)", "value": "8cac9d66650d477750c772f06ca469eeff8056f6c058b1e5dfff1cea549a35ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674773584, "uuid": "7e1b0122-394a-45c5-a419-669e176ada0d", "comment": "Malware payload (AgentTesla)", "value": "bddf5766467766ee980588fab5299304fc31152d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674773584, "uuid": "c1ea6686-2bb0-4280-9a57-d2d155757805", "comment": "Malware payload (AgentTesla)", "value": "751054c652222a67f14a491f995fc94e566764dd93904a405834f1dd61e15e76162dc3ce155c0b04601d0ae430c6076b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674773584, "uuid": "c902753a-33b7-4873-8a64-1963d557bda1", "value": "T14515392C2D7697F2E174F93583D4A0A0BB9F488273A7C969D9D62BC05F123826DCE11D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674773584, "uuid": "26d29c6f-9525-4b92-8818-f65831876e6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674773584, "uuid": "fddff1c4-719b-4141-bca5-667cf5d2950a", "value": "24576:GY8gT8irmdjXHNOrAe/Iuh3WmBDCzwrqhTPVcgcUWfMSNjQI95Yoc:/WODewrCPVcghPSNj75YF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674773584, "uuid": "534e3ba4-8aa7-4e9e-99fd-1b78110fa8c3", "value": 928256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674773584, "uuid": "6e60ad80-6d16-4d54-9884-715cbdfc6dbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674773584, "uuid": "5d555534-8693-43b6-8689-cdfe5f8802ec", "value": "SHIPPING DOCS. 201002652122.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d470fd9-9dae-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674760800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674760800, "uuid": "9dc43b7c-b6f2-4147-a9fa-e17603d5d0b9", "comment": "Malware payload (Smoke Loader)", "value": "2ceed127a480b715d1229631e84a38ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674760800, "uuid": "01b69930-9960-48f5-b7d2-773c7c5e47aa", "comment": "Malware payload (Smoke Loader)", "value": "8ccd7a50b7f49ffd4bc65ce6389c60a68b6e76f2f595c734a6f410fb15380333", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674760800, "uuid": "8623330f-d31a-4691-b4b3-805c4229dc7a", "comment": "Malware payload (Smoke Loader)", "value": "b0d9198a9566a089406d374304eb7b95e2715ea0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674760800, "uuid": "623745ce-6fc6-46a7-b341-a9459031f47e", "comment": "Malware payload (Smoke Loader)", "value": "f0097bf0dac926c6919ce08d694e4be3d93f9cd6b16626e783645736de37e88a39dd4ac561398f34f6c453a261d99716", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674760800, "uuid": "a51d4971-f397-4d55-babc-42bbaf3cb686", "value": "T13C14E0227590C072C59615758C24D7A26F7EF93356B8489B7B841BBE6F303E1A33634B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674760800, "uuid": "ea81a24e-4a5e-42bd-b397-7e56646eefab", "value": "4dfa6309511cb75d1093a1ac55cf0bae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674760800, "uuid": "ffd05e65-11f4-482b-a332-fb1dc524300b", "value": "3072:uBN2LS2tmwLb1nkvXtS5t7xoO44U0umYO9FE/xhabgF5Db0YhjWN:CmpLbyvXtk00PYBpAbgF5XdjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674760800, "uuid": "050374f2-3374-4223-bb5d-ef514b633d25", "value": 204288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674760800, "uuid": "7f5d1569-8be3-4b58-b42c-addd5ab9d662", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674760800, "uuid": "e6d1f41e-21f1-44b8-af1c-bcab85f3afd0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5f1121d-9d84-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674742936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742936, "uuid": "0d595ebf-c3e6-49ac-8e15-f60087c6f6d1", "comment": "Malware payload (RedLineStealer)", "value": "16b787e1b8706086153c9992e67a2886", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742936, "uuid": "070e2e6f-a062-451f-a8d7-687e3da18c36", "comment": "Malware payload (RedLineStealer)", "value": "8d0108f446453fb5fd3e312bda3cbff0f26ee04c5c91766bcf0ee867dbb137f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742936, "uuid": "17a8b2a2-0321-43e0-b861-35f28accd5e9", "comment": "Malware payload (RedLineStealer)", "value": "798d6ebce4ce7e67da996bb97f1d8ad1ab6725a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742936, "uuid": "c0ab7273-aa59-40ad-869a-b79f93f82c79", "comment": "Malware payload (RedLineStealer)", "value": "1e58e42d72eab27c202e5c075bb600efe344d2e2c6e3606833a87eb0be53e823deba8cbf1077fb2704704c398c9dfe91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742936, "uuid": "25e19126-8400-4b0a-8856-f3939f0a4c4b", "value": "T1C4A52312BECBC8B3D13219325528B765313DBA201E21CFAFA3D55D6CDD31291E625EA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742936, "uuid": "70acf324-04eb-4355-906d-0be08d04fd8d", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742936, "uuid": "ae239380-b7a7-45ff-81f8-c6b27fdf3a77", "value": "49152:V5OFYW10TggRZFXAUO3gFbqX6SC/zEfhtPI5C5HynVIGCZVq1:V5tZNAUogsqSBtPGC5HyB0q1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674742936, "uuid": "6ab46c77-e9cf-4c86-a853-c6a234bda92e", "value": 2266158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674742936, "uuid": "684dd5c9-6387-41a5-9287-cab4e42f1457", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742936, "uuid": "552596e9-da3a-44b9-a50a-313dcfc86c94", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a51f9534-9db8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674765188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674765188, "uuid": "1e65f781-6bda-48d2-8215-7b84387d4a64", "comment": "Malware payload (RedLineStealer)", "value": "e201aadb663013c53fe51d8719a9210b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674765188, "uuid": "bf3fe099-8269-4d1c-afae-04bb115baf1f", "comment": "Malware payload (RedLineStealer)", "value": "8d8b0a7a2d259d562882ec2e47dee305a0d44cc1bf34e662b47b921122c4d11d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674765188, "uuid": "90382f07-656e-4db9-9205-ca86346c74a3", "comment": "Malware payload (RedLineStealer)", "value": "8ba0aa00662bd99c2c5dfdd067d172455ab9a322", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674765188, "uuid": "d31830de-bc5c-4b30-926d-986e7a23e611", "comment": "Malware payload (RedLineStealer)", "value": "ea31bcc26baebbd7fd41ffd4ccbfcd59eeabaa7e39a2c877fd780470a4a5d1360850e84aabcec3c4e2533a1527a1e1c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674765188, "uuid": "1f412858-49e0-44e4-9fc1-08619156a286", "value": "T10814E0223480C871CD9555305834E7A16F3AAA331B6D588BBB580BEEDF712E177B634B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674765188, "uuid": "f4b0801a-5fc2-4ef3-ae27-e9a5d8e7bfa6", "value": "f698356339eeb1f50ceb8d08cc5c7335", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674765188, "uuid": "7d304f69-3146-4dc9-9a1c-deefd94c4f5b", "value": "3072:QBN2IK32AXLKBhrfNl+ODuqx5CJrGUUlKbLqmun3BbHOYX9Y4sUkd7mJwE:4bELKRl+OS3rG7gUrNY4sJYwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674765188, "uuid": "76598492-0893-4324-a96e-1e227962fe9c", "value": 202752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674765188, "uuid": "9fb98ddd-1c2d-4a47-ad63-734b048a830f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674765188, "uuid": "15088c9a-bacc-4e96-be83-640176131369", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "759271cd-9d73-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674735473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674735473, "uuid": "a453c9ec-2a5b-4d84-aa93-a363a11e0eab", "comment": "Malware payload (AgentTesla)", "value": "ea05344d02dcba04db88b84b0ef87c43", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674735473, "uuid": "751ccb68-daeb-4a8c-9e6c-d7a8ef4e8977", "comment": "Malware payload (AgentTesla)", "value": "8db04b3a0c1bf0ff77b9f0f352e6091887199e998236f70bbe0833260b864370", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674735473, "uuid": "efa9b06a-25e1-4bff-8a8f-9a4f75b244b1", "comment": "Malware payload (AgentTesla)", "value": "7bedf5d795c9b37c7dd4717671e6fe641682283c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674735473, "uuid": "a87ffac5-0998-4ead-9756-a05cf5d16c7d", "comment": "Malware payload (AgentTesla)", "value": "ba6de172690e298f2c04f5cca59492e42f8528710b26f427f3634f4ea97e47e3d9a1bd326ac01e2dce97ee8efa0c9a11", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674735473, "uuid": "45167c64-2283-42cf-8541-3192baf99b8f", "value": "T12725BF1423E9DF82F9BE4779C2B4524053B37865A532D7896EE1A0FF1DB3B008A41B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674735473, "uuid": "876bea61-5e18-47c6-a609-d288f85b858f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674735473, "uuid": "78be9677-23b1-4a2a-9abb-cfe9eb992459", "value": "12288:ytG7vV5zxPCRgtEn7WrXD+FqIG54nqU4/W/5V9ng04bqiqLG5/snfdbIsIJY24nF:2dFG6qVWxLng04bdmnfxfMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674735473, "uuid": "bf4865b5-0b0d-4087-be8d-e59c774a6201", "value": 963584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674735473, "uuid": "a5b887bb-38b9-4768-9454-94c87b09ced6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674735473, "uuid": "4293b1e9-d093-4efd-b28e-e1f47f03ae9e", "value": "PURCHASE LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe536cce-9d3e-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674712939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674712939, "uuid": "9dec4276-078e-4ff0-a55d-2bdb5b05ae49", "comment": "Malware payload (GCleaner)", "value": "6f145db8262357c36281c5811332f8cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674712939, "uuid": "ad9e403c-9bb0-4ac4-9d35-da3174d6d302", "comment": "Malware payload (GCleaner)", "value": "8dbcbb2b4afdc17e50ac24b1ab7b8670b9295fe6e2c48f5eb438775d76b21d32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674712939, "uuid": "cc411aff-a607-473b-addc-136da2ce1025", "comment": "Malware payload (GCleaner)", "value": "ccdbb3eeaebd4b03c4454dffbcff33ef68d29008", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674712939, "uuid": "c1c80191-111b-4cb8-b0ff-001e4bec0f92", "comment": "Malware payload (GCleaner)", "value": "ffa85a5b012fbd5be10da0713bf7570682145e1a035a9c3b37217db33a8be93d99e76675230b09cba6b0c902fb79645e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674712939, "uuid": "7375b609-4c1b-43b3-84df-7e8f8c6e4184", "value": "T150852345F4C1E57FE8A683FA6E308284AFE3BDC7A43C0930356D17ED1DA52A064646DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674712939, "uuid": "3a0d1c49-a9ff-4fa2-ab2a-f7d3e51a0d1d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674712939, "uuid": "6f20cfa0-67ae-4efd-aaa6-94cc3bef7316", "value": "49152:okug+pifQEXNh0M8y9Mpc5nX71Xdeo44wMThSLCgv2MR:hug+yPL8y9MOp8cwM16v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674712939, "uuid": "ca93f1ab-fafc-4004-8ba2-89e4137d7bf1", "value": 1868196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674712939, "uuid": "7876928d-cacc-494c-9f49-4cba097551d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674712939, "uuid": "80a75cfc-916a-4865-bace-3868ed12195e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39791b61-9d6c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674732366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674732366, "uuid": "4dd80edd-cb18-4589-8e0e-7d03e9ed8a7b", "comment": "Malware payload", "value": "0ca83dcff0aaf6567b28f90472de93a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674732366, "uuid": "774fd97f-6d8b-42aa-9d48-f299ab7e5e26", "comment": "Malware payload", "value": "8e2c36396748c7159a05c5c89be43c0f343aef3600b73ebf5796cc704e884ac3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674732366, "uuid": "a07aafeb-7f04-497d-8efb-b4b10f731240", "comment": "Malware payload", "value": "b8c94c38294a13d252766537633f1eda52d373c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674732366, "uuid": "e6e90d43-921c-4faa-9647-dcec3490a5fb", "comment": "Malware payload", "value": "01dc5636d5e7b17908c18433349b1fae00dcf619a1dfbe9b39459e90e2e6b2725dd2f640454568f0afd6764afc60172e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674732366, "uuid": "e650330c-4353-4ea2-8041-1c810bb1e22a", "value": "T1B7763362BEC684BDCA85D470CAB49ED0F6FDE84107009D532BB2E16F6D3D8A4D1607B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674732366, "uuid": "316ed7ae-db00-473f-8b51-2a5b44a6ed85", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674732366, "uuid": "93143656-1008-4b94-9973-cfce76bf6ecc", "value": "196608:91OZoGfPUeV+hRrUHHFozboD1inGIeOfm0+zRBjZNtzl1Tg8QeSrB:3ODfKh6SPoDjIeUyRDB1sZeg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674732366, "uuid": "8a4698c0-e952-4896-b37f-1e3e29423aef", "value": 7629777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674732366, "uuid": "f49cff49-c12f-40b2-9f2d-17fd33490887", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674732366, "uuid": "3cdfe152-35d8-4255-b21a-d13ee8ad2d45", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49198ac7-9d5b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1674725091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674725091, "uuid": "c885edd5-c05c-4c88-b9f2-57e4f5e9cf35", "comment": "Malware payload (Loki)", "value": "c98fd628f48ea8674c35931367a586e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674725091, "uuid": "5e1309b1-c378-4075-9f87-5c18ed248f20", "comment": "Malware payload (Loki)", "value": "8f2a0dc81907a6d52ac8497d7ca4dcdcdb6ec549a3c179d51941a76075cad38f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674725091, "uuid": "e78fe3ca-1beb-4839-9bb5-b322824858ca", "comment": "Malware payload (Loki)", "value": "5e533508df3484201795dfc4e3c47e1458d2f97a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674725091, "uuid": "7016de99-0e93-430e-8b46-85f2a24c8bd4", "comment": "Malware payload (Loki)", "value": "f635eceb1ebacb50d1dee35308214eba6c392e45ab362771422223a222bcd1793c019069614c36ac1e0f35d8845c62ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674725091, "uuid": "c4bb2c57-9671-4dab-bd3d-6d2d1987b336", "value": "T11864AF1675D0B8A0F91A4A36CD2ADBD4392EF8D28F3D735F32D46A1F18722E1C526235", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674725091, "uuid": "c514009a-c71c-4c07-a75e-5a1c63efb882", "value": "e5f35c047e0fdde323b83e51e689dfb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674725091, "uuid": "f477841f-867a-4ed1-8caa-1751b6977432", "value": "6144:WDLhFuOKnKUg/DEWuS9L0CY0+MOKXe5UT:WDTtKnDiVu4L05WC5UT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674725091, "uuid": "6b84b32a-3d78-4698-80ae-6fee97865d1a", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674725091, "uuid": "955c7318-1b0d-464c-aede-7b2dce8d849a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674725091, "uuid": "277cca8b-e7d7-4fe7-93a4-363b4331d7c8", "value": "c98fd628f48ea8674c35931367a586e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8862f40-9dd1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674775958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775958, "uuid": "824b3f5e-858a-488c-b420-061273c670a9", "comment": "Malware payload", "value": "4224d68ffc5338fddb1ebb203dc0052d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775958, "uuid": "a5ab7f63-7a74-4dca-8df8-7d66783fe172", "comment": "Malware payload", "value": "9144f86f1a56744a90b2c0651584b27cb774417b5a6f465ee1e487c55cf5c2c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775958, "uuid": "8439ba1b-f108-4641-b8ad-9fe499226049", "comment": "Malware payload", "value": "a584bb5201ad100cd55e664b6e83760aa4f3e17c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775958, "uuid": "4aaac6ab-65f9-4414-8b31-8a1105c53019", "comment": "Malware payload", "value": "5e39443eaa8e28be1dcae7af8bd4dacb749229eff6abd9f9c9d84da059e2f0169fe1d04f9eb675b577419f5f6483b07a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775958, "uuid": "05d86554-4b10-47cd-bf15-47742ab30cb3", "value": "T15595230BE1E6D4BDD90287B93731A1C1DB3AFCAF643D1152395C92CE6D723D0A8719A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775958, "uuid": "084983a8-b901-4028-a8e4-ddd07faf7cba", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775958, "uuid": "41113834-9e46-4067-870b-48d2d0f82af0", "value": "49152:okug+yYRWMouSdrFJ1/bTesYWfI/uz38jLCgv2MR:hug+yYDouSdxTTes/gnv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674775958, "uuid": "0044bd60-4c00-484a-be95-e6092fbbc3bb", "value": 1914811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674775958, "uuid": "73e96d01-92a1-40c1-a868-5666818b1b0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775958, "uuid": "8f9c697f-ea6b-410f-abb3-0db4e77eccd8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9907ef79-9d50-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674720500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720500, "uuid": "6cacd288-a9a3-4e3a-a1da-cd218f6a16a0", "comment": "Malware payload (AgentTesla)", "value": "327cc65061d4d82a3936dd472b5d1da1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720500, "uuid": "6271045b-af2f-4ffc-99f0-fee772437e32", "comment": "Malware payload (AgentTesla)", "value": "91c47a9ba0835aa82c0578d5379528654d6031a2c6c6c797fad7e6a15286298e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720500, "uuid": "2a1ede5c-979d-4526-a125-6586d85fb70d", "comment": "Malware payload (AgentTesla)", "value": "c6947dfb7c3da6e809a0392e7b794a245f40030a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720500, "uuid": "74f732a4-01bc-49af-826c-e4ad1bdda66b", "comment": "Malware payload (AgentTesla)", "value": "5c6849dce5f3a02a7fb843b1e5dc5fe28d776f2217cae89d2e4f51b7f7e019817c6ecd1ab48308efa13cb4906b67727c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720500, "uuid": "e5cdb6fc-2948-4e70-ad7d-1fc6663b2ff8", "value": "T17C442342C9EF16C72BCBAC230D8C698D65ECD621BF6B7B50914202059C6DDA2FF0653E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720500, "uuid": "39f3eebb-d9a3-4115-8afe-f28820121fb5", "value": "6144:LStjYHP9HGUZOkzg4Mf4okFWyMDF23zPWjoGTBjkEA7:2tEHBwkzg4Mxbo3zPWjoGdwEA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674720500, "uuid": "2071689f-099c-43a2-94e2-c7f3c6fd8cf4", "value": 257672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674720500, "uuid": "37b3dee7-bc16-48ba-a374-00ff109419ac", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720500, "uuid": "f704ddc4-c0f2-40d5-9400-1299e0fa5b0c", "value": "payment slip.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd76b22-9d9f-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674754278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674754278, "uuid": "2c5d1bdf-f2a7-429d-86e3-3f6a9c800987", "comment": "Malware payload (GCleaner)", "value": "f95522fba0aca73f67593e477c5ab33d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674754278, "uuid": "a7446e03-d4ce-43d3-b81e-66dbc5604911", "comment": "Malware payload (GCleaner)", "value": "92a52eb7a00fd614dad7644ad2e05fbaf0c55875871e22c20dba7db17f2e82e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674754278, "uuid": "52241fa4-ef78-4525-9969-56172ec72ff6", "comment": "Malware payload (GCleaner)", "value": "f3d538e65efdd4b2e07dad9d2c37f82bbdfab637", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674754278, "uuid": "d02db40a-f463-476a-b30a-c5998f8c27bd", "comment": "Malware payload (GCleaner)", "value": "6d6090790ecc9ac8fbea667a93d83271a53b0b9556fba598cfa5eb7a5c94a935040028eb2c2b0ad042e57c2de49b6cfc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674754278, "uuid": "4ac7872f-308e-4877-892d-e2fb60b951b8", "value": "T11895338BA5D1C0BEF811D5BA2931C691FF73BCDB247D0440756827ACAEB53A04C6E66C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674754278, "uuid": "474d1a01-b9f5-4ebc-a489-433688ada1e9", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674754278, "uuid": "cd576a77-b8f1-436b-bb01-570c617f1206", "value": "49152:okug+qTp1Icsv9wrefYfaWEawApeLajqOgkLCgv2MR:hug+omcs14e5WEazkqqOZv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674754278, "uuid": "b501b919-dae8-490a-936f-775cfefaa831", "value": 1881944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674754278, "uuid": "2e3afc34-d379-4e4a-933c-5d1939d77b93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674754278, "uuid": "f993c125-3165-483d-ac9a-ad110e5255d0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9342b23f-9d7b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674738959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738959, "uuid": "737e279e-7be8-43b3-bf74-7a4b50ce5570", "comment": "Malware payload (GCleaner)", "value": "e42bbe5887d3f3d6a9365275ba2ab93d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738959, "uuid": "c667e8b2-8229-42d8-aa14-0eb686993940", "comment": "Malware payload (GCleaner)", "value": "92ad98c2d2794b155b7dc4130115fac833b699ade5f7b3139400383bf64b923d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738959, "uuid": "7ca30457-cfc7-43ad-b9a1-51f1192048c8", "comment": "Malware payload (GCleaner)", "value": "21c8190ef0e16f00c3b9a0836757118448d17357", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738959, "uuid": "771048f3-0e12-49f1-9e7f-b1e54dd025b5", "comment": "Malware payload (GCleaner)", "value": "00a52bec829f4a14892e062f5df8cd0d79e5e3e16b3ef7ef700118532f692144cc6d551595e81f32353f54098f27df2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738959, "uuid": "05e0072a-1c68-424b-ac24-3dcf5ede9cd6", "value": "T1E395238AA0C1C6BDCD6646B929715100EF7BFE9710BC10517B9D238D2F721709CFA7AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738959, "uuid": "f9b17f44-51de-4021-ab05-ecd6245aa11c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738959, "uuid": "117fa932-0ac7-4b65-b16d-3ef2cb41c28f", "value": "49152:okug+njKtfqEf50X0JJTnrA2gb6kAq//HFPbh0DeHLCgv2MR:hug+nEfqE+kPfIuM/HFPb2KTv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674738959, "uuid": "a309ed17-c6a4-418f-b63c-a5940c417fa2", "value": 1896888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674738959, "uuid": "f546872e-7104-4b88-a8f4-c00c4c4d6c6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738959, "uuid": "e9626d59-e26f-4a0a-8f23-24f1ca764b14", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d438190a-9d4b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674718452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718452, "uuid": "e665089c-4abc-4ed5-8cda-a2421ca5d269", "comment": "Malware payload (RedLineStealer)", "value": "dcfa95f4ae4a000f6fd66ad51a53473b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718452, "uuid": "57920d36-91b0-4ffd-b890-f3842cc68ad0", "comment": "Malware payload (RedLineStealer)", "value": "935cfe9c96bee55ec5ac22e5c9b44d2fd58d06d2a7d42c39375be919769e8871", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718452, "uuid": "c3a01be9-5da7-4f6d-8dd5-e8468494f5e3", "comment": "Malware payload (RedLineStealer)", "value": "709f3394a0b9619d8786f97af2266913693b6f03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718452, "uuid": "0e83ce2b-d78d-4354-820f-02605cf2a0a8", "comment": "Malware payload (RedLineStealer)", "value": "4f419426634ebc880bf295fb79d91cba84540dc3e1f4801ee1f908e455fb3ebf111bef720973544d2b5ac99bc7233c43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718452, "uuid": "39bf9edd-c406-4c1d-a338-8f54ecbca117", "value": "T1FE14E1327A94C073C5A784351874E6946FBEF8B256A9888B37580BBD5F31ED0472E387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718452, "uuid": "6d75dcc5-b398-4065-b5cc-0813a5371b0f", "value": "2fb86d3afd3014d2e2e15a2dd2f620c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718452, "uuid": "340e477b-cd81-4a56-9a31-bcf6899682e5", "value": "3072:5BN2C4NYL56sxL45VUnzOO4p7ThI80Ndth40qPATdS3bC:/bLssxLaB5IJhbqYS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674718452, "uuid": "6d45226b-9651-4757-b702-a0123432a9cc", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674718452, "uuid": "4c3ff576-3e4a-4ddd-a050-9c4530f2a0ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718452, "uuid": "3fa6887a-214a-4281-8886-ae0d50ba69d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf12c43-9d97-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674750786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674750786, "uuid": "fd80926b-3f96-438d-b993-35ddd7daa87a", "comment": "Malware payload (GCleaner)", "value": "8d082a1cb1b59166faa2a76d8a52836d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674750786, "uuid": "24d72781-6cfc-45f9-acbd-2665890b07ed", "comment": "Malware payload (GCleaner)", "value": "939237ab2c2dfc16696a5decc9f0eb78c74fc41b7d58c0f4ef726f3c2525b090", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674750786, "uuid": "2775fe69-cd23-4690-9594-1edf4482afda", "comment": "Malware payload (GCleaner)", "value": "641859f4fd55c78a81e83e8e1af6b6cef1559796", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674750786, "uuid": "818c47c9-bf76-4c68-a8d9-4300496416f7", "comment": "Malware payload (GCleaner)", "value": "10b0581bb93c9f15fc92c9d52998fc98b89b81dc4a661c12c2e30003b69d252471c4609df51f650d4ff764bbec90ce6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674750786, "uuid": "65fcc935-7a39-445d-89d9-1f0ae7bcede7", "value": "T1E19523867551B6BCE8118FB22A3112D0FF36BC0F21BD6102B6590BEC2D76260BDE57E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674750786, "uuid": "12b5a900-b059-4507-bc82-f94aa3b58c06", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674750786, "uuid": "1b51fc9c-8310-4a84-8ff8-10b3a5db21f4", "value": "49152:okug+Uqk0JN7tlfgWO0qCGZ51JKrU26xsjLCgv2MR:hug+UX0JN7j+0kJKGxsnv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674750786, "uuid": "e7275177-c5da-45cc-bb54-6602db6820a1", "value": 1896095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674750786, "uuid": "76d88180-3914-418d-b931-e4da4476de32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674750786, "uuid": "8eab0d05-9253-4b38-9bc4-8c366a4b1e88", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "265e2b9f-9d36-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674709141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674709141, "uuid": "9b16176d-3d38-4e4a-87b0-dec7490002a9", "comment": "Malware payload (AgentTesla)", "value": "28cfc00452c4e3e6c0082fdca3c520fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674709141, "uuid": "1d3c7eac-4e7d-433c-b5d5-19d3fabcc5de", "comment": "Malware payload (AgentTesla)", "value": "93b17c9c6d764b7e218d2d1669e8bd68059da3fe346936071b012d22d52fb35e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674709141, "uuid": "beb7387a-a090-42da-94c5-e36ff84ea5e3", "comment": "Malware payload (AgentTesla)", "value": "1260166c856aee0225371c7ab269f3a228cf8fb5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674709141, "uuid": "18695646-c6b8-4700-bcd3-06be95f22db5", "comment": "Malware payload (AgentTesla)", "value": "6573c22d84988e69cbfa7008798f608ab7ee154ef18d0049129594b8056f758f08eef2995d7be72823852f7cd4aada32", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674709141, "uuid": "4c7e2fb2-ae39-4803-9bb8-32b7d934864a", "value": "T18DB26006A388C3B8FC537E359D6757711F7ABEC98D16AF8F8800B9CAA8B8744C115710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674709141, "uuid": "e1692654-8698-4253-bf2f-62caa28c4427", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674709141, "uuid": "2cb9351a-e151-40ff-bd3a-33b0efc06606", "value": "96:IEfPqlezZjTldKYgr+Doo+HzQLCmNeit3l/kSw6k7l6xiRQe3T3erAo00wGvzNt:IEfPql6VpJ/oGlL/kHH7l6Ej7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674709141, "uuid": "1ed56022-abbc-4a7b-aec4-6305c2107d67", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674709141, "uuid": "9d033532-9f47-40d1-a570-36051220df19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674709141, "uuid": "ea79a95c-bd38-4098-b9a7-9bed2dd74182", "value": "28cfc00452c4e3e6c0082fdca3c520fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf8e819-9d68-11ed-88f6-42010a9c006e", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1674730600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674730600, "uuid": "24e146b6-02f7-445d-8453-51cbd169d0e8", "comment": "Malware payload (YellowCockatoo)", "value": "89a548e727c5c0e87178ddd00015517e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674730600, "uuid": "fe2f2a7f-ae5b-464d-8883-90bb288f333e", "comment": "Malware payload (YellowCockatoo)", "value": "93f6fb9b8c1edd2154bcbada045854ff1851f1da3ba3e4404d3e2e98743e56ce", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674730600, "uuid": "89bb72b0-65f4-4f68-bc05-a3a9aab4ff50", "comment": "Malware payload (YellowCockatoo)", "value": "fb509572cf87ea9ba0aea5d18dde789d1c20f663", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674730600, "uuid": "7bab1dd1-a35e-483a-93ea-84c2577d2576", "comment": "Malware payload (YellowCockatoo)", "value": "be949ea7704579846aadc92754c2f036fe3576a80b27f8730cfe3e56caed12d8b52a89928cba93421e7ae86fa9261834", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674730600, "uuid": "768bb686-65f0-4b77-8098-69ca950e211b", "value": "T1ABE49B1C3BA4C85C8B7C16E978AB83079B2457F3D6C29F0F0BA791712A6A9710D511FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674730600, "uuid": "2624a5a3-ad1a-41bb-bd3a-34cebcbdaa3d", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674730600, "uuid": "5ee24c1d-c2fd-4860-93ba-1e631095bc4e", "value": "6144:zOoVNcBN3Vwz9s1Fqbgcqpg/78AoTM1noPFey8lxaRTfv6XpbDZDzboka6aD3RyT:zvViu9x0cMg/gFFpQaRTkpXZPLaD3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674730600, "uuid": "b1047933-39b6-4d74-9ba3-ba8ca96537cf", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674730600, "uuid": "31cb5fd7-8078-4486-a99f-3507b10f76c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674730600, "uuid": "a5baf91b-f754-42cd-b911-4a8b68c6a11c", "value": "UABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZF0KaDL_AJFYgMvLHSTHMGOOKhA3JMko_YBSKi5H8LQOKWiURQUOVOkKEHA8hPxH7OTNBEpYQHMqSvGIqHAOCGQMCJlP.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d659bd2f-9d2b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674704712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674704712, "uuid": "f58dd7a4-586b-4799-88c5-283092831406", "comment": "Malware payload (GCleaner)", "value": "fbc14d69dffa7d25c9cc63793a036cc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674704712, "uuid": "c84fe620-191c-4a1b-a09d-c7a6e86fc745", "comment": "Malware payload (GCleaner)", "value": "964ee6fa2f1f7f6ad1a8fe2378f6869efcaf024ca39e65f3a61e1f95c917b021", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674704712, "uuid": "20b91a46-b634-4f6b-b8a1-9871bd27f7f1", "comment": "Malware payload (GCleaner)", "value": "d643b987c697daf8eb0b8dc6479b125f3705e99f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674704712, "uuid": "50a3b650-4fed-4c08-87e4-248c70a18a2d", "comment": "Malware payload (GCleaner)", "value": "32bc85fb9caf9cf4fe8df031d222161f777e730e9525d792e010d9208dd10a89aaab634f7c763a9bff5fa86a9d9bface", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674704712, "uuid": "f5948fdd-5beb-4bef-9520-7bcd2fd41253", "value": "T16C853342F598D8FDD6558AB61A3992859B37FD8630FC2040361B33DE3FF62611C78AA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674704712, "uuid": "3e0109d9-0b1b-48ca-95c6-9ec6a833cdde", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674704712, "uuid": "e16c3e59-ed86-435c-937f-8b34d481b098", "value": "49152:ZQug+JOrRLJ1Pq382W/DiPgAOaNowf62LqkOc8LCgv2MR:Wug+GRfq3LWrijowpLqk/8v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674704712, "uuid": "b888ba90-3843-4da5-b781-386c3512a1bd", "value": 1862706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674704712, "uuid": "9821da7a-db4f-422a-a33d-e64aab0a8ec6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674704712, "uuid": "01696521-91e4-4032-aa1f-e7fffea63aa7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c228f6-9d65-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1674729467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674729467, "uuid": "d6b72a56-53c0-4dce-bed2-c1b5c61e45df", "comment": "Malware payload (CoinMiner)", "value": "7449d754c71a350b9c7b126dd1507396", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674729467, "uuid": "d1bb35e1-e6d9-4ef3-93bf-b971d517e784", "comment": "Malware payload (CoinMiner)", "value": "974c3f752e02dc82bb0275e4ea30d74333fc1e029afd0a9a44805c90badf4116", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674729467, "uuid": "a37fab01-c3e2-4f7d-932f-f83f1f1576b0", "comment": "Malware payload (CoinMiner)", "value": "343ee0d87a4223b203e9a7de97fe9915c3d6607c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674729467, "uuid": "b3ec3325-2da1-491f-adad-c013c920fb80", "comment": "Malware payload (CoinMiner)", "value": "0ca04ab8302b3a245be3977ded7d81bca4d8539e24162457792dca7e10f1c1b6f61f4a17ab10b24280257340bad5a9f3", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674729467, "uuid": "1743a6c9-03c9-4f03-8f18-0aa0d0e5098f", "value": "T1BBC5F151FF1EA0B1F2AA5138C56385B84E206C26BAD285973D7CFE0D6778380747973A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674729467, "uuid": "ae907be0-f598-44f8-a2dd-e1f7dad1c0c6", "value": "a0ca92c3ddaf9bcf268b6197e6bcb7f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674729467, "uuid": "5b6f7a99-8184-4a25-ab79-0b58423ad49a", "value": "24576:y7StmAY+g9ZcgVAQA6bPcCzXIIfwston7uPjP6Lr5TT5e6UNjV7UfJVeE+4IEtiK:E9ZcgVlgCzXtwu07U7u5P5aifOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674729467, "uuid": "c64d18fd-8b72-4a01-b72e-58395584b620", "value": 2728448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674729467, "uuid": "f040c287-84db-41ce-977b-11cd8ddd385d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674729467, "uuid": "7b98c6e1-7dbd-4ad8-b734-8090d786336d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2caab29d-9d4d-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1674719030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719030, "uuid": "2ebb31be-4112-4892-a9e3-ab9da29788d1", "comment": "Malware payload (SnakeKeylogger)", "value": "fa158fed703f97981b6035190a738822", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719030, "uuid": "b222aa5e-0c08-48ce-8857-95f8e8bd45fa", "comment": "Malware payload (SnakeKeylogger)", "value": "97a21cdbe71ff0d84c423b4bc9a373a1de90c94ec7af9adc97a6d3812fdf2dfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719030, "uuid": "cce2977c-542d-49d1-8c5c-eca0915824fe", "comment": "Malware payload (SnakeKeylogger)", "value": "aa2b7c1c1e6f478d0c7d3ca843110ff81c7d57b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719030, "uuid": "23e2d4b1-fdc2-4bdc-ad4b-d351baf482e6", "comment": "Malware payload (SnakeKeylogger)", "value": "d58037f9e83d8055d97cfa3c078701928fa8d03938b77a81b1c7c895d45402e51bfa2ea0b1f98188de5fb480f8473226", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719030, "uuid": "9c4e36c8-3450-4706-8398-24041efcef25", "value": "T198F4AD0079F380E3F8C7487A553966CC9E2035566753E23366F53BA062036BBBAD6772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719030, "uuid": "0a7ae19f-4465-47ea-bc80-96a067c5687c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719030, "uuid": "481fe4e5-2272-4966-ae5c-a0c6ca463897", "value": "12288:jVpZu8h1cconBuOhjSXsPTNEv5wrqhMqDbVc+liB8G73v4KiaGkUwgYDlV86/YzE:JpZlh1cconBuOhjSXsPTNE5wrqhTPVc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674719030, "uuid": "092d04ff-9063-420b-a76b-8e6aef659f39", "value": 757248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674719030, "uuid": "6007ef6a-95cc-4c0c-bdf6-c3cf99025c9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719030, "uuid": "a9ab639a-7243-475d-91f8-ffeacfed7961", "value": "fa158fed703f97981b6035190a738822.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1177f0d2-9d47-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674716407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674716407, "uuid": "cb57a5c6-60e1-4b90-9f52-814c202fd851", "comment": "Malware payload (RedLineStealer)", "value": "ea94c44a9d3f412b996e907cfd92f7a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674716407, "uuid": "e7dfc1d3-6d3e-4145-b938-9118cb6b35b2", "comment": "Malware payload (RedLineStealer)", "value": "980b15a61ae9945b4d736b93d05295c8a76d61b3272e449e3146f8421803cf3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674716407, "uuid": "bf3d881b-21c7-4831-895b-bd9564f41cb9", "comment": "Malware payload (RedLineStealer)", "value": "4b51224f8844471f59855d008653bcc08a33bbd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674716407, "uuid": "4c97caf3-8f6e-4b28-b00d-27a89d46e3ed", "comment": "Malware payload (RedLineStealer)", "value": "45837fa4dce43f8e2d49992f67c488fadfacf35412eb9ad9955bdb62f4d33af9891695f6f4c18d835e132fb70082a2d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674716407, "uuid": "c724cdb2-0c70-4911-9687-49602bd9a573", "value": "T138B52BF73F4AE6CFC1991C796992E753D30012A0814AA9C3D79AB435FD83CC65A87D88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674716407, "uuid": "fdc92ebf-15db-4d24-80cb-bc4a7a591393", "value": "0757a8f986ddb3ab9e2a579b3f752934", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674716407, "uuid": "41464f59-d66f-4d2a-b6dd-e0bc43087b03", "value": "24576:FTJZ2dMncvOmj4av7V9TJGQAMyc7p4c3EcsDmDwHIGotzpfp7nUmEznMtPoaTZw3:lJfmj4avpTNTr1mc5Iem", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674716407, "uuid": "7ec5ccdd-cf48-47b6-833c-09dec53096e7", "value": 2308650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674716407, "uuid": "8c38dfe4-cde5-4995-a108-cb5af5564a41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674716407, "uuid": "aa56f54e-ed92-456a-ba46-6fd53b105fe6", "value": "ea94c44a9d3f412b996e907cfd92f7a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fe5f0b2-9d71-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674734471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674734471, "uuid": "b5dbeb4b-47c0-4dc8-a55c-ba12ee69efd4", "comment": "Malware payload (GCleaner)", "value": "c112fa67a68b28c425ff752536b9cf3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674734471, "uuid": "677c6982-4860-413b-8c11-f4cd616e59c2", "comment": "Malware payload (GCleaner)", "value": "9817e974ea08c37eaf33ae1580000137b851d4efe580626fe2a0f7ef0c94e5af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674734471, "uuid": "75cf9b1c-d4ff-4625-83d5-4fa4bda29cdf", "comment": "Malware payload (GCleaner)", "value": "1c42f7d6b641df3b3f02cb92af8b0fa109c7bae7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674734471, "uuid": "b8960f4f-6657-4b65-a1d6-cb718289b9d4", "comment": "Malware payload (GCleaner)", "value": "86e1b46f62c7e0899f01bf0423d8ce0df0409ef3f15665e0c81519e4ebe1cebeb0a268014bb5857d380218ef9ad32f14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674734471, "uuid": "6360f3a0-12ad-44a3-9900-466b73c7b7ad", "value": "T11D95238BA150A579C1618BFEAB3921049FB3BCCB187F04053B5912CD3FF9A7045677AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674734471, "uuid": "61a40984-b8f2-4b53-99a0-2102b67e5514", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674734471, "uuid": "7a6a4a4a-3553-4731-a293-21073eb5463c", "value": "49152:okug+aEyT15X/iv57bUHryP8w6kEX+fI4JSSCvLCgv2MR:hug+aES5/2lUHryPJjI4IHLv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674734471, "uuid": "2abfe28a-4a2a-4ff1-8177-8f201f50e274", "value": 1892447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674734471, "uuid": "3627c6fc-cae4-412b-b9a0-9f5da10f2c7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674734471, "uuid": "1da2e756-d82d-48f1-9dbc-d7848068c53f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a960269e-9d65-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674729547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674729547, "uuid": "02b1ce2c-3ce8-448c-967e-65b1008a35e1", "comment": "Malware payload (AgentTesla)", "value": "65cbebcd649971588a9fe09722a5c318", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674729547, "uuid": "6d1baadb-e3c1-4dec-8564-ac700a7bde64", "comment": "Malware payload (AgentTesla)", "value": "9a8eb0f10554a6912a26bcc42bd3a8885fad3e1b2ffb29fc33aef53b91dc9c99", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674729547, "uuid": "1e853a9b-86a7-4b78-99c6-c2867045f647", "comment": "Malware payload (AgentTesla)", "value": "84f193f18698c98a04d4e1a5e8e26bbd084fcce3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674729547, "uuid": "7b9acdd9-811a-4c9a-9a58-2a082c09820a", "comment": "Malware payload (AgentTesla)", "value": "b4390aeedd11ed3dc854fe8cc5bb52968d3af46f0b9aa828a6e50875240eac241ea57ce4f12a66f02eb6ad4ef9bea9d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674729547, "uuid": "4445bc33-df91-4cb8-bb0f-b42ace8857ac", "value": "T14465AF1423E9DF82F9BD4379C275524057B37866B532D3896EE1A0FE1EB3B008A41B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674729547, "uuid": "92295337-a3ba-49e5-882f-013396d3da8b", "value": "12288:QtG7vV5zxPCRgc7WUXDoFqIGCqhn3YUWLz7OZOwfwcmnQYFHc5FGDl2bsq9s/4nl:4iGCqNWLXOZzmQYmfGDJlwqVWkpQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674729547, "uuid": "a039442a-86d6-4c59-9761-56abd0cca7f0", "value": 1507328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674729547, "uuid": "174dfcdb-bf53-4121-a9f3-d8d3c7c6eb68", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674729547, "uuid": "be5b0ae1-e2b2-4904-a1cf-f855dc2b2f02", "value": "Auftragsbest\u00e4tigung.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb0326b-9d50-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674720404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720404, "uuid": "116b4234-31a9-4422-8fb3-754d7e7fbb3f", "comment": "Malware payload (AgentTesla)", "value": "6585bc93de16d73c80e2761522dc1cf2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720404, "uuid": "7d668025-8e16-49b0-834b-d965cb5210c5", "comment": "Malware payload (AgentTesla)", "value": "9b59b08cfee9e065603bb2ca0a992858fb7b155cb074fe9f889f15cc932026d5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720404, "uuid": "ee7db405-d32a-44ce-a17c-c77e5015bd52", "comment": "Malware payload (AgentTesla)", "value": "fc2d1109a85bb5e51a6ba02d33438a65e4cfae07", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720404, "uuid": "a65d18b7-d737-43c5-8190-d651a7d1be55", "comment": "Malware payload (AgentTesla)", "value": "a82bb18b05c07eb8c5c57edda527daf9658f85501ae4c3bbb1b477f362c2e19505e8740a459af1f1db1afb6622ec02b6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720404, "uuid": "82d0ad4e-53d5-4114-90af-fcc2300a1425", "value": "T1EBF37B9C725072DFC857C472DE681D68EB607577831F9207A42722EEAA4D89BDF180F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720404, "uuid": "32fc5616-6990-4b0c-8c00-dfe3c289f45d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720404, "uuid": "7068bb36-87e5-4ffc-86b3-4229194e1266", "value": "3072:pwbu5dBZH1dWHUom8Lao0X6vKJm6G0CdVK/Usj6HUKA1RLX+RYSUNGYa5:pP5dBh1QHOKy8XCU2HUUNGYa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674720404, "uuid": "aa2dc4d6-d877-4e91-b3c4-797a17e5c7c6", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674720404, "uuid": "29e82e14-4b4c-468f-a781-77961c06485b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720404, "uuid": "19d2b3a6-c846-453f-9f0d-61182e0d775b", "value": "Shipping Document_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125d778e-9d4d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674718986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718986, "uuid": "f83d77c4-ed49-4b51-972b-9cdbd9884a7b", "comment": "Malware payload (AgentTesla)", "value": "22a875e8c2e6e1c2c53dc40efd09a2b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718986, "uuid": "8542c8d1-443a-4991-ac67-ab6d1cc7fe7f", "comment": "Malware payload (AgentTesla)", "value": "9b72fd0b87a9c8971cbac88ccf67ab895f1aa0c37afb1a04c3b268cd3ce3706c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718986, "uuid": "2a4a7a34-6bfd-424c-8512-236f5158728d", "comment": "Malware payload (AgentTesla)", "value": "90afcb550483ed84dd607c00e2e8a80158f96aa0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718986, "uuid": "a6d52b2f-0474-4abc-b9b1-2dd7fe363756", "comment": "Malware payload (AgentTesla)", "value": "7535daa8dbce36cbd4543de3213692f27c3e163e6169311f6743e1d8393d4af77b36137dfa2e0ea103f79a72e0f48d7d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718986, "uuid": "7b980ffc-b115-4ec8-816c-162024ff0a0e", "value": "T12674235A591D20F0861B4F6EEF6D2FB0CBEA150A8D6333109879B29EC4741707D86E7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718986, "uuid": "2c8e16d1-315b-4adb-894b-fc5316fe19ab", "value": "6144:bSth6w6vGYuRKA4Bag8iVx2hwCBhBVf8Ln1FteuFsI7ayXvSvOa2uD+8Mqyx4N8s:GtxdRHKadhwCBhXfkbDsI+yXvSsuS1LC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674718986, "uuid": "5af44e4b-b0bd-495a-9c0f-0b84e0827dfa", "value": 364798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674718986, "uuid": "50783744-9a3d-4479-8fdd-bdf887caa0cf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718986, "uuid": "4b124889-1f0d-4cb0-a468-c927935320cd", "value": "URGENT REQUEST.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0cc0d57-9d5b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1674725265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674725265, "uuid": "d2b2a599-6454-4bed-b2da-6382548f8fd4", "comment": "Malware payload (RecordBreaker)", "value": "e533e104ad67102ff340131066328ae1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674725265, "uuid": "e561431d-c501-4551-bd8c-d0670296c160", "comment": "Malware payload (RecordBreaker)", "value": "9c3ccc6932c85f895acc088f43287b323c6cf915bc9f707afbe548fb3b4e671f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674725265, "uuid": "673cad9e-894f-4cd9-93b8-c574247c6926", "comment": "Malware payload (RecordBreaker)", "value": "02cf853cea23ec7c31e3aaece224e141310868c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674725265, "uuid": "9e254c34-5492-43a3-bf10-0f8fdc9522be", "comment": "Malware payload (RecordBreaker)", "value": "192354667b071ffa041f74f4702e1e0f627da037b9956fa2f9c1a2d395fc6843f2e31ab92058bdbccd8dae7ac036c1fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674725265, "uuid": "c6ae6118-fffa-46eb-9a2f-ce96b88404c1", "value": "T1ED14E1217691D032C59B4534386CDA907FBAF9B247A4948F7B940EFE5F703D0962A38B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674725265, "uuid": "8d9d63d7-c2bd-401d-a484-9f68dc3648d4", "value": "2fb86d3afd3014d2e2e15a2dd2f620c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674725265, "uuid": "41aaa073-85df-4b10-b64b-8baa220ec9de", "value": "3072:grBN2QBzxLwCssKRHdE57Soo20LsZ0TzFsDMioRYWJ53LvbuF:CbLhFKRHqmsGTJsoxmWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674725265, "uuid": "835deca5-2c7f-40a4-9541-ed4939220d2a", "value": 206336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674725265, "uuid": "4d3b91c4-89ec-4a21-a5b6-9ba22dd18055", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674725265, "uuid": "64a0ec7b-a45d-4b8d-8027-f3ec9fdb73bc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a35f1a71-9d90-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674748006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674748006, "uuid": "a2ba916c-06eb-4248-8510-edeecae57aef", "comment": "Malware payload (GCleaner)", "value": "95d5d7ffcf0fbf2e858560f0c01a6eb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674748006, "uuid": "910f05e1-70b9-447e-bd26-b9d1ccb74b16", "comment": "Malware payload (GCleaner)", "value": "9d551904118d429a680801f9f7a81d76597371fc29a81bb29580ce4b5be5c6a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674748006, "uuid": "96790e99-3f33-4214-9bba-57d621fc5b80", "comment": "Malware payload (GCleaner)", "value": "4768561655859d37fdc5e6051b177c7ed43e22f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674748006, "uuid": "0fea0bbf-b391-43a7-96e4-19588fce6de6", "comment": "Malware payload (GCleaner)", "value": "a95db7c04286e4e2c0579ae0a21ef48b60ac6f57416e5f995525e2c3875ea36df332979d511b0b399cccbb927ab7eab3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674748006, "uuid": "3c3441b4-3834-4537-926d-d38115f517ea", "value": "T10695230BE191C1BDC51687FA2F30E040BB31FD97743C5521369D228E2EB766299E17EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674748006, "uuid": "79830404-025a-4009-bc7b-325307b85452", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674748006, "uuid": "98c25ead-7f28-4175-8d61-426ac2611413", "value": "49152:okug+Zh0B+VS81p510iFO4aMdLPmd8dmwLCgv2MR:hug+ZhVS81v10iZaBgmYv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674748006, "uuid": "a99bc203-f155-4d87-b98e-99ba4f61d24f", "value": 1910140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674748006, "uuid": "31666eae-b52a-44aa-b972-268d9119975f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674748006, "uuid": "fe4ef027-be82-48e3-9fd1-89ea082a36a1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41d18746-9d9f-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkCloud)", "timestamp": 1674754284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674754284, "uuid": "2766c5e6-addc-4473-83d8-76fe141ecf1e", "comment": "Malware payload (DarkCloud)", "value": "9145885c6226cbd9f18c472e4ac0a4e3", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674754284, "uuid": "e109369b-05fd-4a22-9a78-2729708c854c", "comment": "Malware payload (DarkCloud)", "value": "9ef1c47ac7349f1f7c052ce54767a8fe0ff21f41b68e40261e41b351d3a1ddf6", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674754284, "uuid": "1299b421-cd2b-4c85-88b4-001a4d54f260", "comment": "Malware payload (DarkCloud)", "value": "24fa80c373b83e0dffb87da409f1c312e0eaf5ff", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674754284, "uuid": "9add6bf2-5746-4311-8ca7-8004d4cad8de", "comment": "Malware payload (DarkCloud)", "value": "6f24f1db6a7a9df041c101b248b0dd948030a5a13caf781b2de3bdc815b99a1f5ab05683e3dbb6730e767292df921369", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674754284, "uuid": "0a3ce357-1b9a-4f7b-ab91-ddad3fc5f7b6", "value": "T16345CFD1169CC7E5E8E60E3806283D2467999C87C37DA17EBED7247B84F674B40783A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674754284, "uuid": "c291d644-28a0-4f8d-a9db-6eab572ffd59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674754284, "uuid": "84711190-a153-486e-af14-6d3e54a6a928", "value": "24576:mPDJSb3ewHdqoXpDqDehBgLtQjC4qK3YDPIQSxFL:mPDJSb/qehyLy+4xIDPvSxFL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674754284, "uuid": "c42855aa-60e7-4470-822c-b0fab5d5f9cc", "value": 1199616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674754284, "uuid": "ccaf84ae-7666-4ac0-9c43-7ed7494ad0f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674754284, "uuid": "ba4e456e-23de-49d9-8acb-24d6ca69d9e5", "value": "purchase order__________pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d89fe28-9dd2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1674776262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776262, "uuid": "8b596ce7-b096-414d-88ee-d1c4da280e16", "comment": "Malware payload (Guildma)", "value": "558ef8761388f7f13c00cc55b099d122", "object_relation": "md5", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776262, "uuid": "9ff42ba9-a9e9-46b5-ba9d-8d3e087b5dfc", "comment": "Malware payload (Guildma)", "value": "9f771525632e751a59b3ca3f6ef1f0ade74c9513216afde0d563cb3be11e7fcc", "object_relation": "sha256", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776262, "uuid": "1812ddc8-4247-4b34-8169-aafbe534dd20", "comment": "Malware payload (Guildma)", "value": "383a7019e389e06329351a5aa640d76388d25620", "object_relation": "sha1", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776262, "uuid": "83dd6d87-3465-4fbd-91ab-9e457934ec2d", "comment": "Malware payload (Guildma)", "value": "abbb0bc80b9ddc8984f375d62a6caa7614e8276dd741a7b4ce192b179ff6a0dbbccab0f82c0f14cf12ae296c2aed9e77", "object_relation": "sha3-384", "Tag": [ { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776262, "uuid": "e28c3411-3726-45f6-94a6-cb3da9f66408", "value": "T169F0AB9980003DBEE43C173E8E0527051EAC3CCF1F8010922F8E02802AA8A8BAD0E4B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776262, "uuid": "e02849c5-ddff-4078-b6e2-012d868433ee", "value": "12:8rflM8OBE65GiWgNbWhWjdQHtLVOmi3dm7N4LcXbBbUqTg+Q:8lIGiW7hWULVO9m7QmbBbUZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674776262, "uuid": "915fb848-fc0e-4895-9af4-393f3ce4b01e", "value": 487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674776262, "uuid": "57e8938b-1466-4374-8fd1-c2e046db2309", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776262, "uuid": "1711c7d1-fc98-4b76-990f-7e4069c2ebaa", "value": "Visualizar20Comunicado2235695220381.06602_670.89591026.457460.52726.lNk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e9ddaf-9d65-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674729429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674729429, "uuid": "c1a29468-3f71-4eb5-af41-82450683f28c", "comment": "Malware payload", "value": "183f78fe3a2c4a806590625fc97f1b47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674729429, "uuid": "272e0b46-83d1-4509-a196-0d81808cf179", "comment": "Malware payload", "value": "9ff08d24c8ab0e8f99b49d54818b6dfb6670e273ff33f769583c2f51ee220f3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674729429, "uuid": "8fd818a7-dc5a-429f-8473-9e579b921756", "comment": "Malware payload", "value": "4e3358c13ab62394abfb5c5d96b17e21fa9345b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674729429, "uuid": "eb0b7031-267e-445c-99ba-178d0ca8ddd9", "comment": "Malware payload", "value": "61da584f1dbf2597a13167743c1e6d964300e54914ac3c495811dd5a279f412b13ab829371cc1b6e6799cb0441de7ee6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674729429, "uuid": "3a8f5e52-65d0-4791-91c7-af32892693c5", "value": "T15D763320BAE4D7F2F5129C7685143AE8C2628F69CF348173AFC45D8C6DF9B85D09D282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674729429, "uuid": "cce6ce99-a038-40bc-a747-c6141acacd7f", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674729429, "uuid": "37d4e24b-7185-4b04-a606-19daf857c958", "value": "196608:91OhnekfKeSmHTKlCFmLuWGgG4VZPDqx8gXJ1r5mZ6euir:3OhnrfnSqKlCFYEgGCPux801YISr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674729429, "uuid": "6e7ff6af-1987-4330-8f91-8ce7f84ff50c", "value": 7629520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674729429, "uuid": "c4dfd007-7408-4854-a126-a10b9d5e4eda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674729429, "uuid": "226aefc0-0571-4144-8b38-4c523b74e10b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a28ad00-9d49-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674717335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717335, "uuid": "3c55343e-49c1-4c89-9dd6-b1496347280d", "comment": "Malware payload", "value": "b053682fc0c29a5242fe43af8c29ecb6", "object_relation": "md5", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717335, "uuid": "552ae1b5-dbc6-42a5-a97b-d1aa4c75d2a7", "comment": "Malware payload", "value": "a05f662abb022da01399e18b4492d8984cc7bf990aaed1cc2294ba3c28875b17", "object_relation": "sha256", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717335, "uuid": "cd629d05-7591-43f2-92b5-61e58540ef94", "comment": "Malware payload", "value": "3055126d7fc31c93e1835e67dfdc8516d1604ec8", "object_relation": "sha1", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717335, "uuid": "b9ec4ee5-df63-4f1a-bf72-7e028cabb324", "comment": "Malware payload", "value": "a98dc1cb63d3a95e68be930d5349b8018f86ee93cdd3c20dafd3add6127ac6cfcadda082df3d1517458fb5f87b65346d", "object_relation": "sha3-384", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717335, "uuid": "d137fa4c-dfdb-443c-8e83-6967bfe2698d", "value": "T1B2D1A501F3EC5272DEB74B36A8B363800335F350A8539B9EA5A8611B9D162C646737F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717335, "uuid": "8c2b2d2b-73a5-45e8-8a1c-fdae8785f9b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717335, "uuid": "3b141529-0d03-4f4a-93fb-562138f1878e", "value": "96:oGpKgeeUmH2IjSRUfyVLEjDU7Rk0RN85nenbkPWKxNezNt:K8rDjQUWLEjD2R2EnQPWg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674717335, "uuid": "1cb0df6f-d5a5-4ab0-a4ee-d5dbf956bd7a", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674717335, "uuid": "84aa5b72-eb18-4027-a30d-9dea0baebe14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717335, "uuid": "770ae4fd-e904-4951-bb9e-4d2cc8197fc1", "value": "10093948585994_pdf.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68b00156-9dd2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674776254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776254, "uuid": "9a06d9cd-defb-4bc3-8230-b853d0465079", "comment": "Malware payload", "value": "5900b90aa7c89d52dd2a78b71da2b570", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776254, "uuid": "fa995f4b-e672-46a4-8353-817f8c5264f4", "comment": "Malware payload", "value": "a10c3835f7bdb8f30c1126d5ee27dfb74be5c4e73412be9d37a544c6f95ceb4d", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776254, "uuid": "5c08c490-6b3e-4308-b2ae-0b07a2e7a7e9", "comment": "Malware payload", "value": "6acd798b509c629df3a817935e0c77e5dad22a6a", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776254, "uuid": "9210e68a-f9ea-4f85-abcd-4f87dd8c233c", "comment": "Malware payload", "value": "1e185d85784bd8d0241face14f86d01a99f2ae912358d1781cb0799556705883417ad815c7dc4d32af12c9fe4b4c3659", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776254, "uuid": "8116a914-009d-4ed9-8623-d55a3ec51d10", "value": "T11F41592403ED4B04C276DD79BC78F1414A73B8161A31C6A901846295CF10318D87A72A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776254, "uuid": "57231619-4365-404c-aa6d-fe96e97d7f81", "value": "12:8x4erhZK9zu1yf1yBfVSCUfefqbcPl+Uc7c3Prfq:8x9Vkzu1i1yOCpf8cPl+/Q/rf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674776254, "uuid": "1139844d-33ea-458c-875d-cbbcc02db4bb", "value": 1978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674776254, "uuid": "eadae09b-3cd5-49f3-b223-9c8a41c1b7e2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776254, "uuid": "af2700ac-be67-404f-a40c-17c04abac885", "value": "Copy_INV_01-20.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6595c78-9da9-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674758748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674758748, "uuid": "9c5d61e0-9fd8-4335-8b62-3749419d8d4b", "comment": "Malware payload (GCleaner)", "value": "7dbc04c8ebf69640507ff98960e9372d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674758748, "uuid": "64ef7a88-81f2-4272-a132-e29e0cdcd0a8", "comment": "Malware payload (GCleaner)", "value": "a163695d1e6df4543b05f7f297ad0c21516888e00906c567f4bb79221d5833ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674758748, "uuid": "83c19e44-4736-426c-b537-163c5c1f86d3", "comment": "Malware payload (GCleaner)", "value": "dffc4af07af5d9addc87b9bf3304ec4076b13a60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674758748, "uuid": "06423772-c3d4-4a9d-978a-d934e990f4e5", "comment": "Malware payload (GCleaner)", "value": "393d5c3a95a456db4c8cc433ff07099cea708123014a50b5398ec78068e0387ccce466578b54dace856f10bd6174a051", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674758748, "uuid": "23df1381-211c-42a9-8a3a-737b6af368fe", "value": "T191952307E8C6C5FBF1164AFB273011409F37FC8B70BE6254B74A43DE2E762606A92695", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674758748, "uuid": "269ef18b-e8c7-49e4-8bd1-477ff0e557b0", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674758748, "uuid": "148c03d2-d6e1-4aa7-bbcb-5b19f4ecebe5", "value": "49152:okug+j+G5nCXSLzFifUtGWokNpYzStMAtdsGnDvWdTSLCgv2MR:hug+jVgiLzHt5okQ8rtdpr82v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674758748, "uuid": "483ea8fd-0d79-4cb0-a2a2-04ea011a87dc", "value": 1882359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674758748, "uuid": "2ab6eddc-9bde-447a-9744-169112efccde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674758748, "uuid": "6c70d7fa-f3ac-4735-b499-a99e47fa5ca3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70d411dc-9d9a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674752216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752216, "uuid": "f0f2fcf6-3c78-432c-8788-1596f456162d", "comment": "Malware payload", "value": "3ae8a7c96818ef9ed3904640b32f3369", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752216, "uuid": "b66a5e24-c432-4dcf-9b21-a3eb23df3b15", "comment": "Malware payload", "value": "a1d81c5b5e41aa1472064531801380b0270e57a78499b8c5fd20e632f141609d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752216, "uuid": "8070279c-297f-45f0-94c2-8b7d4603a438", "comment": "Malware payload", "value": "96f38a398e1e4cea27d809f74138d797e8772b1f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752216, "uuid": "e6f13924-4c7b-40b8-9aad-9db3c33b79b5", "comment": "Malware payload", "value": "9524a3ed668faa1ab9497802e56323328ebc878831a960b05aea077d767a19265c80b829d8483a53ffb1e832422abfa8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752216, "uuid": "c5400703-d2ee-4404-8ac2-4c7199dbb401", "value": "T179C3828DB5E7202555673D385A9FE00CB63B84532B7D9940FD4D63942F6883883BBEAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752216, "uuid": "6f88ad5c-c39f-41ca-8b91-51eb43ac6441", "value": "1536:DTLm2YHy08wPt6Kh6PwuQDZ3zWrCEij97Mjk7q3bKbF0+mRawNAgIzNrLCUp:XLmHy0hfhgcmbK0YwNzYdLCUp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674752216, "uuid": "603163bc-f039-4a95-bd26-184ec7810296", "value": 126492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674752216, "uuid": "44b5f777-f572-4bcd-ab96-ca16c66acb69", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752216, "uuid": "22cd0fe9-f91e-45c7-9bce-e965b0ae0d64", "value": "payroll bureau service level agreement 88277.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f95e90a-9d50-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674720377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720377, "uuid": "1e7806b0-69f3-48e6-8458-320a5adf9bd8", "comment": "Malware payload", "value": "63614f4ae59ab69c66d262d31bacb3d7", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720377, "uuid": "5ac06c11-000e-4151-bb1b-ce9f80d07d0f", "comment": "Malware payload", "value": "a1df56a63cde53c9b3badaeff6bca923219a889848ed4e0b5ff64716b37bda53", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720377, "uuid": "a914b31e-b085-449f-abb3-663037c1f628", "comment": "Malware payload", "value": "2c50fc90ec2f7c80a6566cb32e8f9abae18e6de4", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720377, "uuid": "a530647e-6b93-4c59-8931-58819563bd41", "comment": "Malware payload", "value": "e2c87304ae47b66a7d68e269179c327be57d9bb918ac84a6133386838475c049806cc56c8ab0c05b3e43f041c76648b2", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720377, "uuid": "7963891e-aa2f-4102-9eaa-f495b39083db", "value": "T15B32A0254BA63212CB339D242786A04BF481C6BE0E35905E15DDC3D387669FCD159AD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720377, "uuid": "443783d9-ae72-4012-ab9f-55addf18b807", "value": "192:qq+6z6098M3tOyKNTPFLU3ti4Ter6/n8e6clpO0gV0+h7mHFxyv8bIVmR4xkXl2:5t60GMdO7TPFLUw4A6/n8e60pVgq+hq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674720377, "uuid": "788d075f-7f60-4a2f-abc4-1ea889367b35", "value": 10986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674720377, "uuid": "62c3cb79-18de-43a9-8cc9-b11353c4a73e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720377, "uuid": "ba318356-75a4-4cba-8fe7-120c9055e423", "value": "Draft BL Copy.GZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2784dd3f-9d84-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1674742644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742644, "uuid": "5c7546dc-588f-4172-a2d2-83e6cba31f49", "comment": "Malware payload (RemcosRAT)", "value": "40f841f874a98d342f2176fbf26fca27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742644, "uuid": "03992cf2-c131-42bc-8615-b0355704c290", "comment": "Malware payload (RemcosRAT)", "value": "a223dbd3e666c66e48d38bbc2e552a39bbfeb5f8b1663cdfa1d4a28543980c79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742644, "uuid": "aefb5c6b-31b1-49f5-9ed6-b0060756e91e", "comment": "Malware payload (RemcosRAT)", "value": "d33e4e84a0740b38ed699eacccbb9686b7c72fb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742644, "uuid": "6e95be73-c4a9-4883-ad5c-0adeded6e08b", "comment": "Malware payload (RemcosRAT)", "value": "2adcd114cb44a8cd3a38198987748d077485a6efde0b7730d88369595289e0d77e224e8913e5cd41415ae833db84558e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742644, "uuid": "351e47d7-e2b1-4cf5-b3ec-2f94bd81ddc0", "value": "T1F825DF1023FC5F45F6BA0B7896B9415203B7BC82B573E21D8ED120DE4EB2B54AB45B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742644, "uuid": "a02ed3be-34aa-47b8-ba3b-db2b8a162e88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742644, "uuid": "faf9f9bc-fef5-4aa2-9ab0-b8b2309fbabf", "value": "12288:/SkOvbnR8ey/Zhk2XD9zFqIGBDhyrwR9MEqfQ2u6l/SYUSxz+R/iIU/pSsGzXZ5t:Lv1XGLDv52VQmxz+inGd5u6HR+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674742644, "uuid": "43838556-2d54-4309-8526-597943f831c1", "value": 980992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674742644, "uuid": "7e9a7f6a-2160-4c80-aaaa-0cb0f3169088", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742644, "uuid": "416bd210-dfd7-4ba5-aca9-7044a7003f45", "value": "EKX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a050045-9d50-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674720448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720448, "uuid": "4d33f322-73f3-4fe1-ad8d-bd546a57f1c5", "comment": "Malware payload", "value": "457e9c546fd5a5a48fb67571c708539c", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720448, "uuid": "8cb1924e-90fd-41a3-8ae7-5c9e52c1494d", "comment": "Malware payload", "value": "a23da328bf42a9639ec730ebeb231ec3cb0ab33f771768a69f47906751646936", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720448, "uuid": "f375180b-663d-4019-8da4-55c6bab34c1e", "comment": "Malware payload", "value": "bde8ef40b3ce410e4dac43d61aebccd80b79f25c", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720448, "uuid": "e5776717-eef3-4e2c-bea5-1ae76c357773", "comment": "Malware payload", "value": "7c8a2523341a4444995f6702c9114759e06336fffc634d3386db5259feb7a97a4454f940273097101af572def506ea9b", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720448, "uuid": "e466cfd5-397b-4f01-9677-e09c5b06f789", "value": "T17F22A0902A36634E5C2C90BA3FCFE2355D4EDAD3A88BD3C19D0D1851DA841723BD2D56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720448, "uuid": "7d78e4a8-c2ba-416e-a380-a36da75ecbf3", "value": "192:LWX3v9MG/Yf77GVFBfWOybKX7KwXVsIOVdnCcQ3CSOwMiFzfJFyoczZ:Lglp/OkMOZrKwlnOVdnEySYwJ05Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674720448, "uuid": "8044fde2-d059-41c4-9be6-ae240cec558e", "value": 10692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674720448, "uuid": "1a161462-d28e-4cef-a0ff-ba25035c9b15", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720448, "uuid": "2415a408-2fa7-4da8-a6d0-0370f52fae82", "value": "7tcy2hdFYI.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2852f04-9d8f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674747601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674747601, "uuid": "bd870b22-922c-45b3-86ab-2bf42a97d00c", "comment": "Malware payload", "value": "ed8e7981b86704a33613246769efbfa8", "object_relation": "md5", "Tag": [ { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674747601, "uuid": "cbfcfd18-e00f-4ade-9c52-1e1decd9df80", "comment": "Malware payload", "value": "a30dd8721d4a3a4925ed825a21e8186efe32db0b8471947368dac0eef1f85efd", "object_relation": "sha256", "Tag": [ { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674747601, "uuid": "c86f700e-031e-42e5-b87b-9bbe6faadd9e", "comment": "Malware payload", "value": "721a8549f04772102929b3430e33df8e423578a1", "object_relation": "sha1", "Tag": [ { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674747601, "uuid": "941f9011-0985-4d4d-ac57-de3cba7c4ab1", "comment": "Malware payload", "value": "155badc825768394cca46f59d8119aad32790271f20a2bd3e7e7d9f7f94a0f929742c45dc843a01e5ce69e6e9bdea85e", "object_relation": "sha3-384", "Tag": [ { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674747601, "uuid": "78e42cf1-42c8-4c46-b5dc-639de02d897b", "value": "T189F1BFE097BE42E77C052C3BD7F8D1B1E51C49E6CE5C0D2841C9E4E522D7D55AA9C084", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674747601, "uuid": "8341693d-e3e4-4bd4-8a15-e7e2f5a75e3c", "value": "192:1mJZXT/WmpvDa30QO4R8bqynEprwt3iPMNOrGTO4VZVeJk:SZDue60R5nEBi3iUNuf4R0k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674747601, "uuid": "72bce267-ecdc-4e85-8f78-ec75ba57f51a", "value": 8084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674747601, "uuid": "044597cd-d723-4cd1-b23d-3c0db74effde", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674747601, "uuid": "9d637d0c-bb9d-498d-829e-677da9256ec8", "value": "a30dd8721d4a3a4925ed825a21e8186efe32db0b8471947368dac0eef1f85efd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37c29a80-9d4d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674719049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719049, "uuid": "111eb6a9-2fd5-44c9-958c-86b67dbcea37", "comment": "Malware payload (Smoke Loader)", "value": "3454cf624e0778c6b0ea3bb5ce20be5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719049, "uuid": "e0c7e299-453b-4946-8480-e4e80ec7e3c5", "comment": "Malware payload (Smoke Loader)", "value": "a33918064e6cf084f67c661b0661251fa2627e24761889b1991001c40d641ad5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719049, "uuid": "9a4f5cc3-aec7-4f2a-8c6c-4ca491c7f1f4", "comment": "Malware payload (Smoke Loader)", "value": "d3e8cf388f9c5ceab13372f33271f9f0bd143dab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719049, "uuid": "cfef8120-7748-486a-864f-cd4ae9e4f6b4", "comment": "Malware payload (Smoke Loader)", "value": "3cde2c85aca458580cdcad19d26c1c398e02be9af3921e63ee5fb700fdbc1741ce8732ba8598301cc89d17a1287e1d6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719049, "uuid": "87e0c224-7af7-4074-adf3-e1ee9b463bf8", "value": "T18414E0227990C032C79A45340835EBA16F76B9720E97D8877B9C1BBE5F703D05A3A387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719049, "uuid": "947e5e04-9b19-4dcd-9635-369111e19e25", "value": "2fb86d3afd3014d2e2e15a2dd2f620c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719049, "uuid": "b2c60530-be06-4295-91c0-dea81603b6da", "value": "3072:aBN2dgYZLdGkQHNc5tq0J57SrcEsSoNm2YyY6PWrON1Ps:u0LDQHNGq0UcE5am2Yyoi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674719049, "uuid": "3ef4e9b1-e8b9-4f8c-9bbf-4ec7e545ec3f", "value": 206848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674719049, "uuid": "b6c6f30f-83cb-410a-95d6-dca5f381766a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719049, "uuid": "08024110-9934-4e2b-87ab-12750cd7a59f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb390225-9dab-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674759722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674759722, "uuid": "40961780-f57e-4857-86b6-225e6c7eeed4", "comment": "Malware payload", "value": "f8c7c54fc25c5bdcf08f778b362fab72", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674759722, "uuid": "cd75fb93-737b-447d-a699-4e0e19ed6ecd", "comment": "Malware payload", "value": "a340ef5adb00a2bf1a0735600491ca98ac8045b57db892dedc27575a53b25056", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674759722, "uuid": "2c6935ec-4ab8-4d0c-9b2b-15dd8956b89e", "comment": "Malware payload", "value": "378044cb569c6f40202296b756b49957fb22adb1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674759722, "uuid": "fa98f799-5fa7-4f14-8d99-1b3bf9047e4b", "comment": "Malware payload", "value": "55b523f36213e668404f53183e0b5fe423a4a0b66362f36ad7d8b25782ad846a2797089eb62680fec9f9d88fa6031ece", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674759722, "uuid": "a8ea0e69-65dc-48d5-8954-d6568c5f424d", "value": "T1F0E37C127AD1C471E6B30A301970EAB25A3FFD314F61AA5F639402AE9E305D1E931E77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674759722, "uuid": "f199ed38-8c47-4fa5-8256-687f92d87a42", "value": "0d4c72eca79518082f6b2512e1810693", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674759722, "uuid": "b947a11d-04cc-404c-9ea9-704ebe2dc194", "value": "3072:W4wpch1pxvhC/Q3xOItTVriTfVbSMhC+6VuBrOIrapKyqSWALOLRaChOzf0kYO:RwpcrhC/21tTgTNbSC6PKlkC4zf0kY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674759722, "uuid": "b8fbe064-71d9-417b-9d1a-d01a5cb3b412", "value": 144896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674759722, "uuid": "a45aecfe-cf73-4065-9614-764511255761", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674759722, "uuid": "471aed97-3eae-4ad4-a47b-9dcf9677d859", "value": "a340ef5adb00a2bf1a0735600491ca98ac8045b57db892dedc27575a53b25056", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cae0cb6-9d50-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674720506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720506, "uuid": "271a3a52-841a-464b-9efb-ddd41a7d2b85", "comment": "Malware payload (AgentTesla)", "value": "61b272142f06bf772009b4b055e7cda0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720506, "uuid": "499a765b-95c6-4095-815a-a3cf81d8ef38", "comment": "Malware payload (AgentTesla)", "value": "a654440720fcdb36cc338da86c2c6beb922b3918c5341e168741a60a3d5ad2de", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720506, "uuid": "dfe14ebb-138e-45b7-992b-0f62003013f1", "comment": "Malware payload (AgentTesla)", "value": "baaf50be2cad818b4b45d51d4bc4806be5cc07f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720506, "uuid": "8b220946-4781-429b-93ea-9629b278970c", "comment": "Malware payload (AgentTesla)", "value": "ac98b6cb4dca49c15b690161f65751bbe91dc817b131a1ce353a732a3ee4af9675a6b92699e24f2bddaabf3005062760", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720506, "uuid": "79533a1a-1c71-4618-b8bf-0cc83b76b69d", "value": "T1AB441210A3F985D7E5D319330E3D565A6FFCD9222A796B0713405B097C3FA92EA0E326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720506, "uuid": "bb9eb305-86c6-4eed-b7b4-e38c4fa88405", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720506, "uuid": "85c63a36-8cc9-4863-8b27-002bb27b0602", "value": "6144:vYa6dvq9HsUZUkzgyMl4okFW0M172X/PqjoQThSkEAL:vYv0akzgyMfvSX/PqjoQ1lEAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674720506, "uuid": "d43ebd00-4cda-4178-bf98-d8e2dfdadf22", "value": 272473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674720506, "uuid": "eb4d253a-10fc-4dec-a42c-e28f974f6d96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720506, "uuid": "283f9f1e-e947-4aea-b051-dd635df4ca6d", "value": "payment slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "880e5c48-9d23-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674701145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674701145, "uuid": "17f810de-1d5b-4c01-bbae-665ec046a9e8", "comment": "Malware payload (GCleaner)", "value": "54991a18b5995264efc6e9f4e3fcfb58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674701145, "uuid": "0003a26a-3a8a-4147-b3e9-9fc6fbe01276", "comment": "Malware payload (GCleaner)", "value": "a77a91481883ee9903966921de29d6eda21f2ca99fdf4f3594ed56c5207c8d58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674701145, "uuid": "6e10af15-822a-40ec-a355-fc40f5d52098", "comment": "Malware payload (GCleaner)", "value": "a04ddd76cf74d179a24b84cbc435bfa1e4d6badd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674701145, "uuid": "6a41ad04-a9bd-472e-b9bc-d4a8b9f6a7b3", "comment": "Malware payload (GCleaner)", "value": "9e418229e3a6c20c0fe6e88845b0f5815805b2f0f922bea2d7c104e8c24e4578e3d2bce2f00b6361db267ed74016a956", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674701145, "uuid": "6b01825d-5224-4897-8ba7-e8a54c8807c2", "value": "T11F853303C991CC77E073FF7C8E34424BA87FBA1528969A16306D2696CF36A4A551F723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674701145, "uuid": "f1ec025e-cdb9-42ed-84cc-3bd5e7b3879e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674701145, "uuid": "f167092f-8d0b-41ee-b4bf-17ee4bc856d7", "value": "49152:ZSaE4zIvEdIUTTEULfn6KM7Q/5OEEAV/RTLCgv2MR:caE4zIvETTEuv6X0/5p3/RXv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674701145, "uuid": "6b00913e-5352-4710-85e1-2a318cf5bffb", "value": 1844757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674701145, "uuid": "2cf6266f-d44f-4405-b0a4-e829cf0a5f2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674701145, "uuid": "0863964b-8f5f-47e1-863c-5ea3f00f159d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24fe372b-9d4b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674718158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718158, "uuid": "1d111987-62e4-4d24-8efa-8c40e9f718ca", "comment": "Malware payload (Formbook)", "value": "32b61efed665369f276fc0e23a4bdc7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718158, "uuid": "77fcfd34-5cf2-4a80-bfa6-639f68229c82", "comment": "Malware payload (Formbook)", "value": "a803baeae3e3a6d11b39b8a3df5bd4454fb50a3d950c19071e7f8d4ecd545237", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718158, "uuid": "a1802362-9d0c-434d-8c68-10ebcc95b6ef", "comment": "Malware payload (Formbook)", "value": "f5e48582c1edf65b4410e280f171cf992136e217", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718158, "uuid": "e8749f73-e49a-4cf6-a8d8-75128c7f58bd", "comment": "Malware payload (Formbook)", "value": "68c1c8c128cf2a440edd7c6651682b410af48bdfeedda119cdccc6e6ce3f8a0b853a07305660dbc9f6e77ac8e7126282", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718158, "uuid": "c8e7ea41-bc69-4410-a9f8-77f482f127cc", "value": "T147E4AD1023EC9F40F6BA4B789679509213B77C977573E21D8EC120EE4EB2B14AB45727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718158, "uuid": "1a73ccbe-b4de-457d-8be7-44ef2f67f161", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718158, "uuid": "60d0bae2-d627-457d-891d-84c737a199ea", "value": "12288:fSkOvbnR8ey/ZhxCXDPzFqIGsAFzTrlt9CC1g3BX/cDWu:rvxAXGZFJV2RX/cau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674718158, "uuid": "eab5ae0b-a4ed-4daa-9476-470f4554d996", "value": 702464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674718158, "uuid": "a6b5774f-3526-4192-9e58-02d110d6bcee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718158, "uuid": "56af2263-2cfa-425c-81d9-d9a31fc6f4a7", "value": "DHL Notification_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c35424-9d81-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1674741597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674741597, "uuid": "f11cb6dc-cbd5-4ced-8b6d-8c5972732ae7", "comment": "Malware payload (AveMariaRAT)", "value": "efe233b3ffe0cc102592415257fb8a41", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674741597, "uuid": "58aebc42-e955-4e23-bd53-8de06fe59179", "comment": "Malware payload (AveMariaRAT)", "value": "a8920f5026243373c34756d2332a35b691ef70d15a6edf82a95a934cd1eaa2df", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674741597, "uuid": "e239f957-9777-46bb-98c9-c255f76717d8", "comment": "Malware payload (AveMariaRAT)", "value": "19cde54f139b31a24e715ced3ad72c6d3a45a721", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674741597, "uuid": "0579c8bd-00a8-46c5-8fb7-ba9ed8350b3d", "comment": "Malware payload (AveMariaRAT)", "value": "0daee8293f176fd8e7b3f1d3ec48145bd02ae32f07b22cba521a67e5b4b652b83577bad199cafc9fa0e1d2274e948961", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674741597, "uuid": "76c09833-5220-4445-a3f9-69142d24f1f5", "value": "T123A4DCB4602B4530D258EC0F54A17A1C2972FED3A8E558E0939FE871CF62EF56ED064B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674741597, "uuid": "bb0d9911-c2f4-4410-b55d-cfc9f9ea9f02", "value": "6144:ssBvxGaxUn2+Na96cHzJ5NSTVzFt1RDAUww:ssBpXSn2+Na96cF5uVzFHRsUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674741597, "uuid": "5559ddf9-e005-4524-a9fe-d7e320f490f4", "value": 488828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674741597, "uuid": "6ca385e8-42ab-4ac8-ae44-f41defe82d26", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674741597, "uuid": "025ff1d6-d0c5-48dd-9607-c131dab55300", "value": "Tender for access control .doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e4ddc50-9d50-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674720402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720402, "uuid": "783abd7a-3e26-49de-abde-de984c4d4e2e", "comment": "Malware payload (AgentTesla)", "value": "107fe2ac90955572fd89d53510ca9242", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720402, "uuid": "c9e88d40-084e-4831-9bdf-9a8170853e55", "comment": "Malware payload (AgentTesla)", "value": "a99b49f2067ae486a530b63a38cc373ed8d28c0e7f60d5b24e4fc3e0fe60f677", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720402, "uuid": "9f3c6077-b35e-44c1-a012-36269acd1c61", "comment": "Malware payload (AgentTesla)", "value": "6a461ca59b3b132459447b5a975830f6617e5471", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720402, "uuid": "271e7756-0ff6-4d5d-bb58-e0808dd2d729", "comment": "Malware payload (AgentTesla)", "value": "5725cba5654bcdfcc4783552773f2ee8fc870babc2719aa83b206f53d35197686130f10fe90cb3bc3deea7efdaaeec0c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720402, "uuid": "28ec27f0-1aa6-4032-b1d0-f60561129f54", "value": "T145227C3CD201F41AD112457DE142C6F1F768A597E221B92D3018339E4BA01D75BDE6AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720402, "uuid": "be44f468-fc93-49c2-831b-8566e184ad53", "value": "192:ScIMmtP8ar5G/bfIdTO5namWBX8ex6y3wrN:SPXt4ATO5nosMwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674720402, "uuid": "febda83c-9e31-44f1-85dc-40c00e9a3af8", "value": 10360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674720402, "uuid": "958fd555-c792-43c1-aef9-0857181d8295", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720402, "uuid": "cb7e8b99-b3d2-44e0-839e-8c1adf998974", "value": "has been verified. However PDF, IMG, xlsx, .docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7340df1c-9d95-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674750072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674750072, "uuid": "c6ba30ed-6aa6-48e0-bf5d-32d22476f08b", "comment": "Malware payload (Smoke Loader)", "value": "0cb2c997ec086e0279df16c054686b04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674750072, "uuid": "ab034c2d-7c17-4a59-a07f-dc4deae686e6", "comment": "Malware payload (Smoke Loader)", "value": "aac691c9beeb286a0ce51bfa051b08050258a10038938cef9f95b35e25d2be04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674750072, "uuid": "3295e53d-ac64-4782-bb68-f7f35d5ed563", "comment": "Malware payload (Smoke Loader)", "value": "cc8d979cc1446be8ae6630428099bbd2f87c3cd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674750072, "uuid": "8708331e-64be-4b57-a082-30fda6ff2b65", "comment": "Malware payload (Smoke Loader)", "value": "4ea6a8febecd44d3ba07ffd160b822e96df89d85ed5e4a29bc55da5864a760412dac5253298ceba8cee3d96c51c475dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674750072, "uuid": "43cc546b-1937-4b48-b957-b10c89ff3900", "value": "T1B514E0123491CC73C8E114355824D6E46E7EB93216BB948B7B981AAE7FB13D1533B38B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674750072, "uuid": "d3199748-a0d3-45ce-a8a3-4cf790c79d54", "value": "3441d27f999e45e989c5f0204be01528", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674750072, "uuid": "1988e997-080a-4803-a40a-1b40ba8085e7", "value": "3072:iBN2Lxn0aRLn2TFhJF5eNAXv64wXePH4JpwZye/hRbBvP/dL:WubLnIhJjf6xXwYPYX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674750072, "uuid": "91580ee2-8364-40c3-a40b-dc9c51bd82d9", "value": 203264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674750072, "uuid": "e706a6f2-7ad0-4006-9319-a4b8d6243148", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674750072, "uuid": "9b7d2d93-9e88-46fd-898a-b080e537f94e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8d5ce4a-9d83-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674742539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742539, "uuid": "8e222482-2ebd-488f-b7ce-7dc2c9838e4f", "comment": "Malware payload (AgentTesla)", "value": "f468a2eb85986b3e5479ae732fd6c21f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742539, "uuid": "967728bb-cde6-4831-ad92-0fbb32100b19", "comment": "Malware payload (AgentTesla)", "value": "aae65c255c24872651f5639421cfea382847382d50d40042cb931b7f7441d445", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742539, "uuid": "177087d2-be7f-49c2-972f-60cc57d49717", "comment": "Malware payload (AgentTesla)", "value": "7038f2c7b8da03f3fa305664d08f13393252b0f3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742539, "uuid": "9fef9059-aff8-42fe-a51b-daf42a5f74c6", "comment": "Malware payload (AgentTesla)", "value": "a2a1bf2c1a6517e16418fee2705c3a3625fc395df61cfe664a4ca498b85882b1a9085ce20bffc9356d1081655fcfc9a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742539, "uuid": "5ef40cfb-c554-4c16-929f-0c1afd661f4d", "value": "T1BA44121073E4E0A7D1718332B63E9BA3FEBDE80511E8865323009B5C7A36A86C55F779", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742539, "uuid": "5f28363d-c3b3-48b2-9f07-5dd633374b04", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742539, "uuid": "19f766cb-a599-44ab-95c2-9b958dee7572", "value": "6144:vYa6TVvAOnbpSRC7sKuxYT4L+UQwFa2m+9MQOXtwyGi8Nnl4c4iKY:vY51nboU7W2TjZAGQ7licH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674742539, "uuid": "3d2671bf-535c-418d-8ec3-aacdb9ec3388", "value": 272725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674742539, "uuid": "3e993ed2-f044-4133-8dcb-f16ce466c19c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742539, "uuid": "c21d85f9-e7cf-4c18-94a1-b44b820c43ba", "value": "Bank TT request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d408fc16-9d7e-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1674740356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740356, "uuid": "7857cdb1-56cc-4c92-8f05-0064235a90aa", "comment": "Malware payload (GuLoader)", "value": "d353328e5b7da1d726f0738efde0a2db", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740356, "uuid": "4cdf3cf1-4f65-4741-96ad-bb84fa3ad496", "comment": "Malware payload (GuLoader)", "value": "ac37f563962d397ece20eeca7022518e31574f5144d8d562752b790bd1a81bbe", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740356, "uuid": "8cd19a1b-6968-4021-95f2-0b8fa035b373", "comment": "Malware payload (GuLoader)", "value": "d3a7c80cd017dc1f242d9d2dcaf2a10c8db67e5f", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740356, "uuid": "40e4442f-5104-4620-b5c3-65c85585d551", "comment": "Malware payload (GuLoader)", "value": "6e94d312c16b63fc5b3688bf707a35839da4efbee22303cebc24200b1ae20f77e96a2cebaeaddfcc998a13976f94b123", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740356, "uuid": "b7b2a093-5402-4bdf-8221-d84b92070fb8", "value": "T13364235215EAA93D2D6C222C64FFB4767814E33BEE484E7DFE01D4AA95D78C00C787A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740356, "uuid": "d93e6eee-6060-4f30-a487-fa19605bb5a0", "value": "6144:Nm9MeKGPxHG6BP6SqsCVw/qnarytrvDTeTZSGv7lg+Ib:s2AZ4V4qaryVXAZT76+Ib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674740356, "uuid": "fa0f63f5-83ad-4ae1-b812-dcc5a62237cc", "value": 313851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674740356, "uuid": "5958a368-79a9-4f92-90dd-5aee67287966", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740356, "uuid": "c50a56df-ee7e-4848-b624-78ed58be6b6a", "value": "SC_TR11670000.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeffab00-9d9f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674754575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674754575, "uuid": "53ae73d3-5649-4ba5-99bc-f25fda082d0e", "comment": "Malware payload (Formbook)", "value": "840753b4c8da36b15fae1a5d8c8d7e0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674754575, "uuid": "07959195-08e7-456b-878e-335d80b9445e", "comment": "Malware payload (Formbook)", "value": "ae3ea706282521a21b700c0bd6b6ab0b0eecd3a4936bd84a35fe900f8412d3ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674754575, "uuid": "a350a018-8cfe-4ce9-aa12-262a273f9f6f", "comment": "Malware payload (Formbook)", "value": "0048f92493ea4993dc88856e28726a12ef4d61ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674754575, "uuid": "973d3804-9e95-4ccb-952f-1304a8ae0092", "comment": "Malware payload (Formbook)", "value": "067f1d2b48409e492343497ce11fe2420192aa1897de611ee4d6cdec3fef915f19d119d928e416167b86c67bac321122", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674754575, "uuid": "e4b60983-8ef0-41e1-ada7-20dba89c4b94", "value": "T19E157B3C09B826DACABDF6BE6B85E5D0FE83805EB2758DDF4AD20441D54217222CBD1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674754575, "uuid": "2ccf6967-aa35-42dc-bdea-8de789d19394", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674754575, "uuid": "369ad18a-edd7-4e42-bdcb-1dd7068072d0", "value": "12288:POwZZ5qqqcKiurBcKUe93SGLkY380CTpwIByeVAr6Pf/UlAdjH5OwkV5fam5Gg:N5NqyugIkYE+I0yAGH/EArUVBQg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674754575, "uuid": "4f5dc5a1-e3d1-4beb-90a1-3751d97cb331", "value": 904192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674754575, "uuid": "95017f93-a03d-4030-bd21-50a76dc7412f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674754575, "uuid": "b8c8ed60-2d76-4cfd-a07f-fc7219abd2e9", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1775bea-9d49-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674717562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717562, "uuid": "a980bc45-560e-417f-857c-856835515c70", "comment": "Malware payload", "value": "83f225d9041a202b3d7cda3053d55c60", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717562, "uuid": "68395f59-14c9-4975-ad5e-7798d4f69edf", "comment": "Malware payload", "value": "ae68ab2eaef2c04303dccbdb7778740b0c97a437b10db050a41618fa5f537bb9", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717562, "uuid": "732f6f3b-1ee4-4067-a1ae-4f61b9b97f77", "comment": "Malware payload", "value": "1e5d72802cfb840d85ce24869d239c58c49e0594", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717562, "uuid": "a993f185-0761-4bcf-a4a4-1094ebe134e6", "comment": "Malware payload", "value": "d7faef0c4466910b278f24157509fd4f2dfb14bef05b340c694e9826b0baa62d744d389dc903ee8974a5443a6689b9ab", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717562, "uuid": "3801f55d-d088-4da8-b7b9-c6533da2992a", "value": "T111A4233BE26A9DF31825F4B5C06D46A92CE74C942B394DE0953951B0DBFCDA5F322342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717562, "uuid": "ccd0d2ed-c180-4c7a-8376-371c7c4c08a7", "value": "12288:NlraKwQBeGHwp2YvCx9Fp9iPg/uwd5jiW6YphZnNHI:zm+HMmx9FyJMi8hZn9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674717562, "uuid": "bd5c6610-a464-406a-a852-79de5f27b565", "value": 477814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674717562, "uuid": "49adc159-0be7-40bd-8674-ace05736ff41", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717562, "uuid": "76c12906-8b0c-4901-af1a-8f2fb25f40ec", "value": "Purchase Order Number 0062101239.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c1326fa-9dd3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674776635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776635, "uuid": "818b5ae5-8b07-4e36-a4cd-b4ffb7a5f019", "comment": "Malware payload", "value": "1149ed0506a9092d7b96809aa5bfadee", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776635, "uuid": "c4845e8b-7025-4eaa-ae72-1bad2874e9ad", "comment": "Malware payload", "value": "afbc4002c8369634933a12c9d2963644e648e30dc1ab25e506696f593fda4a33", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776635, "uuid": "3139e7e2-f8f1-4bfa-90e0-b6744cd60a51", "comment": "Malware payload", "value": "2bb639efc5c8247fbbc96809465806606cc35d96", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776635, "uuid": "5a4e6f11-0f8d-4cdd-b2fb-728989b724b4", "comment": "Malware payload", "value": "09767c6a8c980b621ae0c1ff985fb6bc3dd3040f1b676d93077e9f2f52201dc78b6c63ad97f4a78c7f276804f99e19b6", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776635, "uuid": "7716bf11-599e-498a-b94e-3c309efe8456", "value": "T1002149141FE60710D6B3C73A7CBEB311C9363C46EE928F9E015091886425110F5A5F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776635, "uuid": "46128961-0b9c-4d46-88f3-5d948d9fe321", "value": "12:80m/3BVSXvk44X3ojsqzKtnWNXW+UcCsvXRCKeX0myZXgymbWKDiN33YqlqV9N88:8J/BHYVKVWU+/CWhC7lQwymaH/CP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674776635, "uuid": "c452e36b-a816-489b-a1c4-2a7ea60026c8", "value": 1120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674776635, "uuid": "eef7bc58-cf19-41f8-83a6-5348fe46e66b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776635, "uuid": "d82932af-3cf7-4c42-b30c-4cc6bcb1ce8b", "value": "Password.txt.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da19904-9d8c-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674746144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674746144, "uuid": "cc6b1d37-3054-49a4-99c2-764feb79e116", "comment": "Malware payload (GCleaner)", "value": "f75d085a3fcb0782a47753c72b2840d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674746144, "uuid": "a47c46ac-e157-480d-9e92-4ba967b71fa7", "comment": "Malware payload (GCleaner)", "value": "b02dcb7fd8b34c7b60dbb88aeb52a21d09e92aa1b7ebbdb3fd79ce5f45dd39f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674746144, "uuid": "c10c4ebb-ebd3-4cbd-a7bf-4de8ce1607ee", "comment": "Malware payload (GCleaner)", "value": "0ec5e753879cf3b0c64a5c65c4c29539c19f2157", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674746144, "uuid": "b93936f8-691c-42e4-880b-84f3928d8d13", "comment": "Malware payload (GCleaner)", "value": "4777f0007da622e8ffca4db55536700ac74406dee433cf6f405beb606486ec749d10580b133bf868637b58b27dacbda8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674746144, "uuid": "27cf5e60-c889-410d-8a09-7b3bb2525282", "value": "T1DE95234BB881C2BDE9568CFA7630AB90B733FEC7603D0112777821C92EF67A415A5725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674746144, "uuid": "61ba17d0-f59e-4d37-b961-e131cd84155e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674746144, "uuid": "c8e095c4-de50-46cf-a77b-0c882aca3d9d", "value": "49152:okug+41RxohRwyZvrfoMXsr/Dq9eMyQdMg4HIEyWLCgv2MR:hug+kCRwyZvTXI/gHD4HlyGv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674746144, "uuid": "81ac6ce3-1e91-4ab7-93ac-be6e294090ee", "value": 1885891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674746144, "uuid": "589e2801-485b-4be4-bd5e-84f66b955190", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674746144, "uuid": "a4bd27e5-6b72-4ace-8473-be33769ffc50", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "006899ef-9d86-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkCloud)", "timestamp": 1674743437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674743437, "uuid": "b4bcce7b-207c-4a20-8c4e-45c60e629a09", "comment": "Malware payload (DarkCloud)", "value": "91ba92f3b25755c0fe02d8f969b7d338", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674743437, "uuid": "993fdce1-2426-46e5-b1af-ddf26f62f108", "comment": "Malware payload (DarkCloud)", "value": "b03225ede8b6ce37f12a6999260e06d0274ced375ac52294cae061a50dc61527", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674743437, "uuid": "b7360f0a-16ba-4edd-9551-32d36d86a7d3", "comment": "Malware payload (DarkCloud)", "value": "60750757b55bc76cf2a7ebd2a3fb08ad916fa351", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674743437, "uuid": "d9a38310-bcb0-4e54-bcff-b52e2436c277", "comment": "Malware payload (DarkCloud)", "value": "86254d616e4bbb0e75bea6580af50c6356b18e045403608b773dc9b3183d35fc87200dd5a804abb7abb9cec4cc9d9f5a", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674743437, "uuid": "9acbd103-ccd7-4d0a-b582-a2bcffe78eb1", "value": "T1F3A42304B6E9C936EC2B5B301AB747A245E6BA0724BA6687D34807CE72331F5D56D333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674743437, "uuid": "c56e9e71-349b-4c6e-b253-2b2a66e3c00d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674743437, "uuid": "c5b4a004-a8ca-4fcd-83de-be6cd46ab491", "value": "12288:RYhWFMic5xzHDjHpeLbcDXoOvSjNEHYd64jT6c:RYhpfxzjjJeLbIV+EEd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674743437, "uuid": "a072fce1-36fd-4318-b21c-352d21c3b1a0", "value": 486512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674743437, "uuid": "c3a052fc-bece-4317-b6e7-4acdb8e45445", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674743437, "uuid": "e7cb7e53-7d15-4147-95ab-2345df418a81", "value": "Credit Requirements.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c9b876b-9dd4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674777173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674777173, "uuid": "e9f1ec71-d3b8-4363-9a0b-ad021edff875", "comment": "Malware payload", "value": "5bd04239ddfdcc2a94d24ada645ef496", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674777173, "uuid": "a910591d-07d4-4cdf-8db5-43488946299e", "comment": "Malware payload", "value": "b03da986046c2b6590f52efafcd803f02ee12379d1273b3b6b0814bfe5b2474d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674777173, "uuid": "0bcafb15-0651-4086-970f-9506f6d08dfb", "comment": "Malware payload", "value": "87e9cd17570f9619bd67bd76fe37019750e14a19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674777173, "uuid": "cdb4c01c-5829-4d41-8683-974b54f045b5", "comment": "Malware payload", "value": "ad0bbd332523986055b7145eff0e587ea382fc593a4b63300d6f2e73f80cde0110ddc2a6937945a5a3369bbd6a094921", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674777173, "uuid": "dd22aa8f-0fd8-45fc-9ae4-6b5b63ca495b", "value": "T1D9F4373D1D7A93F2D474F97153E5A4A0FA9F4093B3A7C8A8C9D61AC05F421826DCE12E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674777173, "uuid": "c6cce411-6e67-4ddf-a798-2f2d875abf37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674777173, "uuid": "4bf505ef-cec7-4ccb-977f-b5e38d123a67", "value": "12288:VyazyOeq+pXp8irmdjXHNOrAe/IurXG+IF8zISjkKYrub5u/tlEDIIhHTCxAFk+c:ST8irmdjXHNOrAe/Iuze8dolr6ClxIV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674777173, "uuid": "c1381f46-6aac-4dab-b244-7ccc4db79e4e", "value": 756224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674777173, "uuid": "9659d63e-e01f-435b-855a-dc93ea62aba7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674777173, "uuid": "ab209f34-0a09-4e99-af44-0668ab20da05", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cee1a590-9dc4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674770412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674770412, "uuid": "42df400a-974f-4d0c-984c-84b98a657c64", "comment": "Malware payload", "value": "f6efcfa3e3532477ad07108ee5d26b38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674770412, "uuid": "615d9a74-fb93-43c1-bd24-99707ab2dffb", "comment": "Malware payload", "value": "b08da99c3832b447a00cbd2447faaf97a35bd7e27abf0e4cfd93f8e42951387a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674770412, "uuid": "6a649693-7b2a-4d13-96fa-6a9b28a40180", "comment": "Malware payload", "value": "21be14616155e3161ff11fa0d45932002b5eb686", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674770412, "uuid": "760b9021-62a4-45ff-8e3d-fb25cf5a72a9", "comment": "Malware payload", "value": "76aa1b3b148bbc6c0a630b2f5452ce1a5229fed0424f92f095a04ede206eda88a20105c80ced9b1c367eeb0199ffc5d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674770412, "uuid": "6ec15a0c-2926-4520-aeb9-dc40f0f14779", "value": "T1FA85330EA490DABED86586F22B354120EF33BE47203D0206395653DE1EF93B15D66FE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674770412, "uuid": "7f2110ae-b876-4765-b999-c3a2c961bdff", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674770412, "uuid": "40b0d7ef-006b-406e-b09b-a7ad2bf784b8", "value": "49152:okug+h9zqzG2nd92c8mZyfjzEYe2/i5I2ruuLCgv2MR:hug+jWPD2c8pDeWi5prv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674770412, "uuid": "3811fe2a-c9e4-4ec8-bc52-a1063ec73c87", "value": 1845662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674770412, "uuid": "9aac6537-7f87-41aa-8857-5ddd4e9c58c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674770412, "uuid": "ab13ece5-761d-4125-9529-ba403f7b1d07", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c0a5ebe-9d9b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674752503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752503, "uuid": "149030c9-2ae2-448b-a851-37bffd18d2a9", "comment": "Malware payload", "value": "4c85f58df1e88d2c44058feb8c7ca35b", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752503, "uuid": "5e472b28-93ee-41fb-9d1a-bd936b0f2e0a", "comment": "Malware payload", "value": "b234d9e4e91dee608f6f1d0a6ea24a3bcab623c93d5e0ca0272fd7a08fd8efdf", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752503, "uuid": "d1c75b94-dc47-4a3d-a4ac-2aacf8bc73f3", "comment": "Malware payload", "value": "943fc4384276129f62430d0aba49cd7d51810d2a", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752503, "uuid": "a90de408-e29d-4c2e-a631-d682fe9ccdb5", "comment": "Malware payload", "value": "9e6f9757b41a950753d9f7807ed3207f5f2557e927b23bb831875a11a2af3571ea3344acb587ba369e2864591d6a0684", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752503, "uuid": "bf87528c-d258-4766-84d2-06c4b7e2ff46", "value": "T1E0242336554B9EBFE35A8E0F348CE607F442334795CD9EC43B56C2DA198E914730A8EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752503, "uuid": "e95cb296-65e4-485c-b7e1-4eda302773c6", "value": "6144:Imx23oabOFmc/uqV8PWCc8pVm/ztavMdJs:Id39kmc/uqax/m/zgvAs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674752503, "uuid": "a022bdb7-460b-4225-add6-5e764e03003c", "value": 226009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674752503, "uuid": "2fd08dc9-1b2e-4cbc-a218-e27c38a28c52", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752503, "uuid": "1258ff77-ab67-4107-82fa-ce8e35621adb", "value": "Z Rosja jeszcze sie nie zintegrujemy.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad0b1218-9d52-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674721393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674721393, "uuid": "0ad496ad-726f-42ab-a685-e285a53fe08d", "comment": "Malware payload", "value": "49c474240ca1d79e9a0460a16761860a", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674721393, "uuid": "1a2e67c9-e6f5-42d9-8a40-e65fb63fa908", "comment": "Malware payload", "value": "b3778d0d522878a5b4238364afa827b557e203827aa2a6bce7e91cde0895252a", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674721393, "uuid": "624b3ea8-5353-41df-abba-110283135cf0", "comment": "Malware payload", "value": "fe66546b55618b1ba1fb789a8784549529c0bcde", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674721393, "uuid": "436c05a1-5188-492a-851a-4fbe4ad2a96c", "comment": "Malware payload", "value": "465969db42adbf06ac62f154cf236de4b991efcfb07d96eb47f539aebac14dc8b90884a73f460f709fbc498452b051ba", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674721393, "uuid": "a6b41515-7b0c-473c-953b-0ec154c96c8c", "value": "T1CA74F19D3210B5EFC867D8728E642CA0EA12B4B7836F4613B12F11A99B5E547DF143F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674721393, "uuid": "82244e5a-f805-4549-908c-232e82fb2e0f", "value": "6144:yML7CNgCISJiuHs9jvo9MItevnkwQJ9y/v/5PgqGpVrbCo:/L72DkCOs9evnwJMfABbCo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674721393, "uuid": "32365d84-e6ba-4b30-8e1c-897b9af6300b", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674721393, "uuid": "f6f9b51a-749f-4966-adf2-1dd762a1c2b3", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674721393, "uuid": "3ad1e3c2-588f-48c8-876b-c309d4bd8e1e", "value": "tt-copy_10.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d9c3c2c-9d50-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674720401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720401, "uuid": "0e382e50-ee30-475c-904a-1c39e1e4c542", "comment": "Malware payload (AgentTesla)", "value": "f67b55b8decdbdb3f2b3d94e9b78a966", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720401, "uuid": "279744b8-3e4d-427d-81cd-0e8d0ac82e37", "comment": "Malware payload (AgentTesla)", "value": "b45450a263a277473db3f03e8257fb36594be9bd085a8a045f9f4fc48267eabd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720401, "uuid": "27b27b2f-f5e3-4da8-9040-3c1fc616668e", "comment": "Malware payload (AgentTesla)", "value": "97dbea7d520c787c1957dd21784b762b415ec0b3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720401, "uuid": "190a824f-1ef8-4c0a-83d3-9ff32fbe2d41", "comment": "Malware payload (AgentTesla)", "value": "7c6dd96985b8cf84c3e518f0f5dea9e2a3e1a6c2f2a68d13baebb40d7ee18346e94be050ec3ea9981718402795c90e88", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720401, "uuid": "88f35bce-6454-4589-87a2-600e2417781e", "value": "T104F38C9CB25072EFC857D4729EA92C68FA6074BB931F5203906755EEEA0C887DF540F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720401, "uuid": "31e81a91-06e9-46a2-8465-a9c6d7983823", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720401, "uuid": "54e0aa0f-a2c8-419a-bd52-a1ddca427fc9", "value": "3072:ZHGARyb4vOm+uDmy+OigS3TbJUjdfaeex2PyLYrHFQbdvywX+3J:Zm67gPOiBbUdfaeXGvywX+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674720401, "uuid": "4e1b3a04-d806-4ba6-94a7-35796290893e", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674720401, "uuid": "04cfa470-6fcc-43ff-a177-2f886428f271", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720401, "uuid": "707898fd-9cf7-4814-889f-8316e8ad6ed9", "value": "documents2435466.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc6964c-9d48-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674717233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717233, "uuid": "c9c21d48-86c1-496e-8107-4118d1f5b1f7", "comment": "Malware payload (Formbook)", "value": "22a7749eec2293e077a1b05e1eb61a47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717233, "uuid": "dd8c2d6d-1050-430d-969b-61c2e6f1d982", "comment": "Malware payload (Formbook)", "value": "b4977eff8f75b00244fbffc9b7be9ccf6792a0ad8928d7bb33976935d9b8b35b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717233, "uuid": "6fbf134c-c692-4a92-ab0b-19533f5ba73a", "comment": "Malware payload (Formbook)", "value": "e8ab8cb57c7f1ef2149d26b6712e0bce4af452af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717233, "uuid": "5161b6e7-0730-4b55-89df-ea002c0a51e1", "comment": "Malware payload (Formbook)", "value": "ad8ec276600a64d8bf66e27e48bbdc920f49f74c62373a43fb519af2ad930122905247a2512483a1106cb21855d5212e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717233, "uuid": "17eafc49-d021-4d0c-bae8-987b3eb3b2a2", "value": "T11B74120847F4C477EA930A311876A3979FE6C22215758B4F9B402B65FE33391C91EB6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717233, "uuid": "b05d9db7-5f58-4519-81da-9b20f557888a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717233, "uuid": "a1f618de-9198-4382-9089-cee0fa28cf51", "value": "6144:PYa6nCa9dkp9r2Ukw0UfsN6YAySeBYR7sZL02X96dzzYz0NYgFwstL6R3OGHYr5I:PYdCt9r2USN6eNSO0s9KzzP7FwKb4YnG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674717233, "uuid": "ef94ca2c-b26d-4d1e-9135-7b35e5e91707", "value": 361153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674717233, "uuid": "9be256e0-f111-41e3-97ce-70d35f66ff73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717233, "uuid": "8a135638-0756-4856-8644-06104bb59aab", "value": "\u062a\u0631\u062a\u064a\u0628-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b03e5e9e-9d46-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674716244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674716244, "uuid": "8d8761d9-1105-406f-857f-1312383dc345", "comment": "Malware payload", "value": "92df80420f44d5d0d8ef249ec3642f54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674716244, "uuid": "c68fb5ae-3330-4f80-a05e-823009bf79ee", "comment": "Malware payload", "value": "b5fbe9746fe594d24e11713e418c40597b4ef256bfe1a460a1e093340443ec04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674716244, "uuid": "bf31a8d9-8ad3-4bea-ad10-7d7b8f9842a7", "comment": "Malware payload", "value": "e9092337fa9f04a244407e955e914c0847cdb8d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674716244, "uuid": "1b209d25-fbed-4ae5-a3e9-d18aa9869db0", "comment": "Malware payload", "value": "a8c9837d6671a14843c069aef3ffe105c7bb4bd89ab82ce13d216132caff3e271ac72859f59badd93575638c87be57f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674716244, "uuid": "63f5887e-049c-4181-85bc-31a638682b1e", "value": "T10C321B0869EC4233EA5E9BBCC4AD05811FF58737A106FF6A1E89D19939C33D9411136F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674716244, "uuid": "ca4dd19b-61bb-45e8-92f9-dc0cae07e745", "value": "192:pkmAqUXyAcuR/fgndZZ5lgRIxxUFYt+XN3Q2IamMwdu00tLTs6dLM7h:pDAcuR/fgnh7gCxUF/NA2I/d10tx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674716244, "uuid": "db2f7f96-426b-4c1c-8b58-3626fb816af5", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674716244, "uuid": "285a9b0e-5afc-4b35-bedb-97fd4d47c22f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674716244, "uuid": "43226f8f-2092-40e1-bddf-8813ce611536", "value": "riWG95JfmC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46129b54-9d41-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1674713919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713919, "uuid": "ebc32fae-d380-48c2-9aee-f1bea8095a3f", "comment": "Malware payload (Gafgyt)", "value": "87e214e8abc1e97c182ead7c666de37d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713919, "uuid": "d35ac41c-3351-4249-a38f-358aeac78314", "comment": "Malware payload (Gafgyt)", "value": "b603194b9031ee714554cb4ecb1b0ec5962e2d5c1fe9e2a381d51956d9618fa7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713919, "uuid": "1621eb0a-d6d0-4b7e-9a9c-9d183958c74d", "comment": "Malware payload (Gafgyt)", "value": "8bff20eeace5f494f27daaa3754a3a44760982af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713919, "uuid": "9e1fe9ee-c981-429b-b754-0a8860aa13ed", "comment": "Malware payload (Gafgyt)", "value": "f3038e5528275325fcefc7b0ffc78dca39b85dc30cbe25f11595b54b6933a2ccdc661c38bad52e9030de33579ad42510", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674713919, "uuid": "1db642a8-d5ae-4aec-adda-32a745cbd3e0", "value": "T13E14A727E7214DB7D81ECDB301A62201558D927B86EA3BABF664C958FB4680F05F3DD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674713919, "uuid": "0beaa17c-14bf-48fc-9e75-5fdcb74c9e0e", "value": "3072:EDfZIrvfyXwgxLf9ireDOhmvR8q+TGhjYj:EjZIrvC3hliEOhmvR8q+TGhjYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674713919, "uuid": "55c6543b-466c-440f-95c0-738042e20a51", "value": 191718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674713919, "uuid": "e13d32a2-dbbe-43b6-8747-7fc748542335", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674713919, "uuid": "e2690297-2914-43b1-a40d-c177eaecd40f", "value": "87e214e8abc1e97c182ead7c666de37d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0035587-9d9a-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674752429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752429, "uuid": "367b3a3e-7ecd-4e9f-97cb-84ca9be8eec0", "comment": "Malware payload (GCleaner)", "value": "f33b594331618ad3b7f770722b7537d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752429, "uuid": "5651dfd5-774a-4b34-9cc7-ac031b20f9e6", "comment": "Malware payload (GCleaner)", "value": "b641f60080b0e06dd60c148a15439f78efe9b29108439f55746dc944b34138e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752429, "uuid": "7e89fc1b-1f11-4472-9abf-f4e1b0cd73f1", "comment": "Malware payload (GCleaner)", "value": "1ec5ebb58eb9d946550cb7ca8bc99cc9d64ea6b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752429, "uuid": "e3ff7e0f-1a93-4a77-b7de-9ffd45dbb403", "comment": "Malware payload (GCleaner)", "value": "4e33de39b6c289152db1e40781faac1294bd5320444d9ed1450a6f255022d0afe589a49a87cf9cc66b1a0d919835562c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752429, "uuid": "d7a6f693-b7b7-419d-8270-92a2d5907403", "value": "T17F9533574095D1BCD1134EB739305AC5AB73FD4F15BE2409328E62CE0CEAE20A9A766F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752429, "uuid": "25029d7a-273c-43d9-b1c2-599f3fca1d83", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752429, "uuid": "9352ceb6-3ab6-49b5-8174-9f398ba7bb4d", "value": "49152:okug+E61yls0M64n91urCG+soODLCgv2MR:hug+E6ED4m+s/Hv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674752429, "uuid": "4340c6ae-aa70-4d27-93f5-6f4116e7d418", "value": 1901321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674752429, "uuid": "ada13954-6247-4839-9316-b1a24ed7cc9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752429, "uuid": "56aa6ea2-2194-4c62-9632-7df664df7733", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ae056fc-9d80-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1674740931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740931, "uuid": "f210722c-aecf-48b1-aa12-6a96ae690c6b", "comment": "Malware payload (SnakeKeylogger)", "value": "99b51e9c3cf95537755a6875ea7ab9c8", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740931, "uuid": "dfe88072-c462-4e4d-8df0-1a6a2bc2b05b", "comment": "Malware payload (SnakeKeylogger)", "value": "b6ba9b1f0724dee6813ee67780cc5a130e5565d616b6acf53a7ef417ab580dfc", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740931, "uuid": "2d30c26c-dfb2-4dab-b66b-0fbeba1ca5e0", "comment": "Malware payload (SnakeKeylogger)", "value": "b3cd81d24fef2526f4df5762a183a757c3291fc1", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740931, "uuid": "f3e9ee4c-266d-42f0-93ae-3b362594714d", "comment": "Malware payload (SnakeKeylogger)", "value": "748426a2074f1d828070e087021ffd0d124b1b897cd72b5b8fc6094a3ce02368a6382598e5a9666531381e6b58f31342", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740931, "uuid": "e8e6e742-df01-4363-a927-37a0f85b8483", "value": "T1D9059D1423E9CF86F5BE4779C674524063F37866B522D3895EE1A0FE1DB3B008A42B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740931, "uuid": "93d3e48b-2bda-484a-9f15-b210ab07afc0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740931, "uuid": "123f4cb4-961d-4dc5-8195-978c268028ee", "value": "12288:BtG7vV5zxPCRgs1/WWfXDtFqIGXB7iy5Rte4jJTrpRnw04fEVCl4nqU4/W4fd:FrGhiURtewTcvfCqVW4fd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674740931, "uuid": "8e0f3205-0f0f-4031-a28b-bbaf2da5340e", "value": 868352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674740931, "uuid": "130d9a15-845a-4b45-9e92-759a381944c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740931, "uuid": "e034a2fb-58d8-40b5-b463-2dc801d80c69", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67724b0a-9d64-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1674729007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674729007, "uuid": "09b66e0b-c2e7-4c6f-9e8f-94b796342779", "comment": "Malware payload (RecordBreaker)", "value": "94c879d34a4d9d0b763909f9161b779c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674729007, "uuid": "0bf66e8a-f4af-48c1-a348-9c4d10dad94d", "comment": "Malware payload (RecordBreaker)", "value": "b78a15f205497e919dc646cef7de88dd6e96612e28d816c27f708690b68a37da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674729007, "uuid": "467ce671-50c8-4199-ae58-fcd717c25b43", "comment": "Malware payload (RecordBreaker)", "value": "bdc206b4d0e32bc91f8fb869dc5799699942d677", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674729007, "uuid": "0c67073e-50c5-442c-8f3e-886c31a0d7b5", "comment": "Malware payload (RecordBreaker)", "value": "523738ff562758fc9fe85cf72bb117fdc66088d1c0a710f34f9170b2c17417709e89b96c71e2659272634d11a73a1144", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674729007, "uuid": "3d595141-a6fa-44e2-a770-b7ba64ae1093", "value": "T14914E02179A1C072C0A702744864FBD16FBFB87256E589473B981AAE5FB03D05B3A34F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674729007, "uuid": "824415c0-f6b2-433b-9baf-39d0d83207f2", "value": "2fb86d3afd3014d2e2e15a2dd2f620c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674729007, "uuid": "c2bc1e8b-4992-45de-9038-1b63ab31fe73", "value": "3072:lBN2OR/kAL6PnN0H469n5SOuZrizY6GhqRYIH95sx:LjfL61G469TerWYwYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674729007, "uuid": "783245bd-8843-4d46-8224-8d9b2d4f7fba", "value": 205312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674729007, "uuid": "f2b88c40-c861-4997-94c6-4786b2e6c3f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674729007, "uuid": "faca2d51-c524-4119-a719-4222e69948f9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81d8f3f6-9dd0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674775437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775437, "uuid": "649b9837-de1b-4918-877d-3ed2b18322e5", "comment": "Malware payload", "value": "0797440e2d36decb58c2839897dd562b", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775437, "uuid": "4d48bb12-9bea-4c9e-9d47-e0122c1071fa", "comment": "Malware payload", "value": "b82f4d53895d55829ed76cd7da651bab17f7e57754f3f988241952c41aabdbf4", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775437, "uuid": "e630f468-0202-48bc-af0b-de7ddd0f60e1", "comment": "Malware payload", "value": "c22e26375a29f27c027897df246c08869c6b45a8", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775437, "uuid": "89e74fe5-6357-4cf6-80f3-e8255ef45c94", "comment": "Malware payload", "value": "08a8380725927769a9be334b6880a94318f5d1b662b540949fa62ff423273f0d2c8945886eab9ccf2feb958d06997931", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775437, "uuid": "4e87271f-4c7e-4d41-a56b-62a8f1a48098", "value": "T1ED31041913E81223C2768B3BC8F68303D5307905BA116FAF41C7569A59427127E16EBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775437, "uuid": "fb18d0db-de4a-446d-a76e-6a3346c9a1bf", "value": "24:8Yjw1JpTQcuAov6qOIBq5+ccU+d4o0c5Cw1B/Q6n6w:86+JBZlcU9oDRj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674775437, "uuid": "c9183cc0-543d-48a7-a4ab-20eb0182329e", "value": 1830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674775437, "uuid": "ef05b347-a7a6-4658-8836-a9e6ce701e89", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775437, "uuid": "e0739725-a6d9-4f4e-a50a-62bfa1d2d132", "value": "c22e26375a29f27c027897df246c08869c6b45a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5413fd4d-9d3b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674711365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674711365, "uuid": "5a5aa2f9-bdca-4111-8937-5cbc7ca86cd2", "comment": "Malware payload", "value": "4cdd57795cfb512c57f71fe729dd23aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674711365, "uuid": "5817f08b-074f-4c8d-b8a7-9d43e7b52968", "comment": "Malware payload", "value": "b8308edddd2543f429a10e95d4c0aaa811fb190bd9d1f11356e3ae123df273bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674711365, "uuid": "4be1869c-8e3d-413f-9b45-09592ca1ce7f", "comment": "Malware payload", "value": "248352d6df9f63cbf9d1a05fbc0a5b92521214f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674711365, "uuid": "beed1a5c-cab7-4113-8de6-db6d9379da0d", "comment": "Malware payload", "value": "1dd80195b653290173ef37c7a55660b3c0838a353b7232c7e06fed797ea926dca20f9692d2ece2624ee55be768fe0fcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674711365, "uuid": "a8580d23-64f0-43cc-a532-a9595091a661", "value": "T1C104E0317AA0C072C46A44702868CAC17FB6BD3256A9DD8B37A43E7E5F702D1573B396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674711365, "uuid": "e6b86556-a215-4176-90e9-d48aec3fe705", "value": "2fb86d3afd3014d2e2e15a2dd2f620c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674711365, "uuid": "34e00750-eae2-480b-8b64-defde07739af", "value": "3072:MBN2afVfLBE6j955WayZWFFu4yEBF0yoWd47t375bqe3gf:EjLa6j9HyZWVBF0yoWG7tr5bg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674711365, "uuid": "0c2e8eb3-854c-402c-8d08-15bdba646d82", "value": 178464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674711365, "uuid": "c4007e9d-5a7f-491d-ad03-207dc3887f3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674711365, "uuid": "695ef296-caa9-4250-b756-fba904a7fbe8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f7cc0ae-9dc9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674772239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674772239, "uuid": "bb6e2b16-4e8b-4732-9457-86bc3e7ccc5c", "comment": "Malware payload", "value": "4081c6172597ab7b0163b130925ad665", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674772239, "uuid": "a6ea4dd9-7e50-413d-9d3c-e262c49638ee", "comment": "Malware payload", "value": "b8944a57466cd23b02b462b13134b7980caa8a0c053a4f076435c4a004e831e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674772239, "uuid": "10e9ad56-9875-488c-8894-e4600ed1dde2", "comment": "Malware payload", "value": "dc1637b6958c165c86462b8ed63280a95ad07d67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674772239, "uuid": "3324c0e7-da47-430d-a0b6-17dc153208d4", "comment": "Malware payload", "value": "417ea4e83e6bcffc9f9381b1017ee86195be1a88e611cf050be6f668be74a03af8221e7fb5c4db16fae50d1e7158267f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674772239, "uuid": "10448df4-54e2-4cdd-b720-e326a2a66a5d", "value": "T17185334676D25BBED50203753E706180CFBAFEDB50BE6221320933AD199726128F57EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674772239, "uuid": "bdb8b285-f0e7-46cd-9092-b1f1bad860c2", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674772239, "uuid": "e23c74ce-c8b6-402b-b307-38b3dff4cb72", "value": "49152:okug+VxuNdnUq1SAV4e3iD1k8bFz6Syr0cbLCgv2MR:hug+V4uAqcIFoSyocPv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674772239, "uuid": "5a6cc049-6101-4169-8d85-ab9b00c9d3cd", "value": 1856230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674772239, "uuid": "6acb14a4-28a9-4301-9531-5e2809b4e614", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674772239, "uuid": "de26de57-a1b5-4f8d-a56e-aea486ee10df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5b43633-9db2-11ed-88f6-42010a9c006e", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1674762639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674762639, "uuid": "68fecfc9-ee25-4e18-880b-4ffb101e4f63", "comment": "Malware payload (ArkeiStealer)", "value": "8abfaae409bf39fee50815623157e2d1", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674762639, "uuid": "f4989491-9f43-4ed9-b46a-6993c98f1efe", "comment": "Malware payload (ArkeiStealer)", "value": "b9246a7cb0efe77225d19ff1dc0c982a6649c9b96ab63446c80542f146929a1b", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674762639, "uuid": "250ffd51-b63f-4c8c-b43b-85e53bd1af64", "comment": "Malware payload (ArkeiStealer)", "value": "6e1f85d46a5141ad0eddc0894b4a01b65f38ce32", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674762639, "uuid": "f43cb2ec-2239-42ff-affe-05670ac78492", "comment": "Malware payload (ArkeiStealer)", "value": "c2cb7ece8138e181a8d4092c2c08f57e7604bc7792bfd9255c6c3cb956d188f6a401dc0c304ce9bb80dbdb11df28ff89", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674762639, "uuid": "97500b45-3d37-48c7-a9b6-476ab97b9b02", "value": "T198740111F2B1D472D05F05308966D7E019BEED305A70A64F37B637EFAE30A505A6A38E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674762639, "uuid": "6d8a54db-9689-48b4-9f32-ca83cdf1b027", "value": "b35462da489bc13bae884e55b5227599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674762639, "uuid": "431a297c-95e2-4fb8-a25d-6ed2f4113015", "value": "6144:bLsrk7LanzMJedKeChRFbjhHAFyuSwaMW3VG1Ei0w0ztkYr8qMrc:bLsrk7Gn4JtZjq8uWMWFF9z6o8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674762639, "uuid": "241591b3-fdaf-4324-a840-b1ee8e6fd1b9", "value": 366592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674762639, "uuid": "2ac9dc62-cbaf-4b59-a22a-fae33eb6ef9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674762639, "uuid": "6a36d81b-6d51-4a16-a933-53338fb5e0cf", "value": "B9246A7CB0EFE77225D19FF1DC0C982A6649C9B96AB63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ad430e5-9d1e-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1674698841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674698841, "uuid": "685f98dc-23cb-4421-a4a8-ff0f5b1258b4", "comment": "Malware payload (njrat)", "value": "c4e0adb874cf0945094c39475f9a2e32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674698841, "uuid": "d5d40858-a1a2-449a-a4c1-05be3dc13f01", "comment": "Malware payload (njrat)", "value": "b9344b02f55768eab5fe7d72434f34fdc2a13c4a6f9e1bcec75dacb88e7323ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674698841, "uuid": "0b97a616-21cd-4f64-b196-d635b375f8c1", "comment": "Malware payload (njrat)", "value": "57a08a8949008b0f8a6bed19ddcbaa96e44d7c06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674698841, "uuid": "acc3ec65-81dd-4ddd-b633-18f1593292a2", "comment": "Malware payload (njrat)", "value": "a52c2fafe34aa56b8361bf62e7c0dd95bf13187e505c8d61eb1b1aa186d98a1cefa1c1bc6d48e0d420f2b876b6669c68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674698841, "uuid": "f0ae47a7-6bae-4758-a03a-b2ca01e938c7", "value": "T10DE208067BE98215D6BC5AF88CB313214772E3838532EB6F5CDC98CA4B676D00255EED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674698841, "uuid": "b0fe58f6-8ed6-4b5e-82de-3a01be8bc365", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674698841, "uuid": "5c9605b5-824b-4a31-bdff-d23a13940f97", "value": "384:G0bUe5XB4e0XfOZzw0Q0mS03AWTxtTUFQqzFrObbV:HT9Bu2C55dtbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674698841, "uuid": "050d523f-93b4-4175-893e-c34b899664d2", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674698841, "uuid": "40d6fdc2-0825-4914-9a8d-8d3fabfd16d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674698841, "uuid": "2332cee8-05a0-4ba3-8a96-147de5f4f277", "value": "bJia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a84c6e67-9d2c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674705064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674705064, "uuid": "7026a81c-e7f0-4e0e-aa18-93022cacbdaa", "comment": "Malware payload (Smoke Loader)", "value": "4e6c110ee35fa2a91d62d5084ce80548", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674705064, "uuid": "7d5173fc-6037-47e5-aa89-a0143df9b8c9", "comment": "Malware payload (Smoke Loader)", "value": "bb69ff576f2e3837ea3b0da3dbd487864ecbedecc778150702d7c2cbc60df9c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674705064, "uuid": "f5756bba-97da-4275-8dfa-d1d37b18c968", "comment": "Malware payload (Smoke Loader)", "value": "b97586b4097f75ed9d21477fb87dc8e4cc11f3ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674705064, "uuid": "1a591ad1-7900-451e-96b2-2a8d6645978a", "comment": "Malware payload (Smoke Loader)", "value": "ade400fa183fb88039f991f147f0ad31680e6fda8553d2d42d36757805df3b750c55cec78c944d27138c1393eadbcf01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674705064, "uuid": "a3218cba-234a-4f14-8de4-b8f40b71b973", "value": "T19964AE2271D0F860FB1E4636FD2ADBD4392EF8D28F3C76573294A61F1A722A0D167215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674705064, "uuid": "0f4d5492-8900-4213-a25a-080dd8b56547", "value": "e5f35c047e0fdde323b83e51e689dfb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674705064, "uuid": "6c743967-61f6-47b1-9798-26f10b54cfb6", "value": "6144:XbmL1QlZrF7BjkdE98MOlrYm2VY0+MOKX1aUT:LmijxFAdEi5WhaUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674705064, "uuid": "9afc72e5-dc78-4339-a930-164f4aa8a29e", "value": 332800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674705064, "uuid": "fa309a5b-2fcc-4f25-8438-70390ca35b44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674705064, "uuid": "b6bd4dce-d576-47bf-9fe3-d2439a47bc73", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8abd7b1-9d83-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674742565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742565, "uuid": "80685402-d8f0-41d4-95e2-1fdab10e3d5e", "comment": "Malware payload (Smoke Loader)", "value": "5b6f59e1deb86d14b9d19baa2b8ed001", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742565, "uuid": "37a9ae18-759f-4dc5-a3a1-b57578ea283e", "comment": "Malware payload (Smoke Loader)", "value": "bbd358ebc86fcf572727eac82d23302d0dd26152686522af90a89cc128e6378e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742565, "uuid": "51e122e6-dc96-4cff-b7e7-ab1057aec1f3", "comment": "Malware payload (Smoke Loader)", "value": "ccd68839186d9b56496f53685b911f241695f7a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742565, "uuid": "d5039fd5-9ed0-4c00-abe0-9568787861cc", "comment": "Malware payload (Smoke Loader)", "value": "36d641c3a1ca526f5c205efa24ccb4abbd6aaaf30a07ca04ee7808644f1c3b15a4415b986173ce64980b9bdd24e2dbd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742565, "uuid": "d4e4d69b-7782-4778-a221-80daf9588bde", "value": "T1C114E011B9D1C433C59604384824EBE16B7BB9331AAD888BFB5C1ABE5F306F19626347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742565, "uuid": "3efdc346-3172-4578-83da-10dcd4495100", "value": "0cf7da7ba6041e7b7038cd2e90d72093", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742565, "uuid": "a46031ec-9026-4fc5-9446-7fe162826c9d", "value": "3072:yBN2hlPsyQLQFmNxFNRk5sjasZvLiir6HFPNjdEvrYsmxq/GL:mKQLQAzFNRU6z/riF5WOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674742565, "uuid": "869ee45d-7b39-4737-aec1-148b873742e8", "value": 206336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674742565, "uuid": "a23b4769-a097-45b0-8de6-535c11f43066", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742565, "uuid": "9e952c27-e991-4557-945b-a9bba36907e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a8f8af-9d9e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674753751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674753751, "uuid": "24662859-9ce4-4a9e-aa22-356ca0ad7103", "comment": "Malware payload (AgentTesla)", "value": "e7973abc77f88ab490e32fd14b7d445a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674753751, "uuid": "f323aa22-6c00-41e3-ab45-bb197e18d384", "comment": "Malware payload (AgentTesla)", "value": "bbea7541f726c2ecb8eebbc87f6f52b50db57a836571ae9b0f1fd91dfb653b48", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674753751, "uuid": "a9335301-5944-401b-88c6-800d7e8ec046", "comment": "Malware payload (AgentTesla)", "value": "52673459e443f6a57c80a0e52160eebb638eaa61", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674753751, "uuid": "b3a23f55-3167-4a68-b831-42e374430d2e", "comment": "Malware payload (AgentTesla)", "value": "f21652f5e38dddc45be472687cee8a123ad73c99514da3849d5df0af23b1600fd98a5dbddf99a0d11e37aa5020055c35", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674753751, "uuid": "dfffe073-93b2-4f9c-9986-db2d9c359013", "value": "T1B8E26C1463EC827BE77F5BBEBC7541A10BB1AA23A426FF4C358D51C91B4279402217AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674753751, "uuid": "8d0c72ff-0ffd-492a-9520-bb4ef3f959b1", "value": "768:yM119NYrB3JBZd+y043kAmZbIkr05tIevQ:jkHl0exEIk2vQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674753751, "uuid": "de95e006-0d1a-4d0c-9673-d59cc2e8551c", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674753751, "uuid": "f69edcd0-bdb8-455f-8202-8d39073c35ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674753751, "uuid": "84a33bce-2039-40d5-9981-5bc782649cbc", "value": "MACHINE QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b0895a6-9dd3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674776634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776634, "uuid": "7e324385-198f-448b-908c-69d9a86acc24", "comment": "Malware payload", "value": "55c65981b085c50bed367c2e91f439ca", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776634, "uuid": "a4937dc0-e0b3-4ba7-950e-b1b19418cf9f", "comment": "Malware payload", "value": "bcb658a1c5085c95b03f5099e1c873ddc0e15a6b834f9ab1a8a61819511b799a", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776634, "uuid": "9f6d307f-8151-471f-b860-9c3bea1a6f1f", "comment": "Malware payload", "value": "130921caeff50ecc68604f14f5a72d89b0c71561", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776634, "uuid": "ba52fcba-8a61-439e-96aa-13014b25b28b", "comment": "Malware payload", "value": "9f9d2cacf4c4f98b15dd87b00c7e9538af734a8b6a9920b6948445e3b895afcb88f2d2d614938f5b7953c360a4d5199b", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776634, "uuid": "fc6344da-c9ee-4844-b63a-055c47a76c64", "value": "T143116D181EE25720D2B2C73DACBAB311C93A7C4ADE928F9E0151C2886435221F1E5F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776634, "uuid": "175808a9-e2d3-45c7-b84e-5261413c7b77", "value": "12:8WUm/3BVSXvk44X3ojsqzKtnWNtW+UcCsvX3iOURPYDf9Eg5ycNCnCVNl7DiNMI4:8k/BHYVKVWO+/CWHiOatOYil7aY7Ia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674776634, "uuid": "73fb825d-b793-4d52-b566-d701d73ab603", "value": 1104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674776634, "uuid": "dae94aee-bc05-40d1-8cd0-a53a9a21b353", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776634, "uuid": "ea14ad36-976f-472d-9b6d-1272ae2c2097", "value": "mal.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ae1e32c-9dd4-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1674777036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674777036, "uuid": "523ac7c3-6582-40b3-8481-312587d213c0", "comment": "Malware payload (DCRat)", "value": "00009e23a8bcbb7323c15448165dc6cc", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674777036, "uuid": "4604193a-a2d0-466d-90e9-351347c03c69", "comment": "Malware payload (DCRat)", "value": "bceca4720a9dfb62bf4f5130f9443e6fe40f24fb440df17a51b29340575805c0", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674777036, "uuid": "a5f5d7e7-2855-4213-96e8-3828eb16e765", "comment": "Malware payload (DCRat)", "value": "2b5050619a50c63d487ed07651be88d1a8ab92d6", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674777036, "uuid": "6d812942-c48b-4736-ae1a-8a146411de38", "comment": "Malware payload (DCRat)", "value": "d4c8da933a472fd78610317cf3119f1c0580e716d236b99b9548adcc033dc9cc84b12fda4fdb5d1008e70beeb88b2c98", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674777036, "uuid": "8a22b83b-5fdd-495e-8e98-7829b31a7dd5", "value": "T16AB5CF027E44CB12F0181633C2EF454887B4AD516AA6E72B7DBA377D65123A73C0D9EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674777036, "uuid": "46b7b191-bc1b-42ac-9db1-c8222d34050c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674777036, "uuid": "efb38e7a-44c5-4b8b-84f0-6aba4e3fcd33", "value": "49152:oEAW6oV1uWgMzCAKcNqGAonnXvjGt8YxKIh3i2L:LADWgmNqGAKKBli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674777036, "uuid": "4f8770d5-f3bf-4cfc-95f7-69af5c88090d", "value": 2408448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674777036, "uuid": "1af3c00c-0374-44fa-9b7a-7e502bbedf0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674777036, "uuid": "af6dacab-6b9a-48c5-a9bb-6447d0500844", "value": "00009e23a8bcbb7323c15448165dc6cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6904818a-9d82-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674741895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674741895, "uuid": "01e18dab-5821-4ff8-9dd1-a5703841b306", "comment": "Malware payload (Smoke Loader)", "value": "dd3ebeca94abf3aa118c38be15e9e971", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674741895, "uuid": "659f199b-21f2-437e-9b75-0d09ccc78280", "comment": "Malware payload (Smoke Loader)", "value": "bdfb2b536d397f44f3b3930b5f6f6f2610d334fc707f29f8f349c873d59f8075", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674741895, "uuid": "03c49651-eb99-457f-a30d-71ab4c3e93e0", "comment": "Malware payload (Smoke Loader)", "value": "bb4fc1489fa0957bdf56bc0082a227345cb2f7df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674741895, "uuid": "c04679df-aad3-4786-9d97-8e3724d74ba1", "comment": "Malware payload (Smoke Loader)", "value": "40bf997e02dad598427a31c79e60794e3a64b79762596ab0cad0aae521dafac063e4b9620906097a1ac0a633fc9dd3c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674741895, "uuid": "e9964630-d8c5-47c4-97b1-e9205ff69d9a", "value": "T1A014E02136D0D172C19649745835EAA16F3FF9324AA0C98B37940BFE9F317E0A766387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674741895, "uuid": "75b63b6d-59b1-4e48-a92e-05058cfa024e", "value": "0cf7da7ba6041e7b7038cd2e90d72093", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674741895, "uuid": "d5dedcea-6974-41b7-9383-3603bcfac20a", "value": "3072:KBN2FY0DfULQ+16KOQCd5kHlPcN6Myi/Rwdba8xcpVsdhRvvb:erXLQw8QCUHlINsdba8xcVohRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674741895, "uuid": "8ec307d5-9464-4483-85ed-19cd5f27cabf", "value": 206336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674741895, "uuid": "168e7185-012c-4c17-b5f1-e9d88b570041", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674741895, "uuid": "d7a97e8c-5f3c-414b-a1c3-1239a72ac4bd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3009b8bf-9d36-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674709157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674709157, "uuid": "dafe1937-2a70-41a6-b7ec-78dd0ac4b130", "comment": "Malware payload (RedLineStealer)", "value": "38d08f7c39752374e1cfa8d90a912b36", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674709157, "uuid": "29ba808c-73e7-4ed7-8fae-76bd968e231e", "comment": "Malware payload (RedLineStealer)", "value": "be1903e4a0121d1dc9c01c8beb32ac5473b3af8073841dc0c3b2debf20df0016", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674709157, "uuid": "ff1b2b46-36c7-4332-9822-0f9219e68d6f", "comment": "Malware payload (RedLineStealer)", "value": "8a48dc09dd4e42dc4bb7cc5c170abe8b54a4fa42", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674709157, "uuid": "225ac1bf-77ca-4d74-b459-601fa153a972", "comment": "Malware payload (RedLineStealer)", "value": "bb0618974fa9ad7cc570fe55de8fe55d303e4b48f4019f835bf61186b503e03f6f370552a49bbff7800f94ae546623ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674709157, "uuid": "90b3c930-2829-4699-9e60-b6b13c743e98", "value": "T1BA84CF1676D17860F92B4A76CD1ADBE4392EB8D28F3C739772C4AA1F1C732E1C126215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674709157, "uuid": "99d4e9f5-dfb7-4743-82b7-9bb0feef7c14", "value": "e5f35c047e0fdde323b83e51e689dfb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674709157, "uuid": "3071c532-154e-4946-b1a3-6ccdcd8bd549", "value": "6144:hMLUy81xDLKWUBj/BIIiCohMvNI0+MOKXCmSmHUT:hMIRHDei1MSWmYUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674709157, "uuid": "6fc46dbc-d191-49f0-af93-890fe4f88e67", "value": 375808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674709157, "uuid": "df3790c8-6a80-404c-826a-12b9ddb0e9b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674709157, "uuid": "37c06964-c5de-4b00-a5cd-a05a62d9eb98", "value": "38d08f7c39752374e1cfa8d90a912b36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b82ee71-9d69-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1674731242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674731242, "uuid": "d9b85730-9b5e-44f1-ab98-bfeb24856894", "comment": "Malware payload (AveMariaRAT)", "value": "e69bfdaeea8b17d7a40c5015a4025f2c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Warzone RAT", "colour": "#495FAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674731242, "uuid": "324b8907-27cc-4a72-88df-26ac55724066", "comment": "Malware payload (AveMariaRAT)", "value": "c070f2444079cb38a079f2836b3946c8c6cc59218fd0e551eebcc0ee5d07251d", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Warzone RAT", "colour": "#495FAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674731242, "uuid": "a5c519a7-a17d-43bd-8cad-261bb9f83c11", "comment": "Malware payload (AveMariaRAT)", "value": "dd25f6dbf1b7ff2f115bcf2c9a246e2da0070455", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Warzone RAT", "colour": "#495FAC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674731242, "uuid": "2e6846e0-5301-484a-b30d-62ae397d7da3", "comment": "Malware payload (AveMariaRAT)", "value": "d85492cdafdcdf8ad9df9fcb3d555206a6d2b495dc3a0ac1dd7ed2659d507d8ba267917e0b78d411e3ca1831ed9dae31", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Warzone RAT", "colour": "#495FAC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674731242, "uuid": "e82997bb-d48d-47a1-ade7-74044f044c35", "value": "T17DB39E13F7E54835F3B201B01ABD7E7ACBEDF9700628C49FA394858A1D31946EA25397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674731242, "uuid": "7956f597-b8fc-4722-b721-02e4ddec1dc0", "value": "51a1d638436da72d7fa5fb524e02d427", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674731242, "uuid": "833323ff-12b1-434e-8ec2-cc8532445567", "value": "1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01:K1VmhaH8EFvW+0OVE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674731242, "uuid": "a0511d49-656d-4de7-b40f-f48eef8a1b33", "value": 115712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674731242, "uuid": "6941f86f-0f03-423e-9f66-51f6124bb7f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674731242, "uuid": "8f119c36-d9da-43c0-8051-12e0ba2d2ec5", "value": "bJi7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0dda134-9d54-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674722312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674722312, "uuid": "b79ba485-ff1c-4db3-8231-229869fe9e4e", "comment": "Malware payload (AgentTesla)", "value": "399062240a7e6046b23f47ad9da7e3c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674722312, "uuid": "f26d7259-e65c-4f9b-8993-f02e2a0d8b97", "comment": "Malware payload (AgentTesla)", "value": "c0f32f7b70c7a4cdb9f2cd6bc6436b0b75bd832b11ee55907a275dcdfd7f27d0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674722312, "uuid": "3d082691-d247-46fb-bf54-6abec40338b3", "comment": "Malware payload (AgentTesla)", "value": "3ab8ee8cc6f9a6d975891abb7df894999c09ac29", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674722312, "uuid": "f5daf40c-1334-4c4b-9062-aaf165a35a79", "comment": "Malware payload (AgentTesla)", "value": "18bf92abad94fd742a9b666b2a242101f2c284a923c7a5a8939d37e300f2757dd80b707403d5378ff68d3d0abedfe776", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674722312, "uuid": "cdaa39ab-eeb7-47bd-9b15-8c9a97595a1b", "value": "T1B44423B8B89A9B12874CBAB73C68821F8DD8B6574F1E905316E1FD4A553334B7CC690C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674722312, "uuid": "58228516-029a-4423-be22-5d5d0ee13412", "value": "6144:4sZz6MOElYk2poXc/7UILoJai4K6XP8yOhOIv4vH5Ond:LFeteIGa8emZv4vHcnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674722312, "uuid": "ad670013-9c46-49d4-b5fd-62112e16b514", "value": 258081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674722312, "uuid": "375dc00d-268a-439f-9957-07dfe6ff4716", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674722312, "uuid": "f390c219-2c67-4bf0-b098-ac996694851a", "value": "Request for quotation of Mohammed bin Rashid Al Maktoum Solar Park.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ae5562-9d41-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1674713885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713885, "uuid": "4d8dcd81-c2bc-47a8-b083-83bf141ca562", "comment": "Malware payload (Gafgyt)", "value": "0773b99270b221fb68a061fcc5eaa424", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713885, "uuid": "a55163e2-21a7-4f08-a1a9-2a7e840c5926", "comment": "Malware payload (Gafgyt)", "value": "c0f63dba8c6a30cd559a9463c9b0f2e9d47e71358bcb9b118a3f38e75fb38564", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713885, "uuid": "5a87d95b-242e-443c-a382-08004d972f66", "comment": "Malware payload (Gafgyt)", "value": "3c48409bbab8f6561cbc26cc8e271b9816989128", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713885, "uuid": "4758a444-c36d-4f03-b635-b4fdf68340f2", "comment": "Malware payload (Gafgyt)", "value": "0a4c2b9a828fa16ed7979600be1bb4477a94c6a779c2a677f4fbd4713458877b1a0fd209251b3f29bf7d3289d9027bbd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674713885, "uuid": "be68c87d-34e7-4757-bafd-d44943173e03", "value": "T164E3E863F601CDA5F00959B210972610E9A2A3BB4EA73193F6172D62FE7119B3877FC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674713885, "uuid": "e6dcfc8a-b33e-4d11-b5ff-34ca60b8635a", "value": "3072:7rpys4m0AxHy93s99f9Tjy0qcegWnbPWmKH0PXQZfbFj:7rYZm0AxHyUy0rWn7WmKH0PXQZfbFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674713885, "uuid": "43c50d85-735a-4084-b16f-73807f6817fb", "value": 155754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674713885, "uuid": "01d61df3-e8b5-4a75-a5d3-6b3e750710a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674713885, "uuid": "26aa0d2a-63dd-4cf6-9adb-84e2e2caca38", "value": "0773b99270b221fb68a061fcc5eaa424", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5a98f91-9d9d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674753727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674753727, "uuid": "27d9b09c-6541-4d5c-b8da-7d4dddf91c3a", "comment": "Malware payload (Smoke Loader)", "value": "d1a7fe3a466539d449c35a661e5bbca5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674753727, "uuid": "d156da6d-bd52-4680-aa25-774c54270d86", "comment": "Malware payload (Smoke Loader)", "value": "c0fd1edccd3ca278691612b8ec2dc0fe4bcfa2d1a754c2faf19e6b3ea607e9cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674753727, "uuid": "bce70b9e-6f3f-4b9a-a2a0-3795699da859", "comment": "Malware payload (Smoke Loader)", "value": "a9dd0896ba297d2f359f5643a45bad94d57aa228", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674753727, "uuid": "a07c7ed8-4d67-4201-a993-5cd1cd8a7eb5", "comment": "Malware payload (Smoke Loader)", "value": "fd08460dadae3fa7a6bab3bd957c40df98c8b382d64a68ec231e778d2998af4d71a696a103ea77147c9890399af16a65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674753727, "uuid": "132144bc-18f6-42a9-a463-269c75cd3ae1", "value": "T17114E1143591C072C79211347438E7916B7FB9F31AA9588B7B881FAEAF706D2233535B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674753727, "uuid": "2698f790-55be-4239-b264-55a0484450fc", "value": "3441d27f999e45e989c5f0204be01528", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674753727, "uuid": "2911e549-058b-45d3-9836-228731932b5f", "value": "3072:oBN28s8zofQLBPe+wxO3Nk5FYmLg1/OESD+ou89Eb7rTox:QfjLpWO3NGU8DSfb3To", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674753727, "uuid": "9b51bffd-3a20-41fe-94a0-0a47c9b10f36", "value": 202752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674753727, "uuid": "7974c96c-1f01-4302-ac73-7fdad1cc574c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674753727, "uuid": "0cfb4821-a600-4440-8088-f9167b26d711", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "298a3a6d-9d4c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674718595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718595, "uuid": "9c01b4e1-6d5c-45d8-acb5-36d0c6e59461", "comment": "Malware payload", "value": "315048e1d18f5746ae0417a4278ff3ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718595, "uuid": "2e435350-1449-491c-98c4-a398a5b4a2b7", "comment": "Malware payload", "value": "c16c484e87513320b820c9dab9e0bf1eab9d324eee87436cf3b3674fc677fcab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718595, "uuid": "ad365771-0804-4df1-b115-d652300186cf", "comment": "Malware payload", "value": "c083af385df168dff76f4ad7b6c22acc6314f75f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718595, "uuid": "22f9f0b0-79d4-489c-8658-9156876c6631", "comment": "Malware payload", "value": "216d9158c4859313bcfff8baf53b56493a6ade2e8233e0abac7d2edf39b30b24bf63343266b2bfd08c8809ee0cb962f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718595, "uuid": "de495b13-da10-4f19-9551-c289d333bbb8", "value": "T1EEF6332632E30472E6101AB6B89A90985E1E783C09E31136DFF9CD1E96BD7C74D3BB15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718595, "uuid": "a0729c88-c8af-49a7-b92f-eb06e6c0552e", "value": "483f0c4259a9148c34961abbda6146c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718595, "uuid": "6f5212bd-3f1b-4f4f-ac7c-ee249be32e02", "value": "393216:pflC3QsGDKIv1gqzVRWgbZhXOhAWed3xdN:jC3BGGx6jWIZxOiW03R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674718595, "uuid": "c2236e37-7609-428f-b440-6bf653aba44b", "value": 16621846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674718595, "uuid": "71621481-2d8d-4530-981e-bfc13903c81b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718595, "uuid": "77cb6e0c-3b4f-42ca-9c22-4105115ed3d7", "value": "obs64.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87fd252b-9dae-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1674760844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674760844, "uuid": "78b64f21-2dff-46b8-9773-6189a09c628b", "comment": "Malware payload (CoinMiner)", "value": "094de52c848a4923be8c7b962a401ce8", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674760844, "uuid": "66261ff7-cfbe-43c0-8ddd-074162f5eb10", "comment": "Malware payload (CoinMiner)", "value": "c22758710d9076fda9f4388e4062888a370e32fd31fb5715e80b37e34b2b1b6e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674760844, "uuid": "317cd7ea-c297-4746-a19f-27e2024a0aca", "comment": "Malware payload (CoinMiner)", "value": "060cd79258d727173590999a724c14fc803a3ee6", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674760844, "uuid": "7a79442b-f699-41ac-9fba-b7ad543e5be3", "comment": "Malware payload (CoinMiner)", "value": "2dd6dad1768f9a5f76b331eed5cec9ccf23ae42dc2d8707c1be10028afad8b25cb42ccadc52a30575c5e74da60349488", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674760844, "uuid": "4f4610b4-bef1-4581-8b51-f4cf01057a35", "value": "T19FC5F111FF1EA0B1F2A95038D56385B80E207C26BAD285577E7CFE0D6779380A47A739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674760844, "uuid": "3d6957ed-cb08-4c4c-8027-1f65ae4e0ba4", "value": "bb7df0062783405bee34e08f810319d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674760844, "uuid": "7d56b9da-5f58-4c64-9279-0ca0ec5b98e1", "value": "24576:aIJAY+g9Z9gVAQQ6eZ0HhV53Qr+29fJaWz4EbVztgJ2UIMms9OyIoHdGkFriP7ml:aS9Z9gVtE0BfQZBJadExptXxSMP3eJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674760844, "uuid": "20c23be3-ed35-431b-b080-0a3e8d6d385f", "value": 2692608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674760844, "uuid": "01864caa-6fdf-438e-876f-b98c959df19e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674760844, "uuid": "e7cc97c3-7266-4a47-a5d8-98a9b9d0959a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c4775a-9d50-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674720391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720391, "uuid": "c6df5960-5968-4bfc-b676-4d618275d37c", "comment": "Malware payload (AgentTesla)", "value": "9c6cf86efe0d3dd85269f968fe5a144b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720391, "uuid": "99abe20c-55cd-4c50-8929-6ab409eebb7b", "comment": "Malware payload (AgentTesla)", "value": "c2f60fec4b1bdb030e1e2fda68b2cfa14086f320ab95877b12af1eb85c8aa21a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720391, "uuid": "8fd415f8-cb97-4fa0-941a-a4ff0e386036", "comment": "Malware payload (AgentTesla)", "value": "6e8f4ffdbd77b1f5cb5c2b6ef298e49a1b7fc291", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720391, "uuid": "74d9fc85-003d-43cf-929e-8234810b276e", "comment": "Malware payload (AgentTesla)", "value": "beefa7a3a222cc786f7d53b5c5fb8b6fbe8bdaeee8f39bc50bff720074b77d91edf3dfa080efc5dc3ab65124407ce5fd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720391, "uuid": "de0aa9c7-cc82-4477-a73b-d81afe2e222d", "value": "T1EE441217C56E208D2C77A43FAAE6E1434A0AF55340DCE34EDABFB2B90074E4799C5B16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720391, "uuid": "0bc87823-5236-4040-944b-e4eeef8cba89", "value": "6144:CSttu/r9C0I8RcqDv7zcPl0z5QPKsP797aQmgU:jto/r9/IAPzcK+LT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674720391, "uuid": "f0197349-6b1d-4b92-b4af-27db27cec265", "value": 257842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674720391, "uuid": "99b9f30f-7ed6-49ab-a184-581806fa6b64", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720391, "uuid": "8bf9d62a-486c-4854-941d-d8271c725cca", "value": "DOCUMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "402dd50d-9d75-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1674736243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674736243, "uuid": "2e35548d-7806-4539-a2e2-67235c8ba7af", "comment": "Malware payload (AsyncRAT)", "value": "6c03174f161a7bde9817bf7622a753ce", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674736243, "uuid": "4bb3665b-ae22-455a-9c6e-8eac05805f09", "comment": "Malware payload (AsyncRAT)", "value": "c2f91a91c984d5e46cbf5285781ffbe64f7e3326f88ffc9b1415bd956859c8c7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674736243, "uuid": "149ea272-0ef8-45df-ad38-8572bd46b62c", "comment": "Malware payload (AsyncRAT)", "value": "4c318c166f1850878ccf8310b962a1b0e8900214", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674736243, "uuid": "c3a6f2cf-4051-43ca-b7d5-7cc6896a0d18", "comment": "Malware payload (AsyncRAT)", "value": "c949414149d881dd7b8df0a3b02f290576c59b841125eeeff90164abf62a5dac491e9b63638362c73bd7971b7c8f8a10", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674736243, "uuid": "6fe5ccaa-0267-431c-8527-8dc586089437", "value": "T148F49E1023E9DF42FABD4779C2B4524093F77865A532D7895EE1A0FE1DB3B008A42B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674736243, "uuid": "648ece9d-ba6f-4f39-9b21-cb598ada304c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674736243, "uuid": "3a4d840d-1d2a-41f0-b35a-6a372ca65f5c", "value": "12288:stG7vV5zxPCRgXGHlWMXDpFqIG26bR1M3UmQBkYlUEvG60v4nqU4/Ws:kV3GtbRmDekIrRqVWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674736243, "uuid": "c6dbdd92-743b-41cb-8ec9-61bbb6449e67", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674736243, "uuid": "584ebcb9-ab29-450d-a71c-b3317489b6f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674736243, "uuid": "17ddb104-02fa-4505-9ef1-4bffd99c4417", "value": "Oxxgg3mhk1oC0ri.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb0c9f6-9d41-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1674713874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713874, "uuid": "5a1a0f96-20c2-4eaf-ad72-b5e473371b4f", "comment": "Malware payload (Gafgyt)", "value": "6909391ca118155d8aa5c10da584a063", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713874, "uuid": "3cc9ebf8-5f48-4d49-8ea9-490159d40610", "comment": "Malware payload (Gafgyt)", "value": "c69777563dc842462591b0b34c059344f162b57abb5e9d3f879b387c8052b65b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713874, "uuid": "be88bdf1-d417-406a-bb40-6c406d460e31", "comment": "Malware payload (Gafgyt)", "value": "f7ee8701863a69908411bed59f2ee0ee6bd3b36c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713874, "uuid": "5518a5ac-b1ac-455d-98d0-fbd2fc1e225e", "comment": "Malware payload (Gafgyt)", "value": "0b020ea44d6d4d38100ac7a24fba3ae760b60469ba3fc36998315b5e26b1d1e02a83ca5899b8088e6d85e8c5a50019f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674713874, "uuid": "042ed26b-97d6-421f-ab3f-decb77bffcda", "value": "T189D3D5A3E70684B6E40509F2315B33519D53627F88AB6583FB1A1DF0FE6188B257AFD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674713874, "uuid": "41b7bba4-b2aa-4ee0-be7a-4d092720ccb2", "value": "3072:ft4khXSPowVjgWL1HeoMe+K3DXOB7gAmU60rIp3fmbd:ftBSPowVjgWL1LRzXOhgAmU60rIp3fm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674713874, "uuid": "5ba715c7-c2d2-458d-8db3-0e50ef280ed8", "value": 140834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674713874, "uuid": "4dba98a3-29fa-4cf1-b75f-950d3129d0f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674713874, "uuid": "68388d5d-d730-4fcc-8dee-69d9aba1e2a3", "value": "6909391ca118155d8aa5c10da584a063", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d19be0bc-9d6a-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674731762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674731762, "uuid": "55fde777-719b-45b2-8717-30c314c7a34a", "comment": "Malware payload (GCleaner)", "value": "519f12a6c562bda0de15bfdd92291c61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674731762, "uuid": "6f9e97de-3744-446a-aa53-12866481b76d", "comment": "Malware payload (GCleaner)", "value": "c6e13f9877177ff3e366deff5f21ea005729e5dd0bbb3f825d55da9d1ea1032a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674731762, "uuid": "bb085017-1708-495d-8214-9e3625f05f1f", "comment": "Malware payload (GCleaner)", "value": "eedbb882523f6b42c6b56af8f902242dd689c9b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674731762, "uuid": "275bd557-b729-4d75-ae32-ccef3bd527ec", "comment": "Malware payload (GCleaner)", "value": "a6b0ca4e2381cc0bd5652b8abf45276e03c6d0fa2f095758212dc44b559eb5a4cec8c84cf488872aa1beb9cef6f61d7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674731762, "uuid": "aaf4d931-0845-4cbd-9469-d11a5dc14069", "value": "T11085230A55E3C2B8E423C2B56B352940EF73FDCA607D110176691B9A6F772F01C72BA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674731762, "uuid": "d8cced38-305d-4297-bbc7-098dcb9bce0d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674731762, "uuid": "3ded01ac-f80b-45d5-bd77-478505f0ca44", "value": "49152:okug+2nE8KxZC/DSYmvadO5ZNY++9PxgyLCgv2MR:hug+MeTOGYmSY5ZNY+ePaav2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674731762, "uuid": "06484977-0044-4d82-bcfa-e8107ebb798d", "value": 1851408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674731762, "uuid": "50be0e08-598b-4d84-8f5b-de56f32a2d09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674731762, "uuid": "e52c1e95-db1a-421a-b091-ff92916a3315", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f1752ca-9d8f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674747569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674747569, "uuid": "43ff8403-dd81-4561-9423-e7f2308d8270", "comment": "Malware payload", "value": "bb317f6114259d6212c5b21b62fb2e5b", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674747569, "uuid": "bbf17414-dea7-4aa0-8d11-effe00ae3ba6", "comment": "Malware payload", "value": "c8ff8a9793a99c0f6ac19a1a3bdcf6b34862a6e38a4130c7e1390752a20579a9", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674747569, "uuid": "9374bda7-f15b-43c7-9a4f-6c125c5fd9c0", "comment": "Malware payload", "value": "d543ee9f3c136c5c1d49e61d97c6d4eda216d20c", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674747569, "uuid": "4b02c5b1-71e5-40b7-ab2d-85158b00e4c1", "comment": "Malware payload", "value": "d5098d110d3a910ca39d6c7d0b6d980c77a513e0ab325769d3486fc41dfbfa9c534d558e6675ea46f82a4f393e0684c6", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674747569, "uuid": "692454a8-aa4a-47cc-9439-21a025169adc", "value": "T15DA122073E090E25C36286F6149B623283052C92C95D0DF500C0573975D3D3EB4ADFEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674747569, "uuid": "1a7c96ca-8cac-4ccc-9306-6ed77927de6b", "value": "12:8Z20m/3BVSXzZUkjlsoJL09cQllKDiNL4t2Y4B/M8:8MJ/ByUkjlso29c4Ka5dB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674747569, "uuid": "0592699a-4923-4b6f-a80d-629db4cd271e", "value": 4747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674747569, "uuid": "5663804e-ccf6-4f77-be62-40acadfa2f28", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674747569, "uuid": "4919d1be-40ba-4a6c-8fab-fdc862416ceb", "value": "c8ff8a9793a99c0f6ac19a1a3bdcf6b34862a6e38a4130c7e1390752a20579a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "559db0dc-9d7a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674738426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738426, "uuid": "5302f7be-f2e1-4d96-813f-5a100201ab9b", "comment": "Malware payload (AgentTesla)", "value": "83a9ff44ae1051c7c3f99938556239c3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738426, "uuid": "46f510c1-55b7-488f-8f33-ea31618edf00", "comment": "Malware payload (AgentTesla)", "value": "c94fc73c5fcad1ab614fba37d9cc9c21f328c4787e39f3e3d673e1c408691434", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738426, "uuid": "9fd0d53e-daf3-4337-8519-d44fb13914c5", "comment": "Malware payload (AgentTesla)", "value": "c90cdd4afa60a64856aecc177602a33b0c1fb5f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738426, "uuid": "0f095629-2f93-4729-9fd5-e9903604690a", "comment": "Malware payload (AgentTesla)", "value": "5c7c322a1c72891d48ea378a6ab9580fd4899cdceadc8c5eddf1d3bd744ddc563095175024223b21e82b1be67242bce4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738426, "uuid": "bd5615e8-3cc1-47d9-9954-a0ce6f3f9c87", "value": "T1EE15AE1423E9CF46FABD4779C675528053B37866A432D7895FE1A0FE1CB3B008A42B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738426, "uuid": "8ab00771-f265-4bd7-8f63-52b529cb4d72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738426, "uuid": "4a22f178-c933-4b5e-a174-00c23c065969", "value": "12288:FtG7vV5zxPCRgzCWWoXDDFqIGYMyiA2gqbEP03711m8Z5KMMnDfS4nqU4/Wz4A:J6GYMyiA2gqz37P72bnJqVWz4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674738426, "uuid": "3254d1a1-15d8-4848-9f2f-c3439e8f7e82", "value": 914432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674738426, "uuid": "496e9945-2e27-4e1e-948f-564a6a513861", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738426, "uuid": "18433eb8-b8b6-40cc-a7d7-49f66dbe30e1", "value": "RFQ - 3 x pallets - 1075kg - 1.861 CBM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "650071bf-9dac-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674759927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674759927, "uuid": "8f0add8c-636b-4392-a226-bd7e67f9c3ca", "comment": "Malware payload", "value": "c5ea62ac6d9eaebd534144602a99776d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674759927, "uuid": "cec3ea08-c025-4374-9078-d55c6e945005", "comment": "Malware payload", "value": "c9a5db61aa2314d2d71e54a33f36192468b8e1a761e1307f3aa4936fe0ecc502", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674759927, "uuid": "950ef7b5-dfd5-4a76-addc-a7705b4bce9e", "comment": "Malware payload", "value": "727d68062ff63d08a3e0204af3c8791d9092dc82", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674759927, "uuid": "07918c50-41fb-4d3d-b7ba-76b326df5544", "comment": "Malware payload", "value": "f487ad80bf6b3c501505da5ece7ba5dc73ed39ee81c902958e25cea4de6cc647fc0fa43858a1dda8f07d3ab4f9b5b65a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674759927, "uuid": "a00daf80-1d56-42cc-8e82-5b19667d0060", "value": "T174D45C0BE29250BCC06FC17947566672FA73BC884631BBAB17D076302E65F906F2E719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674759927, "uuid": "872399da-31aa-4f2a-82cc-84e40ac31caf", "value": "412bb50a8fc70ed0bd3eb7f322a988dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674759927, "uuid": "6a7ebcc3-9538-4b62-a814-399d9ae911af", "value": "12288:yT5eQYNFUJiSBtnEmcrUwsK4fnWNxH3IotOfj1OzkB3l2:80NFUYItn4sK4fnwV3Io0k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674759927, "uuid": "86b6b7eb-1e6e-43cc-b7c5-78df6ab93766", "value": 609792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674759927, "uuid": "07a23baa-8be3-4d0b-a2b3-e3f37b8943c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674759927, "uuid": "d98d4e86-89b6-4f19-9d3b-0655b5522329", "value": "c9a5db61aa2314d2d71e54a33f36192468b8e1a761e1307f3aa4936fe0ecc502", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d2cde22-9d28-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674703086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674703086, "uuid": "283a78b0-daf6-4e8c-8e3a-6ed3608670d8", "comment": "Malware payload (Formbook)", "value": "3a1aa0c52c08adad7cd0385f7325641e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674703086, "uuid": "46281927-5ed9-415f-87c6-329495aea465", "comment": "Malware payload (Formbook)", "value": "c9ef8926dec5d2535a71642d0dd52e03a6b1daf7df27c108200b76e5d1dc6976", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674703086, "uuid": "a264879d-8ea0-4251-baba-62f1272b78ec", "comment": "Malware payload (Formbook)", "value": "c3a35dfcc454ca89878c85979b3069bed37b3dcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674703086, "uuid": "c05fd01f-9bdc-4946-a18f-243fe2d75c75", "comment": "Malware payload (Formbook)", "value": "d6a703a162bb464fbd8f85b4319599bc5d7860ca6f51c3a5f1162b75ddd0b000c82203ee6221d63114d8fac5dcf65221", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674703086, "uuid": "cdb655bd-71cc-4ecf-a015-9af60579b094", "value": "T1ACF4BFBC7794BC4FC4278FBA85042D00AA60A4B75F47F383905B119D9A1EBDE8E546E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674703086, "uuid": "9d972c12-2fd2-4b80-8c9c-05b747c86421", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674703086, "uuid": "78920c35-9b33-4993-b3ce-e230a82d96aa", "value": "12288:AfygOnZKJFvTzieFwx9ADWtVZCPVacr0CLeh9bK6yrxfX6Dx+9IhgWicXcEA7NrE:AfOnYJFvnxwx1rL9y9fXYeIhgekx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674703086, "uuid": "16f460ec-4ccc-41c0-8511-be67bd29c764", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674703086, "uuid": "0182e974-9c74-4c61-bb50-6b7df7f9d1c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674703086, "uuid": "acda5f93-64de-4c02-80b5-a312e6d577ca", "value": "Swift_0921_0090_889882_000 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd5753e-9d15-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1674695138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674695138, "uuid": "80971213-fddc-4e66-87dc-b93fca1a32d4", "comment": "Malware payload (njrat)", "value": "a7cccf309f69b5ef77b0f540153ee857", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674695138, "uuid": "e2dac00e-50f8-43d8-8ade-868bc2bde91e", "comment": "Malware payload (njrat)", "value": "cb3a2f699cd564b631fc5dff802d6fef6c636a9e1cce96b780d5b9ea50b910fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674695138, "uuid": "b9889752-9055-4fd9-bb89-4c1db67088d8", "comment": "Malware payload (njrat)", "value": "d0232274ece41805c441075e87eec062f073173b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674695138, "uuid": "06a1d635-0ac0-44a4-9215-a89a2e0a1aab", "comment": "Malware payload (njrat)", "value": "877fa4287f44d70bb1285c42b9bd2ef331648edee7e4921f9662b550628321ffac389284d2e33aeee507a43a67a12316", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674695138, "uuid": "e322288d-d8e7-4f8e-8196-ad93bf61e166", "value": "T1EA032A4D7FE18568C5FD057B06B2D41207BAE00F6E23D91E8EE264DA37636C18B54AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674695138, "uuid": "f58d737a-7522-497c-be4e-9926d3b8f8f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674695138, "uuid": "ef48e890-bd91-40cb-82f5-1d921ce70a8b", "value": "384:NLXpZTj6ic1ri5Z7JAyk/24+PRhZe6KlArAF+rMRTyN/0L+EcoinblneHQM3epzH:FpLHJ7k/24+7ZrK2rM+rMRa8NuK4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674695138, "uuid": "b87ad093-c6b0-4fdc-a8d2-9e6c6d166302", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674695138, "uuid": "e9a754c7-99fa-43a4-8c8a-3b4df5efba5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674695138, "uuid": "50fd7a71-a6ce-490e-9f3f-cea62859f000", "value": "a7cccf309f69b5ef77b0f540153ee857.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c7dd01a-9d62-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674727996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674727996, "uuid": "aaeee0de-1d80-4c3e-999f-6c195dc776a1", "comment": "Malware payload (Mirai)", "value": "07672a227de2637ea77a6973e5ecaae5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674727996, "uuid": "e0b70d23-53d2-43b5-8488-f43f6ed84023", "comment": "Malware payload (Mirai)", "value": "cb4879bf62a9d8e350b69df8c44bd6e4066f6a7e6cdf2976810c439e0287edab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674727996, "uuid": "2169af12-5ea3-4ee0-8836-9473687b99ab", "comment": "Malware payload (Mirai)", "value": "b4103801e4f2960cc19425f71861082e6d2b65cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674727996, "uuid": "697a18a5-1a29-49e5-8387-0b063e0b9dc4", "comment": "Malware payload (Mirai)", "value": "8b80be5bc77bfbdc800d530c6efd4ce9bf588d7293294a0d640441f6e30c4b64275bcf35da53262f23705f3ae93a2a16", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674727996, "uuid": "6290cb7e-0c02-4f6b-aeaf-5baadaeacba3", "value": "T1A9836B25BC792E13C0D4A53F22B78325B2F5230E25B4CA5DBE360E4EFF156A024575B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674727996, "uuid": "17a70626-b225-4fab-8e1c-0d86614bec29", "value": "1536:LKMo/69SyAXsE3QdMvjRV4jlbOQGQEsgUYUAxcJP:mhCsZ6M7RIb3GBnULAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674727996, "uuid": "d1874552-1e4f-42bf-8c2a-079afcde97fe", "value": 83008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674727996, "uuid": "7ab85ad4-fab1-4a4e-b372-db1b1deba000", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674727996, "uuid": "bc1a9eb5-37c7-4c0b-a09b-ddb2a74729e0", "value": "07672a227de2637ea77a6973e5ecaae5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "308e2e42-9d62-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674728056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674728056, "uuid": "729d0045-5837-4a2b-a826-0d54c5fd5a8a", "comment": "Malware payload (Mirai)", "value": "d6c2a6e5d40d44b5fb6255b58fa87d8b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674728056, "uuid": "76cef8b6-b939-4baa-a98d-364b2e5aec73", "comment": "Malware payload (Mirai)", "value": "cbe6134f3a57b4fad776910d233b883c3b34236ed3b7670f5ce04722338744dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674728056, "uuid": "16371b6d-6940-4d2a-b92b-bdfe085f975b", "comment": "Malware payload (Mirai)", "value": "06668e63885a00aec481fedcb0ff002b2439e678", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674728056, "uuid": "7dc02172-01ea-41bb-adb1-3086f7759ca5", "comment": "Malware payload (Mirai)", "value": "fc13fa62352b3f975d179e248ae4d6623bd2b2ae0437efeba3d7bd516a5ef09126ff2821334c7d3cd74490861997746d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674728056, "uuid": "6ef5511e-1444-41ce-a884-5e769ec70d1a", "value": "T1C5E2E184D14A9662D0FEDAF61953C7C13B748F8938B54BF1A554FF205E22B231039EE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674728056, "uuid": "fad13323-a576-440a-8592-9cf41ab36037", "value": "768:Syy5/29ULwyC0xIuxYUtNJ4wPV64xy5MjC44uVcqgw0RTWX+:0d29SwEIKYUt7PE5544u+qgw01WX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674728056, "uuid": "6e0e5eff-d467-4c05-8d0f-26b5dbb43310", "value": 32216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674728056, "uuid": "fc90f233-ae05-40bc-b2cb-df7d30d92b13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674728056, "uuid": "8042d767-df35-4910-9d1a-c2fea375089d", "value": "d6c2a6e5d40d44b5fb6255b58fa87d8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f0da99-9d20-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674699799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674699799, "uuid": "20396f42-a3f1-44fd-8c7f-c8200d9cfb9c", "comment": "Malware payload", "value": "e287924b3d5d1f96e5b1bb6f85f7976d", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674699799, "uuid": "d5bde5fc-eefb-4afa-967e-573aa42bb43e", "comment": "Malware payload", "value": "cbf6764efb71049ed3013bb67ab0c2f2274a17acfebfb80d124d75ad89b18dbb", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674699799, "uuid": "3bf03277-c6ba-42a3-9876-ec9d0b74815d", "comment": "Malware payload", "value": "302058406966b350c879a3583b39280caa7b1ad7", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674699799, "uuid": "3c234317-b441-4bed-9660-e62ff712b9d2", "comment": "Malware payload", "value": "7584f82938f273ba827b5a0a87a4689d47e819dfe28f4b2476cb5c5072e78a494345737634438db1769a5dbf9eb6c441", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674699799, "uuid": "f52f9bcc-7fda-434b-adc5-e5258241c3ee", "value": "T13E46F08AF7595A2ECC7304734DE6923666464C878E829B477948371C387B6F80F99BCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674699799, "uuid": "f51a75d5-2db8-42ec-9046-eec5125b6e05", "value": "98304:fhKf6IzU+Ebun6m2X/TD9PrpWuKdOK9OLEDM5ngiJhE68BCu2WFVCmE2Zrbuk:f4Cj5d9pWqPmMdZ+tCu2oVEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674699799, "uuid": "7380fc6a-04c6-4063-b6ed-b8fd8b0d45cc", "value": 5820781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674699799, "uuid": "09e5927a-49d7-4b81-bebd-2d2d1f59f429", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674699799, "uuid": "592ca4af-22e3-4748-a671-9d2dcad1ef8b", "value": "app-regular-release.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58994aa9-9dba-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674765919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674765919, "uuid": "4d47160a-73f3-456b-b1fc-e456b6e00887", "comment": "Malware payload (GCleaner)", "value": "a073c808c85393560de7a79bc615575e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674765919, "uuid": "bb457344-cccc-4862-b7ad-133b79367caa", "comment": "Malware payload (GCleaner)", "value": "cc5258aa6fdf93f67f73edcf8261d773e4694f3dd5fdb0d1472b7e16a4899d50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674765919, "uuid": "1caeb5db-0f5a-4806-a7dc-aa10b598f70c", "comment": "Malware payload (GCleaner)", "value": "d9a3093f675fe7db13469ff0d3a81c02b0e31410", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674765919, "uuid": "7fa260c9-5b00-486f-935a-96ece70c8d89", "comment": "Malware payload (GCleaner)", "value": "86f9855d528ee32d1d10fe8e25fbc21c115d44045d13d91060ed010fb34b2a5697cabb167568faa6cc9f888e57ab88c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674765919, "uuid": "4f3279d9-4c6e-4b0f-8b6f-3f5d0420e956", "value": "T10C95338AF19280F9E8628AFB2B70C0457F33FD8B60BF0556B65D279D2CB46B14D25790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674765919, "uuid": "240d52d6-118c-40d4-bf8d-6dc786c7efe9", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674765919, "uuid": "981a68f6-14af-47e9-9e35-c94721e229fe", "value": "24576:o3Uug2DyKf0hz8TEPTD/WS9GO8fa5ugz2yYEWzSvPBx7M7ahUKwoLC15wvnPdszY:okug+1shr/j0fahz2zSH7BRwoLCgv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674765919, "uuid": "71a6f64b-3d32-4bb6-8cdf-4037b1ab7923", "value": 1880762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674765919, "uuid": "e3ecf6bb-7d90-4ff0-b148-2be795223704", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674765919, "uuid": "c87a2443-3b97-459a-83f0-84cb6cd79235", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ead229-9d7a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674738425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738425, "uuid": "db9888f6-d986-4c62-a525-8f96fc9c0277", "comment": "Malware payload (AgentTesla)", "value": "abb0f20592407cbc9c1df8d7be759d9a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738425, "uuid": "9cecb0a6-2fd8-425f-b4ac-b54005c87552", "comment": "Malware payload (AgentTesla)", "value": "cd4fd070dbe5909f9e14e9228bc1243c2993e6dd105e91deed3bb3ca53e1f30d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738425, "uuid": "77f199c4-29fa-4230-b26e-7abae09d6aa0", "comment": "Malware payload (AgentTesla)", "value": "ae2354355268cd193d54b4ae3691a31ee8744116", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738425, "uuid": "f7b03f58-5fe1-41dd-851d-d3bc7fdc80ff", "comment": "Malware payload (AgentTesla)", "value": "0daad1f0f65c8067db5aa1f5ef28c7c6e1ab90b04a75e04c9d5fe021821e44c6e31f2caacaed67a0b8f2c92f9989a5d4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738425, "uuid": "44488f5d-4209-4ce9-8576-bd918af3c92c", "value": "T134A4F831FC930E37E0747AF5020F08347A9A2EED64E4629C69D2BB761AF5F850766C25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738425, "uuid": "0eb2fd58-8ad4-42ad-b735-cd5bfe9c39ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738425, "uuid": "50cee043-be3d-421c-a58f-c354049a214f", "value": "3072:p2yWP9LN3qIwBzFyIR+DSbisRKOsHas+8+qB1LuiCx8V8rIiJzQvstptE8z0Y:pNWP9GTsHtZLv8EiFES0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674738425, "uuid": "3f687c7b-6f33-440e-943a-0d87df756b07", "value": 487936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674738425, "uuid": "faa3ff9f-23f3-4d15-bab5-38e60c70949d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738425, "uuid": "aff2c3bd-7111-4e9c-8260-1a0759938570", "value": "P0-3325185-dtd-26-01-2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "000c9546-9d13-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674694044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674694044, "uuid": "e79d65bb-c700-4950-918f-0fc6ec240c40", "comment": "Malware payload (GCleaner)", "value": "6993c4d9a24fb253139672d056327f92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674694044, "uuid": "0d050624-302f-4369-9738-afc2d0309413", "comment": "Malware payload (GCleaner)", "value": "cdd56c6c59e6ff284a3b09512d0445e150f06af185a987fc6bc9c5ed262a0475", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674694044, "uuid": "808dfea4-1be4-476a-952b-f9339dafb360", "comment": "Malware payload (GCleaner)", "value": "c27f3def3d60a90782ff19b5c96917f18c16c1dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674694044, "uuid": "fae644fd-e903-4665-a3b3-fc39aef9b23e", "comment": "Malware payload (GCleaner)", "value": "96996d5154a74dfce33cff52aaa71c986bb9fe787eb71ceb14cd9645ed9ad950af56c0be9a26b6ec4312fc7172443905", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674694044, "uuid": "62a083a1-36cb-4a5f-a7b6-54d6ca3ee1ab", "value": "T15385330AE802CB36D163CC301E3B935A8D7B7605567E23D8B21E86BE4BB755C545A3E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674694044, "uuid": "891a161c-dce5-4852-b79c-5af70845bf92", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674694044, "uuid": "dce453ae-47c8-4238-943c-759145dd62f4", "value": "49152:ZQcN7vtyxDZZhTQmwIjuhIjVR3fynsyLWwLCgv2MR:jyHP7wIjsaz3Ks/Yv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674694044, "uuid": "64dcfa31-c86e-4130-87ca-d4c98773e193", "value": 1815275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674694044, "uuid": "0ee7b0f2-a041-4a3d-8262-208c066ecda3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674694044, "uuid": "c9bcf1d3-3c2d-42aa-b714-b1a4446376c5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f61937-9d94-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1674749617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674749617, "uuid": "18a6ce6f-1f5a-41bb-b416-e75db970eff9", "comment": "Malware payload (Quakbot)", "value": "4ca7ff9ea5d5518479d8a2d5e06f3b0e", "object_relation": "md5", "Tag": [ { "name": "1656313665", "colour": "#20F7D9", "exportable": true, "hide_tag": false }, { "name": "403.780", "colour": "#D8BBF2", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama194", "colour": "#7BF5AE", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674749617, "uuid": "ab22db42-bcb1-41a0-9b7e-4f4ba56123a1", "comment": "Malware payload (Quakbot)", "value": "d04caa7719610bd0aa0dd1cda75fe73365479b059968b75cf3a9e3fd41ad5ef7", "object_relation": "sha256", "Tag": [ { "name": "1656313665", "colour": "#20F7D9", "exportable": true, "hide_tag": false }, { "name": "403.780", "colour": "#D8BBF2", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama194", "colour": "#7BF5AE", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674749617, "uuid": "3960c96f-9d75-455b-a10d-13c47dc87e8d", "comment": "Malware payload (Quakbot)", "value": "d83d333893962698edb9a5a963312cf40815d406", "object_relation": "sha1", "Tag": [ { "name": "1656313665", "colour": "#20F7D9", "exportable": true, "hide_tag": false }, { "name": "403.780", "colour": "#D8BBF2", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama194", "colour": "#7BF5AE", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674749617, "uuid": "ed1297e2-b054-497c-9d97-0adc75bcc557", "comment": "Malware payload (Quakbot)", "value": "0192bcfd3e165d7391d311ebee7b13959874f250deb7b3e324df82d066b3281dd4fd0a4c60254cd28c3b7995a1698cef", "object_relation": "sha3-384", "Tag": [ { "name": "1656313665", "colour": "#20F7D9", "exportable": true, "hide_tag": false }, { "name": "403.780", "colour": "#D8BBF2", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama194", "colour": "#7BF5AE", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674749617, "uuid": "9e8d892f-b71d-45a9-b579-8c8d3503cbc4", "value": "T14DC39F12E42280F2D5B50438C1CD9F395ABE75D02FA6A8D77398A6903D606D2E7373CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674749617, "uuid": "beb6befb-bccf-48aa-b7dd-400b3b69015a", "value": "0ac722e57c2c4e9d17a175801fddbcc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674749617, "uuid": "9e1264d4-3940-46e3-b2ba-877abb8ea6d4", "value": "3072:rV9GWm/WPuPuZji5rPSASJDgfMBTBfQIXMh:Rm/WGPuZj83SJEfMBTBoI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674749617, "uuid": "d03b26a9-e8a9-40dd-a586-3b2e985d45dd", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674749617, "uuid": "782c82f1-16f9-46d0-a75e-2fa3c78c677f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674749617, "uuid": "da4b0cca-ef24-499a-9a22-da27f3a636fd", "value": "d04caa7719610bd0aa0dd1cda75fe73365479b059968b75cf3a9e3fd41ad5ef7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b86deb9d-9dc0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674768657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674768657, "uuid": "a56ed0a4-fe32-4184-8d85-b54e47928e45", "comment": "Malware payload", "value": "7be930ed87d9f6ff2a8f1822d68535dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674768657, "uuid": "af700041-00d6-4ef9-83c4-48c381e3c5f0", "comment": "Malware payload", "value": "d04f38646533e047b58a6008e2642b78e3dadac176e3dc715befd27d19c5aca2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674768657, "uuid": "29957e97-3236-48af-b748-fc5973ebc683", "comment": "Malware payload", "value": "21bdcf4edaacf1ac0a93ae4aeb7840ed08f7e3be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674768657, "uuid": "1647c6bc-0f08-448c-acca-05cf2f433e57", "comment": "Malware payload", "value": "63f288dd983836b5c1f165d5303fa170efc0b71f9c912dcc88a1e6a0aebef38a8668fee68fdfc8808c601beaefefe45d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674768657, "uuid": "2de60419-8d1d-472b-a12d-6e7e5a274c59", "value": "T159953355A491C67AD03BC6BB69309980EF32FD4B203C162631D9BA8D3EB36B15CB13D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674768657, "uuid": "725933e7-6674-4efc-a880-e35f6badb69a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674768657, "uuid": "6b156c72-1776-4df7-9e25-8b146dec6030", "value": "49152:okug+vrZxSWDVF6dRmnjn/HQgALLCgv2MR:hug+v9xVDDLHNA/v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674768657, "uuid": "c26fdf10-c879-46f5-b200-bf3d48c0cd63", "value": 1893935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674768657, "uuid": "a70cf1eb-335f-4235-9641-f7556f9f1f04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674768657, "uuid": "633e88e7-8108-4662-a960-9d1d793d00e7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9537bd35-9d18-11ed-88f6-42010a9c006e", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1674696442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674696442, "uuid": "fa3d2047-d0d0-4976-93ee-19c22ad25c5d", "comment": "Malware payload (ArkeiStealer)", "value": "b78f6a52585c44e913f1f36b24e2fc55", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674696442, "uuid": "60d5ca23-9c20-4342-970e-9a7ef79946f6", "comment": "Malware payload (ArkeiStealer)", "value": "d05909281684b70eafb7409e95744d4478735f115b4df2c61515fc2cfbca320a", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674696442, "uuid": "a82789e2-5a9f-4809-a74d-7ff2732efecc", "comment": "Malware payload (ArkeiStealer)", "value": "43ce466565c8471dd8f6a147ae281ffdad3c54fb", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674696442, "uuid": "5faf487f-e274-4ebe-be05-d962867e8998", "comment": "Malware payload (ArkeiStealer)", "value": "69f04174826f3f1a70c3848ad1456a765adc1a6d6c73a6a5cc67b1d0603fe45f68a74e232e390e019a5e8e1829207597", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674696442, "uuid": "b35ad412-4674-4d91-a261-d3e24bd13ce7", "value": "T12E64AF5271D0A870F9274A35ED2EDBD4392EB8D2CF3C775732E4AA1F18722A0C576216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674696442, "uuid": "0aae9b67-0cb5-4e21-a8d7-a6dca34217a5", "value": "e5f35c047e0fdde323b83e51e689dfb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674696442, "uuid": "866eb138-6ce1-4634-b0ea-8a95b5f3026a", "value": "3072:dUztCsngrkhLfT13Ev2oARwhnzT8iru3k9aJF63hZVT6yt5cPhIP3Y0+L4Oi/XcH:x4Lp3Evn/trJxnim3Y0+MOKXp1pv1UT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674696442, "uuid": "b5b04a21-d26a-40cf-a2bf-415cf44db741", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674696442, "uuid": "9b376812-b1df-4f03-9386-2e77034d8198", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674696442, "uuid": "b2cbc872-d66c-4097-a00c-29c126d5dcf4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c31527a-9d14-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1674694494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674694494, "uuid": "32d44c1e-665b-4b42-9636-6fdc20ab6266", "comment": "Malware payload (PureCrypter)", "value": "49884eec4a8dcafe6d2993865154cdf4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674694494, "uuid": "62193d53-e7e1-4846-bb2f-545435b948e9", "comment": "Malware payload (PureCrypter)", "value": "d060ee3029a154a6fba6ed666ee5fafb2c8ee019dcfde0819f8aa24392b6e944", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674694494, "uuid": "60fe738b-f947-43f5-b09b-6c077099ac45", "comment": "Malware payload (PureCrypter)", "value": "8b801c2d83b7602d350734bc3de5de7b9df73436", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674694494, "uuid": "5ecc86a0-2b2b-467a-9cb4-8e8fb3ae85eb", "comment": "Malware payload (PureCrypter)", "value": "b11288ee2e80768a4131918aa5ea483543c9fe965a17a4d98ad97421a2d73302c6c64312e35d2b63b7ec95b2ff6d1aa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674694494, "uuid": "14bbf94f-6ecd-4e39-a8d2-707855724acd", "value": "T12AC5335CFA8AFD12FE5904348550412863A2DD279AC3EE169982B7BD2C733C3C91977B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674694494, "uuid": "a306dc05-d6bd-4827-8f25-2b46ba8c5b63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674694494, "uuid": "e4703a2b-9ee6-4363-9592-ee90e15a35b6", "value": "49152:V2+9WCvHTdprm74MntR2XTw5lKX0Zu04iXgIHuxCt8DccbasI:V2p2Td9mVtR2XTol80Zu04iXgHI8DM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674694494, "uuid": "bcb84f8e-5356-4b30-a94d-fa16c1dd39f9", "value": 2654496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674694494, "uuid": "4978a83b-c744-4d15-8ba0-3ed1b49d9424", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674694494, "uuid": "ab08e2e7-654d-4ea8-a42e-ed0c747daf27", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a9c20d-9d44-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674715091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674715091, "uuid": "410d42fa-684b-448d-a4ca-1725eeb2b208", "comment": "Malware payload (Smoke Loader)", "value": "6f2cd925f68ca4305a916f326f600e64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674715091, "uuid": "d9fcc3cd-96df-43e2-8ded-97c73c2d2dec", "comment": "Malware payload (Smoke Loader)", "value": "d100473e1baaf8c66e872b8536306db55d4d237106cdfc329f22b477dd94c379", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674715091, "uuid": "e0579cfe-47c6-4dfb-8d4f-27cf5f36602e", "comment": "Malware payload (Smoke Loader)", "value": "e3802c773d144b163349b627a023251c703fbdde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674715091, "uuid": "adfbc2b3-d93d-44d1-a9ef-cac84a08e5b9", "comment": "Malware payload (Smoke Loader)", "value": "6ed598413c0d3611ab3f719cc71a1c3936b4d00fa7c5a6325d7a52d702a5744d7c1e592b70d2be6c30c813bdab04c2bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674715091, "uuid": "7c451801-e35e-4568-aa4c-d5cd3bc1ea76", "value": "T1A514E12379A1C072C5A641341D60DBD47F6FF97286A888877BA81BAE4F317D0573A34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674715091, "uuid": "faff33a6-9b54-456e-86b1-0f3816e80c48", "value": "2fb86d3afd3014d2e2e15a2dd2f620c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674715091, "uuid": "5a8b4b40-fbbd-4e1a-bcf2-77398eb7b885", "value": "3072:xBN2S6DSzLoKsZlr5/PYe4GQIu8QbJMt98m8LJNHGoF61g:XnLxsZlWOq687HHGoF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674715091, "uuid": "684e9fef-59c6-461a-9006-e5d25642b224", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674715091, "uuid": "d6416901-0083-4e4c-afdf-5cd7dd8d0b1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674715091, "uuid": "02c4c626-4c45-47c8-a774-c31829f2e25b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f4f26d-9d80-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674740942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740942, "uuid": "53f6e025-5048-46df-b7bd-f6459cf6ea92", "comment": "Malware payload (RedLineStealer)", "value": "2993987ec1c9d05b82919d546bcb6927", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740942, "uuid": "97441cfe-017a-43f5-b0e4-ac9f4aab3588", "comment": "Malware payload (RedLineStealer)", "value": "d137f4c66fdf2e04bee5ec53984c9cc2000909d1ae1419db51403788c8674680", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740942, "uuid": "5d01306a-3394-4281-b955-6c8ab2bcffd8", "comment": "Malware payload (RedLineStealer)", "value": "84eb32e7f85e749e501bce92d0a7790985525eda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740942, "uuid": "e9dd5b4e-7ae0-4fb1-87dd-6b2c3b1318d0", "comment": "Malware payload (RedLineStealer)", "value": "085f683c0da8f5a00b879a89a69a5c6ba77e29e9a8df46598a962c8b87f91a39aed6e220ce8a801d7774816cb45e038c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740942, "uuid": "5ea222b3-43ba-4810-b471-236c75b8ae60", "value": "T16D740231B9E0D073D35B5630A868EAA4BB7AB432556945CB37910F7E1F307D1AB2A343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740942, "uuid": "ee4f8b21-a465-41e8-a61e-aede8ff03c0e", "value": "76acbc9b0e9b8516eed30a33559882bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740942, "uuid": "9aad0dd4-7117-46e1-a9c5-71c34540ef7b", "value": "6144:8xL3OM2sCE9EKTTi2chMmQXVqFJsMklWGdmf:k7OM2ZahTXchMoTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674740942, "uuid": "67a55274-467e-4472-9ec1-34d665cab683", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674740942, "uuid": "970458e3-00de-4e66-add7-20152e997ddc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740942, "uuid": "5ddb73ab-f3e7-413c-a664-3c79bbf2092c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50734573-9d5b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1674725103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674725103, "uuid": "83619712-cc87-4e1f-ab3d-6ba1dc638976", "comment": "Malware payload (Loki)", "value": "a53b3a47531585f8fcd00841e15d9471", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674725103, "uuid": "85d2deb8-996b-45be-80f3-8708932be899", "comment": "Malware payload (Loki)", "value": "d21c653f7179ec7a9cc3444b95de606d4ec76538c3023748cf265f0468f741c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674725103, "uuid": "e3b4a3b2-0a33-4f4e-9d7c-91fd4b635d29", "comment": "Malware payload (Loki)", "value": "28f89e31fe116512f7a17142e9586a702cbc0fbf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674725103, "uuid": "ff142af1-0cf4-484d-9d65-4c3c3bcf5386", "comment": "Malware payload (Loki)", "value": "304024f5863c02406185e2ac443aa34114fb9c608fb254277d17ec09171c8e5acb51dfd4716a64809f9c9b80ae974a8a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674725103, "uuid": "44c3d12e-c06b-4b11-af9f-b7030f0594ab", "value": "T1C1D48E1023EC9F40F5BE4B7896B9505217B7BC827563E21D8ED130DE4EB2B10AB46B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674725103, "uuid": "4075e1a3-e7c5-4f82-bc0b-24e3b06b82bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674725103, "uuid": "8d09a6dd-a114-4b0e-963b-7f59fd3e5862", "value": "12288:7SkOvbnR8ey/ZhNXDgzFqIGE12iZ5+vKpu/t2i/NMXDAXuw0S:vvGXGRiC+DAV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674725103, "uuid": "721041a2-68b4-494c-a951-1d6e0cf7b8a8", "value": 608256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674725103, "uuid": "09af9bf0-dbd9-4efe-830d-c1c57bfa3b8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674725103, "uuid": "f3f02626-fe1d-4ed8-a124-f5583ead8504", "value": "a53b3a47531585f8fcd00841e15d9471", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5ad988c-9d54-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674722320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674722320, "uuid": "f8dd2b59-98ec-4a42-8493-c834f4de32c7", "comment": "Malware payload (AgentTesla)", "value": "56ec8c8a91919d54def9d0891a8c7932", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674722320, "uuid": "beac6b4b-49d7-49e3-826c-aa84b1ec0c79", "comment": "Malware payload (AgentTesla)", "value": "d24a9e99e8ecbcc211c978bd3bb76696a3280f2d857a915e5c7539febd543697", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674722320, "uuid": "ce524b1f-4906-4fa1-8d52-226e97265cf4", "comment": "Malware payload (AgentTesla)", "value": "74bbccb7718222e64bff0ee9ba44ccb424f74ccf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674722320, "uuid": "828a9f46-4d6f-4845-bbab-b953fb688505", "comment": "Malware payload (AgentTesla)", "value": "facaa941a62e55e87dcd8097740869cd802165bace5467cec7adfcd1f1fa9fe32ef9a8b7b1b04f2e6b9f275d50c7074c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674722320, "uuid": "1044e055-ac5f-420e-9ccf-0a854ee1c665", "value": "T1DA441230ABA0C163EDA346717D3F17996FF5EE142998421F379006DA7932782790F74A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674722320, "uuid": "4f05a37e-fe2d-4362-9e73-9b03277f7b29", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674722320, "uuid": "793a9e74-1781-4c4b-9e22-f8b99894c434", "value": "6144:vYa6wqiPb+iJj3DVDEYIy+CrZAhUOgu0gnCXF:vYeqw1EpU0LCXF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674722320, "uuid": "fc25295e-3c0a-4afa-b56c-1d05ff7b8683", "value": 273870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674722320, "uuid": "ad72e8b6-ffae-488d-8985-cc213fa60f10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674722320, "uuid": "64dbd63b-4f0a-4768-8140-0ab5f8eab120", "value": "Request for quotation of Mohammed bin Rashid Al Maktoum Solar Park.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "927bfef9-9d5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1674726932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674726932, "uuid": "81657d34-9003-498b-bd5a-5b80c5dff72c", "comment": "Malware payload (DCRat)", "value": "bbd5709ac40896d243f619941d4789c3", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674726932, "uuid": "0ef96c6a-8ad7-4e45-bea5-6afa8844567b", "comment": "Malware payload (DCRat)", "value": "d2ac899a907641ad38d3d535723be9fd3f581590bb461c93f30d1d2dc5706087", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674726932, "uuid": "b3948f63-63e0-4d88-9cbf-9d8f0289e44c", "comment": "Malware payload (DCRat)", "value": "d6e45ca38ffcb71b1df4fdd51c628ffdc58ab7b0", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674726932, "uuid": "36e195e4-10c9-428f-be87-baa4982aa7a3", "comment": "Malware payload (DCRat)", "value": "5f0dc34e698b3f8f3c9007070263260d0def492e31f514bddd4942a2a4019ad6fce7d556e7164e906d795334444d3172", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674726932, "uuid": "777aa6a0-f8bb-4f08-8d61-8256cbab12e5", "value": "T155657B017E44CA11F0081633C2EF455887B5AD526AE6E32B7DBA37AE25123B77C1D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674726932, "uuid": "c358ffc4-9e33-420d-b8df-c18ba8bda7f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674726932, "uuid": "bd83cfd9-6959-4c6b-9f58-c4d6200a5985", "value": "24576:sWcUeg8DqSBzKMC5n9yjh7VU6KSQBVh5iIq0YLCTayC7NR:PNepqeGMCG9nKLPhIIqjGWyC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674726932, "uuid": "e1120750-297b-40a8-b334-bde427185f1c", "value": 1421312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674726932, "uuid": "a427137b-6351-42db-a720-386102021dfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674726932, "uuid": "3d897083-126c-4aa8-a02a-9f759a30f0ed", "value": "bbd5709ac40896d243f619941d4789c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af3f682-9d4d-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1674719135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719135, "uuid": "71f5ddb7-7b45-420c-bfbb-bbe05007e6b2", "comment": "Malware payload (NanoCore)", "value": "a4a21cf0ecd72f672771b0bb443b1454", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719135, "uuid": "d7aab1d1-0a64-477f-bc62-a4f6c60c0c9d", "comment": "Malware payload (NanoCore)", "value": "d38f12d945b3d21b3179bed6726cef23f2c4ed35cdb79e08bc93a23533abad45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719135, "uuid": "c200f3d1-6a92-4177-88c1-4cb8a1530e75", "comment": "Malware payload (NanoCore)", "value": "f26fe19da34f3af1bec15b9e76650ebd0e2a40e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719135, "uuid": "312f2355-a9dd-4bd0-9d6c-33b4c9b220d4", "comment": "Malware payload (NanoCore)", "value": "c104e2c48177bd26297c0293d5a43a381f6efa0528633befe6dec0f603c8b4f7477a60423d4a3e92e86567c546239985", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719135, "uuid": "d086d961-758a-4c4d-823a-5d181742f5b8", "value": "T1DCF48B442A3682EED0FA4D74163C6C1826621CE2476DB13ABD877DBE9CEB34F4855363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719135, "uuid": "2f1a87fa-9c78-495e-85c9-9a3a38425e53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719135, "uuid": "8469f86f-541e-47a9-a8b6-3efefbb277bd", "value": "12288:+cQYd5RnLnu0bOXZpjXgQ9ASA8XAb2LDuDdqsjGEhBCwLQTlpq3FU:9QYdnL3+ZZXgQjZXMEDY6UBhLQTlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674719135, "uuid": "8fe480d5-1a7a-45ad-9a5c-5028c8fbe08e", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674719135, "uuid": "8768e373-5cb3-473d-827e-4ce8884e6a4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719135, "uuid": "be336028-2c73-4619-8f7f-d7b05e4f01ce", "value": "a4a21cf0ecd72f672771b0bb443b1454.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8434f892-9d4f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674720036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720036, "uuid": "254b4ac2-3cde-4c6f-b611-a1bc4366777e", "comment": "Malware payload (Smoke Loader)", "value": "0eb9ff498f30e66f227bc04138136fc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720036, "uuid": "251c6a1e-dcc1-4df1-8911-d5d7f929228d", "comment": "Malware payload (Smoke Loader)", "value": "d4162bb014c8f5072641c834ba9b2b08ff87a1c22fda440146760acf9374d648", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720036, "uuid": "c9e5620d-7b4a-47ed-a37e-5ea15cf5b182", "comment": "Malware payload (Smoke Loader)", "value": "49c8dec9df27ef1631a8dc1df54e4093519110d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720036, "uuid": "c6568c52-da14-4acf-8faa-c35b4bd99925", "comment": "Malware payload (Smoke Loader)", "value": "e16ca4c31fd91d2d59f9367c6dad3b403f8bdf286b2c834f2dccc6e6c48346a399d428ef2ac0a6d0b862881f10654392", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720036, "uuid": "6d78c529-48aa-4ff2-bb5d-5e76cc1819a0", "value": "T17614E022B9A0C073C4A7043819E5DAD06F7BB93256A5988B7B981B7F5F707C11A2E353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720036, "uuid": "01111d47-f473-42a7-ae8f-9c229e83942c", "value": "2fb86d3afd3014d2e2e15a2dd2f620c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720036, "uuid": "6f8b52cf-6fa2-415d-a8fd-3f7845340953", "value": "3072:hBN2+LwPLceInbp53rYWyqsdnWdRWOWXC:H6LBInbzcWybnWD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674720036, "uuid": "cf1a1d44-d3f3-4bbc-a17a-0ba55fc9c074", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674720036, "uuid": "d4cc2ccd-414d-412f-928d-b2aa22db6270", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720036, "uuid": "0b50283e-6369-4a46-a235-9b236d963465", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acd34278-9dcf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674775080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775080, "uuid": "52fe2006-72b5-4c0f-b9cb-e71ae38ec30b", "comment": "Malware payload", "value": "039ebff46f006809682b217b90436250", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775080, "uuid": "fee4dd74-c211-462e-9837-8a3ba53b6605", "comment": "Malware payload", "value": "d4702a330061f024e1c0a30557e07ccc51feb682f78a2e035fc0cc50366ac800", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775080, "uuid": "a7de982b-a00b-4301-a711-87c802b91765", "comment": "Malware payload", "value": "0265834d487a3f7c81668c8a0595407a119e2169", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775080, "uuid": "031a3574-f660-467b-9d36-70783a71d21d", "comment": "Malware payload", "value": "35a206b3e55e98d776b3041261677695f626df624e629d0da67726f14b89d473520d9041f335fbe21e2669105695c6d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775080, "uuid": "fe21b5ed-8bb4-45d6-aa39-61a831b9a44c", "value": "T13F14D0313590DCB2C49B15304874EBE12BFAA9710665858B7BB836EF4F3C2D1667A34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775080, "uuid": "6f12a999-d75d-42b4-882c-290475b8f45d", "value": "8112aba4cbddc2cc0c799fee8b497e25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775080, "uuid": "8ba2fbd3-420b-4e22-97c0-3d83064fed0a", "value": "3072:iXBN318GIhldEvL3+Vxu57v1gvv25kdLblyLnx7WASR7ZLvoOWUBH:uNvL3+VxO1gckl8LxIRNvoOBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674775080, "uuid": "777cb342-4f54-4007-a477-07c4e0b0f11d", "value": 205312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674775080, "uuid": "613d8d50-d7b6-49d9-900b-cabe2fe1c146", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775080, "uuid": "db0fdfa5-9005-4fcf-9ae5-d89cd0a7fc4b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e1096b4-9d8d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674746681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674746681, "uuid": "77e31740-ca3c-46d6-841a-6b8b7b83bea8", "comment": "Malware payload", "value": "4a32a69dae46a85994399ed70d51d2a9", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674746681, "uuid": "00454b86-5c6d-48bd-b104-4e446f2b1e7a", "comment": "Malware payload", "value": "d4c2f6ad9adddc8ca3ffc60b24cdfedd72bc42047ec4dc92fa189dbec2ee355d", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674746681, "uuid": "a28ff1ed-b6b1-4b70-9594-a064035fac0f", "comment": "Malware payload", "value": "dd70bcc25f5fa385b9c16ee9028bbb96eb4c93a5", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674746681, "uuid": "f04f5f2d-b8f1-465d-b491-1475a82e42db", "comment": "Malware payload", "value": "5c40eb50caa58e829757b8c4655ace22034fd8dfe15463b1f728f1d13f560c40e7491209920e3ac444c813c041262ea6", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674746681, "uuid": "1465062c-a569-44f9-902b-86830174ec41", "value": "T10745123E2293BC28C4F38533C98D6119966C6C929E71A999253309E05F2F7DC5369ECF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674746681, "uuid": "231bd6aa-cd2c-4c55-a64f-29967c0c4ee9", "value": "ae7a97e5540a06a1edd6d678bb9afb75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674746681, "uuid": "b84e1e1d-8df5-4ced-9e3e-a1ec45d5d4d7", "value": "24576:u9JcNeaEePfgSr2CEYGs7Av/UP/v1KS33hlcuooqWQb7TW244:iaEetfGs7Asv1H33hlbfqjnWn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674746681, "uuid": "9b870c22-76df-4ac7-a37e-9cb3e296e4d9", "value": 1241696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674746681, "uuid": "26a08e55-82a4-4463-bfab-d2af9ad100dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674746681, "uuid": "c023dc4e-a95f-4b53-b2aa-b3b8b23bd41f", "value": "1061773530\u00b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0702f47d-9db2-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674762346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674762346, "uuid": "b4e02be3-2106-4954-bf6c-df3358bacf1d", "comment": "Malware payload (GCleaner)", "value": "6309226cceb03240dc3456aed12ebd83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674762346, "uuid": "7ec97098-a145-4954-b01a-b0db0056d12b", "comment": "Malware payload (GCleaner)", "value": "d577b8679eea915b0a809ba6f457ac4d10f0635864dadea7435dda80ebc5c0da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674762346, "uuid": "7d3442e9-4cb1-486d-afe1-08be209cad6d", "comment": "Malware payload (GCleaner)", "value": "86447f707ef88d7b4f60c76f1955f1abd3eb0152", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674762346, "uuid": "92a2701c-6ebc-41ad-886d-80f735e698d9", "comment": "Malware payload (GCleaner)", "value": "2062f215e62e1de58ff5077c1a2659fa76487157f5d7561be8048777a22863d4edd781be64fe8f65d814d909df6190c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674762346, "uuid": "1b5d9d83-7f44-4e37-b0b0-60960481b572", "value": "T13585234BB8D1D9FDD941CEFB6E30A200AFB2AE8B117C51517647379C28B72F059622E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674762346, "uuid": "fd534a92-a9e5-4e52-8dd1-d8199841bf3b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674762346, "uuid": "2e280d75-e4e1-417b-8d47-a28f27cb0b73", "value": "49152:okug+Xm2OtWlJLbJEQ2UuXr2QgV1JW+a80SiytjLCgv2MR:hug+XIU9q9r2QCk8fnv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674762346, "uuid": "0afbdcda-5020-4fa7-ac2b-dec8492db4fa", "value": 1874213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674762346, "uuid": "1aa6c799-37ff-4b3c-8bdf-2ed726bb0380", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674762346, "uuid": "47cb77f4-45bf-499e-a7cb-266f2393ac6f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f7fa120-9d7f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674740483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740483, "uuid": "d0bc8ece-ba60-46bf-9f16-6a920d737133", "comment": "Malware payload (Formbook)", "value": "c55eff277ac26a9f3ce0f9aecce98a6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740483, "uuid": "d3a62a19-ee4f-449c-979c-e899782dbb58", "comment": "Malware payload (Formbook)", "value": "d57ad8a21aa598c3aea680ee4abdebc2ee552c290a1f5d498f3516b084a95d38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740483, "uuid": "6ed67c11-2ce4-4853-93d4-a972fc9cb0d3", "comment": "Malware payload (Formbook)", "value": "55375f788bf212e1b4777af7bca6973aae68e2a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740483, "uuid": "8dfaab82-f733-4f22-bd96-b20a4cbb6cea", "comment": "Malware payload (Formbook)", "value": "730a7ac564d906ddc892325b9161f71672a2cb601214f5c558bddc8d4126485024867db6bf6881532f88ca2e07e5df09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740483, "uuid": "d5600e44-29b3-4f3f-a8c2-555df626bf51", "value": "T112541240FE60D997D8820BF51D7B26916AE2B82158B55F5F13803F45FE32D829A8F723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740483, "uuid": "6f35ddc9-be6e-43a1-b4df-1ca2ce6b18c5", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740483, "uuid": "3c5668d5-0cac-4f04-b7bf-700949e661b7", "value": "6144:vYa6SfAyN4Wgo87ExXLdIs573MIdpmd3eVvXVRW4rXFJ:vYUfjbgoGsX5P73Xd83eV3Wo/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674740483, "uuid": "63a6e622-93ce-426c-bf92-01ba01dd95e4", "value": 280352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674740483, "uuid": "b3ed4098-bd98-4d16-a3a9-78d5593e8d71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740483, "uuid": "91bea756-e48b-4a36-96df-4fe81687cc91", "value": "swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34fab46d-9dd4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674777026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674777026, "uuid": "652f4864-b71c-4d4d-a795-bbb6d2b1c577", "comment": "Malware payload", "value": "89be005919969e877221b7615c6824da", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674777026, "uuid": "d671f4d2-ea56-46fc-aa17-581135f12e13", "comment": "Malware payload", "value": "d5bb7f257f07099a70c685865b65e69ad9fa16f2cbaa13b9f8109fa5bd0d7471", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674777026, "uuid": "f985b871-5358-42d4-ab12-14223acf74ee", "comment": "Malware payload", "value": "0efef178cb51ff43779a0fe864ca02f0d5009dd4", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674777026, "uuid": "fb2732f9-10d4-41d3-af33-4de15ee52b5e", "comment": "Malware payload", "value": "a338f860e063b6d1c20024f7641edc6b8c28a79eaab4176f3fc43f33b6fb898757b93907dab0f1c99fcdfab3545370b9", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674777026, "uuid": "43f56ebc-f19a-4715-b43b-b25896cf1b9e", "value": "T1C71150E658DA88847372C6B517E7E19DF813D18A61414D0C778061ABFF6A30E42D3587", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674777026, "uuid": "c178b7a9-c71d-4e45-9a1c-6f8e506758c6", "value": "24:hMNmMvy4GqptEIjb18qeoAl8p8xuY8yu5yNwq7kWl88e/ZM8E4olEC:ImMqopOIjb1Jd4ucNP7kJyt40F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674777026, "uuid": "88417e2c-69d5-438b-b0eb-605310e05536", "value": 964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674777026, "uuid": "45697d2d-11e6-4206-920a-34e893a61d0b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674777026, "uuid": "e6aebe09-df5f-4ded-9d9f-54719fc8cc32", "value": "PO.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bec6e32-9d6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674732343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674732343, "uuid": "8583d07b-605b-408c-9e8b-797401aa7248", "comment": "Malware payload (Smoke Loader)", "value": "8e45ba63f16aa36dad019406d962f520", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674732343, "uuid": "259577e5-4f45-4ca1-b15e-0b3b57e898db", "comment": "Malware payload (Smoke Loader)", "value": "d60d4934ef2900d3554574f1bdc52cc524413482a8665587afb861d86ef87b21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674732343, "uuid": "e998aa8c-65ed-4dfb-9ff9-acfd2d1fa725", "comment": "Malware payload (Smoke Loader)", "value": "e7a31cb649c34c389c639eb9adfce34c4ff4f081", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674732343, "uuid": "6869b03d-ab4d-47c1-a2fa-e8e654a5f77a", "comment": "Malware payload (Smoke Loader)", "value": "9f29faf70fdbce1096615d2e59e32f4a4d6b81ac7695d42197f09b1b6302eed8127aebe8f95881fdff1b3ad9ae4a4d1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674732343, "uuid": "22790927-8c6d-46eb-bde2-19af897c535c", "value": "T19D14D01239A0F471C5AA45381C68E7DB7B3BE93346A5C58B37940ABE1F701D1AF3A346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674732343, "uuid": "70d01875-48de-4f0a-abc4-55f450c3e61c", "value": "76acbc9b0e9b8516eed30a33559882bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674732343, "uuid": "ad511f31-c816-4553-a2ba-6b47a74051e9", "value": "3072:DBN2IkoKpLwhZah5JEnCrYfY9WUSWpHmTU/9JcTDfy1pL:NaLoZalaCr5WUSuHmTy/cT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674732343, "uuid": "3c1d6cf0-52ce-4b93-bafa-b411ec695393", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674732343, "uuid": "c2227d0a-a744-4f33-a153-b84badb3fa50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674732343, "uuid": "450dbb97-7795-4564-be98-6eae979acf54", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68df2fa7-9d79-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1674738029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738029, "uuid": "92bdeff0-6011-4fab-b913-5403ba6e80fc", "comment": "Malware payload (Guildma)", "value": "d79365f906dc0232197cfe378a1f6a62", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738029, "uuid": "ed5a159a-d394-4377-ade3-7448b7586166", "comment": "Malware payload (Guildma)", "value": "d696ab9b16e32fb3d04f7c7456fd3837b792a351eb3076dd95dcfa75b02d5f16", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738029, "uuid": "4ed3974b-16dc-4487-8ee2-a4dee83da333", "comment": "Malware payload (Guildma)", "value": "a6390b4228e52bb3b1a13d6f4ddb7a66778186d9", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738029, "uuid": "01ca3743-ea4b-4259-aea9-f54bd3c83d1f", "comment": "Malware payload (Guildma)", "value": "f1dea7fc65a02d99c4f723268bba78e3a827202b89a06bf5b3760c628047077ef999f54c223b7ff77167fc47ba9b75d6", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738029, "uuid": "47ea22f2-67c7-4e2f-a303-5fbfe97b0f30", "value": "T1C342C0B4B5010F4920701926FCFADD0AEB44C837915885C9B4F3C54BFDFA2B9A6E8D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738029, "uuid": "0b3587a8-c5f2-4117-860a-5d925103b4a2", "value": "384:IA3IXH42S/KGVx7pPhRek6zHk/Tq8B4c5S8VhVCersvPV4QPvEzCOs:DdZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674738029, "uuid": "be67df99-1417-4ea6-a16f-18b2a7ae586d", "value": 12644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674738029, "uuid": "f54d2a3b-bb41-4ad2-a75b-952367bc6ccf", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738029, "uuid": "a8b80143-4c78-4647-afc8-50a8b70e7644", "value": "payload.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "603a48d7-9d7e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674740162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740162, "uuid": "cea7a5fc-9cdd-470f-bc73-2691b1690525", "comment": "Malware payload (Smoke Loader)", "value": "eb82519a4b077f78db9089cb8fa55fbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740162, "uuid": "aa60a423-8481-49ac-897c-15453afce5e1", "comment": "Malware payload (Smoke Loader)", "value": "d7a7e504df9acc4258515715fb57bb41ac2e913d7972e80c04815ff3cd7d8c84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740162, "uuid": "a6bb1b81-fd9f-4837-9a13-b649d3f96fa2", "comment": "Malware payload (Smoke Loader)", "value": "9e42848a868e27b67751df48b3b8a1d8035c2cfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740162, "uuid": "d3174912-7482-4c28-8499-b2553dbb9f64", "comment": "Malware payload (Smoke Loader)", "value": "aec6d78e4f940e6f62ae2fd0d1dc1b1a7d08a1a49175132881a299bbb6e754f732e50b0242d76de4dee5896a392b0c74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740162, "uuid": "424e137d-eb94-4e7d-a779-d749f65e0366", "value": "T18A14E012B990F033C5D689705824DAF4AF3FB93216A9C4977B570ABE0F313E1576638A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740162, "uuid": "f734c9f7-4c26-4c19-b7de-8571bcafe7d5", "value": "0cf7da7ba6041e7b7038cd2e90d72093", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740162, "uuid": "6fc384d1-e3fe-4a76-8310-d84a271263d9", "value": "3072:XBN29mzuiLdqe2w4fM5a3rmmdDnuP8TLG50YAUKyRnIAMI5FMG:xtnLdPN4ff33DtGKTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674740162, "uuid": "1de8d60a-fa15-402c-8146-0d9e469f55e9", "value": 206848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674740162, "uuid": "73306a88-7628-41d5-9ca0-4186ad7cc81f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740162, "uuid": "354bb5f7-83a4-4903-802f-a8f1fed5a44a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8d94e5e-9d4a-11ed-88f6-42010a9c006e", "comment": "Malware payload (StormKitty)", "timestamp": 1674718057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718057, "uuid": "125e3b47-81f1-49dd-9a4e-36c5140341bf", "comment": "Malware payload (StormKitty)", "value": "6b6158281be7a4c6d27c26a19584a506", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718057, "uuid": "4e30ba20-3c78-43de-8f31-93580921ff18", "comment": "Malware payload (StormKitty)", "value": "d7cd5ce46ffb8abe6ee2cb0c2a9f6528d8121fb90bd4072e71cd901099885eb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718057, "uuid": "b4fe7994-4538-488a-98e0-08c1ff5643da", "comment": "Malware payload (StormKitty)", "value": "642977b3de3a0d226859228dae11cb5d74ff0472", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718057, "uuid": "fc68e6aa-2ec5-452d-a082-c3e5e7b2c77c", "comment": "Malware payload (StormKitty)", "value": "999de002e4238b1fea93c413419df1dfc61bed14c87f5d7d15f93d2638e6b30ce432b7a1a747cad00a9f7b8e1d31b97b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "StormKitty", "colour": "#922AAA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718057, "uuid": "33a4b813-a0b5-4fad-b8e2-96a29bd97ddd", "value": "T11BC3599D725072EFC857D472DEA82CA4EB60B4BA831B5207A02715EDEE4C997DF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718057, "uuid": "8706f167-c9a8-48fc-a0ad-d42cd1964a9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718057, "uuid": "6e2be87d-a3d7-4587-833c-5eac0cf1a5f5", "value": "3072:hzVvRQ0DOtiT3VLK8LEN7m8lneeF1eujsqk7jx++eH6:hpJpOtQON7m8de6okkB++eH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674718057, "uuid": "4fbc3fe2-2038-463b-9573-3226e424f926", "value": 127488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674718057, "uuid": "fb88cbaa-c7c3-4233-9db0-91373f217ca2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718057, "uuid": "c0d7c837-36d5-42eb-9cf8-0c3a3f70c7c4", "value": "TRANSFERIR COPIA_26-01-2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2d1f7f0-9d53-11ed-88f6-42010a9c006e", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1674721913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674721913, "uuid": "fcaf1dee-8f90-43ff-9aa0-50d176be055c", "comment": "Malware payload (RaccoonStealer)", "value": "dafe5a638249c8479349a21d8a285b80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674721913, "uuid": "4e6f6fcc-00dd-4772-8831-6a9f61eadbd9", "comment": "Malware payload (RaccoonStealer)", "value": "d7d25a827de912a5ed8e3d8eb4e6d26b20b48834b6cbf99c72162f9f74e62364", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674721913, "uuid": "7451db85-01c1-4903-9684-a819d5157113", "comment": "Malware payload (RaccoonStealer)", "value": "4f930b8ee8343d2c5c675e1b100e75f42a3867d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674721913, "uuid": "e8490e89-b2f0-47ed-81bb-5c02f0e50079", "comment": "Malware payload (RaccoonStealer)", "value": "62cbc108099abcc8f4b7ca33a5f78a7b8a7b4955504b0a5dfb13110ffd680d576b91bb0781ddccd83e8ea7e8f684eb34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674721913, "uuid": "2e004cd6-6368-4c60-95b5-bd4d2d109f9a", "value": "T13AD5236BD6C0BDC3F0260B70B97A0E550976DE76664A2262F0DFB32125730ADCB35396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674721913, "uuid": "0cfb41e0-9668-4ff8-bbe6-4901b8f74a6f", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674721913, "uuid": "a1363394-d3bc-4029-9c81-544f89f0eb96", "value": "49152:NhLw96g9fhkl8asMCW4YAAgSRJWDnO6dRqTr+Wn8D/hnN1/gisnopApkdkRcwqj4:Ij9fhkl8asMmcg1DnTdi18D9zI3nop3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674721913, "uuid": "d2eb0f1f-6639-419a-9359-ec1341165b37", "value": 2920960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674721913, "uuid": "f0ca434f-680f-4fa1-b776-b1733db16800", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674721913, "uuid": "62c25e06-ee93-4956-b6d7-2fe50cc0264f", "value": "setup_win64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fc45d3b-9d41-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1674713935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713935, "uuid": "eaf293db-8f2b-4316-bae8-d8f5ab9eeca1", "comment": "Malware payload (Gafgyt)", "value": "c6e788aeb9cea1776950cd0041c53ead", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713935, "uuid": "f7e045f9-1bc1-431c-852d-e32bd672a22e", "comment": "Malware payload (Gafgyt)", "value": "d8b897a2b6a7124a82cbc4cb77219f0e2cc49400d0cc3b925c695be0a3bd73a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713935, "uuid": "76ac8ab1-f7a9-4947-aecc-c1b37a60f8da", "comment": "Malware payload (Gafgyt)", "value": "5970161c05c310f58a1cae16ab9191a2fee95d1e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713935, "uuid": "9018b1b5-d3d7-4f9f-a057-568f2e373330", "comment": "Malware payload (Gafgyt)", "value": "ee4db324727b3716b91074e234d2b71a2de5279d92979be33385e50ce939436bcc9d3912ba8a58ed54200b9607c79930", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674713935, "uuid": "5c8271f0-c755-4d6d-b095-ab398ab9c19f", "value": "T16B14942BBA225B7DE158857107F33B60C78611BB66D66293F12CCA54AE7024E187FFD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674713935, "uuid": "1f8d6131-951a-4d24-8471-47bac1695bd5", "value": "1536:o7j+1TzPqOHH3Oo2rKGju3uuXPXiKAuiXNUskuMd6eP9lX9yyIc+ddddddkwqPqv:H5U+X06sk1d5cyIBZZNhmvR8q+TGhjYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674713935, "uuid": "98322054-08c6-4e00-bc44-ddc1e15f894e", "value": 191718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674713935, "uuid": "66826d9a-893b-4f9d-a444-dc5b8bc73846", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674713935, "uuid": "cb507a77-c907-46f4-b688-8385d959635a", "value": "c6e788aeb9cea1776950cd0041c53ead", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a123ec-9dd1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674775660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775660, "uuid": "11e2d1b0-e9bf-474e-a853-c2efdc230f28", "comment": "Malware payload", "value": "e2a70af474a4b38bca6b68f1daf1b362", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775660, "uuid": "2e05d006-0db6-4814-97b2-6c1ee5d14604", "comment": "Malware payload", "value": "d8de4c9b1e02881514bcf0bc4115a2a236faf35f04989eb46ff4cf8b447b9f29", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775660, "uuid": "4778af6f-6c6c-4b65-85d0-9eaeab3f1a7a", "comment": "Malware payload", "value": "8e0e856137291592e50ec5074e3ac074eca0e592", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775660, "uuid": "162802d3-0d01-47b9-be8a-d512e9cbce5e", "comment": "Malware payload", "value": "c20b08d03e13ba4f5f0313692dfdc15acc8984970f0c9e872d60b4cb2fe8021910b2c208b0d80fd850a5c3f0510b9bba", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775660, "uuid": "2bb0d8f1-fe0c-441f-90ba-daca888cf9b4", "value": "T10063E8A9765070769E13E4B1416B544EB27F443BF44E08ACE2A88DE1BFF28DE447272D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775660, "uuid": "883b68df-2fc4-465e-b98e-97f0d45b6965", "value": "768:M/lZmWuDcQ9RWfqvqoeFGMvFzsiOPNDD7BLQGrMqCDYRQ8JCPSjn5gfGyCe+U22r:7b9jLNrBHstajrBsuSIF4COGfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674775660, "uuid": "c87d031b-9af6-4575-9930-3ae065f203b6", "value": 73109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674775660, "uuid": "f560ddf7-39da-4258-8be8-77a74038570b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775660, "uuid": "704d9d94-5e00-44be-a9f2-28844c0ddf29", "value": "view3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2101b899-9da6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vjw0rm)", "timestamp": 1674757236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674757236, "uuid": "a4845810-0fde-43ca-bb72-a2219789f4ff", "comment": "Malware payload (Vjw0rm)", "value": "d7d4bde73f37306d955f0bfb63a8d002", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674757236, "uuid": "47b25e93-881f-4021-b4c4-420f76f9bde9", "comment": "Malware payload (Vjw0rm)", "value": "da924bd600bfab2b3d7647fadf31593747aac941e083856d8bcedaa021da4b7a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674757236, "uuid": "5d6479b0-1b74-40a7-811a-e93f7294bc76", "comment": "Malware payload (Vjw0rm)", "value": "843b86723b5c6113b1ab20756b98d3c8221db031", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674757236, "uuid": "5db8b31c-df4d-4f51-b726-a27733f189f8", "comment": "Malware payload (Vjw0rm)", "value": "78b909884ccdd226808591af84b755d309b3e3d1207bd8ba78a286e3f081f1b8d6ee34d17e463c5ca0a83728838aa4a6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674757236, "uuid": "4799a8bc-fb3a-4509-ba65-5cda429724d3", "value": "T1AF45D3D4FA0D60495EB1105801391E994DBCC6EBC2B8DBF8F617B914DA3944AF3ED2E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674757236, "uuid": "2bd8634f-c514-4592-8b16-cda65d0873a1", "value": "12288:eQ3B7qgpCrbmZ7njOZkjS1MDP13+2O/+dKEy:gbm5nikjSCDPl6/+dKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674757236, "uuid": "72ad305c-4e3b-4527-a9b4-deb35f4bf866", "value": 1242436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674757236, "uuid": "b29b9619-dde1-467c-ab39-1d1b425a2b3e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674757236, "uuid": "9e5bb244-c64d-448b-9e8d-891add29449d", "value": "Purchase Contract.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da6a26d7-9d2f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674706437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674706437, "uuid": "144d0401-ba11-4d41-8b8e-a38e8e53b8db", "comment": "Malware payload (Smoke Loader)", "value": "0c1b1b481953dc252d65d1925cc2584c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674706437, "uuid": "dc72c0d1-97df-4a5e-b698-f07fb7d08603", "comment": "Malware payload (Smoke Loader)", "value": "dcddaac9bbbbee2fa3285cb9f35f28a692ede37bd4b9e5b1da18be5b1b8ab10e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674706437, "uuid": "5f58ed37-6fdd-425d-8136-c769d6393566", "comment": "Malware payload (Smoke Loader)", "value": "7bc375d257eb19ba785d91fc129ccdd6846a2285", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674706437, "uuid": "bd708cef-54a5-4358-9c26-5d000f8cbfd3", "comment": "Malware payload (Smoke Loader)", "value": "59af6667481dd503566192f8162538cdd265004899b96e5d5ca3633fdc77b009d3fa35a43e7cb83fefd38b2aba20b48c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674706437, "uuid": "0ff7769d-7b98-4511-bab7-33a1c6a51f83", "value": "T1EF64BF2275D0B950F91A0A36CD2AFBD439AEF8D28FFC725732C4661F2C732A1D166215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674706437, "uuid": "baa846c5-6bd8-46f4-a940-54076b6f6b57", "value": "e5f35c047e0fdde323b83e51e689dfb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674706437, "uuid": "99cef936-b2e4-4680-a824-7e583b77c90b", "value": "6144:LlLlXEPHGhM1Z8blaRdMuhwo1LDY0+MOKXKh5wUT:LlJCHGhI4lfMwol0We/wUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674706437, "uuid": "6e3f61b7-d7ef-46f0-9891-b35681e7db60", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674706437, "uuid": "b3c3c89d-a779-496a-a52c-6539cb2e87ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674706437, "uuid": "c00c88c0-5883-4ab2-9313-2dda723b36fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b18b709-9dd2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674776258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776258, "uuid": "39c5b6d5-4474-4679-a81f-e10cb8690bc4", "comment": "Malware payload", "value": "544a65bfe51385bb148f23a4e3f140d6", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776258, "uuid": "2adf9888-fed1-4f07-9b8d-d26e7f00db7e", "comment": "Malware payload", "value": "ddeb109a97e3689b63d4ee848d4c23b0646c8070badebcc852577be0b64c7397", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776258, "uuid": "73270a3e-cd22-484c-87dc-e6e190c91ca4", "comment": "Malware payload", "value": "aaa7e3192aa75b87b0e4877e11e12c5f98493e22", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674776258, "uuid": "addd041f-f05e-4b61-b126-42cd489e06f4", "comment": "Malware payload", "value": "1ff84b16f96f4f2ff8a04ae4599d54f53d85b987c1b7f35a41b52b009c872eade79abb2f005c74a928dc1e79dc1a9bc4", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776258, "uuid": "4acfd61d-11f7-41b3-b8bc-9d46a50aabf7", "value": "T10241B0060EF55B26F2B24A3A017EA261D932BEC3FD42CB5D400152891976950E87EF3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776258, "uuid": "148c353f-6b39-4861-b01c-b0c767a87c2c", "value": "24:8urvVXzUU4+8AEtO6+/e5F+78PLxXJiFtJ9Fs74N8PLxXHH44EXD/Pxm:8OjnDElFVPLxmtLJyPLx3H4FXjPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674776258, "uuid": "03f4fde4-6b71-4aff-b2b2-ef9a8c287a0b", "value": 2158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674776258, "uuid": "568cd220-949d-4b42-98d3-01528a77e8b6", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674776258, "uuid": "5da04925-d417-453a-9c72-c0f94209b31d", "value": "Nota 2023.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "984a738f-9d76-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1674736820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674736820, "uuid": "cbdd56e5-d287-48e3-9182-4c332e25ecd5", "comment": "Malware payload (NanoCore)", "value": "b0c7a7b1906f09f91832fde3516a42dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674736820, "uuid": "75ca7121-8f43-483d-963e-9639b06d35e4", "comment": "Malware payload (NanoCore)", "value": "de618fb2a376e986af7a45aa15f4e9bf5a99a0cedd696e99c15210b2e29a673d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674736820, "uuid": "b5d5bea5-4ad1-4ae5-8974-520b350e8f02", "comment": "Malware payload (NanoCore)", "value": "4aeff52d336bf539145c4b70a2c38589fe6168a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674736820, "uuid": "337c20dc-e891-4703-9365-301d7a7a2e23", "comment": "Malware payload (NanoCore)", "value": "07fcd07ead730f20e7f7caf637bd399c54a474b6b252021054c76b0312e1d3fdd8195abd65c1a24075b294d0a73616ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674736820, "uuid": "9fdc7a24-6fa8-40c9-b37b-b70989396d53", "value": "T1BB15BF1423E9CF82F9BE4779C274524067B37865B432D7896EE1A0FE1DB3B104A42B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674736820, "uuid": "8a2a96b4-f673-45e4-9435-156e47d87fea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674736820, "uuid": "9336b3bb-476f-4f42-8dd6-b3751b8f4a95", "value": "12288:YtG7vV5zxPCRgh1/ZWkXD+FqIGbyr1W89rqfw2Dn+Sp2/iOQJ/ze5hHThHwZE4ny:gBGerNxqI2bHZS5xuhqVWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674736820, "uuid": "636358d9-d189-4b2f-97fc-57c60a793acb", "value": 954368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674736820, "uuid": "c9c9c092-4811-4081-8462-49bade1c7934", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674736820, "uuid": "c2be1c57-7dd2-4b83-bf72-188ad07ccb5a", "value": "b0c7a7b1906f09f91832fde3516a42dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d3ad26d-9d50-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674720454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720454, "uuid": "dd0baf21-290b-43a6-a09c-dad4c9b7bc7a", "comment": "Malware payload", "value": "2c9cfec0055c7639aa9b4c5ad4e96413", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720454, "uuid": "72a4342e-bdfe-4731-90cb-ea62e3817d74", "comment": "Malware payload", "value": "de8de826f2785e0db8e1d078eeaf1a929f7f46b0a7ead36699e5771fab33117d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720454, "uuid": "935f5899-c667-478c-bce5-568ce45a7809", "comment": "Malware payload", "value": "b7aee3d2033a50c1329fb53e0d509e7797a6a172", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674720454, "uuid": "68e60516-818b-48c6-a75b-786554c3af32", "comment": "Malware payload", "value": "197dd04699a68f51799fcfc084dc38cc716801b8b9a8dac9fb97df242d85682b1dd8477a781c82c5c1f1f17b453b3b98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720454, "uuid": "8a42286f-2943-49b9-a717-0a664cde71ae", "value": "T145824B5C166CA513DDEB1BBCC4CB85138FB29277DC41FA1A29A8D0D939873D0266832F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720454, "uuid": "629a293b-d0b9-404b-9eaa-02feb7cd9b02", "value": "384:3T9As28vSNZVyywwwwpqMalFwpceA0o2dFyAsNkEZW7cH9ucGmGovy8ZpHSJK8n:yNXvqMalFwpceA765GRAcHcWyiRr8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674720454, "uuid": "698e1541-4c95-462e-8907-0ed64cd623c9", "value": 18792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674720454, "uuid": "fd9f88c5-7ab6-4168-87d5-350294bc8a6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674720454, "uuid": "d18436af-79fc-4cc3-82d9-2abf3ceab97d", "value": "7tcy2hdFYI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d7bd024-9d4d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674719085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719085, "uuid": "95ba2d46-7327-41b4-97d5-bf7fe392c113", "comment": "Malware payload", "value": "78fb4b695c7beb09d3e5df8e39283995", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719085, "uuid": "8a43628e-6538-4a3f-8398-2f6cb9296325", "comment": "Malware payload", "value": "df84048eb7df085ca8bd8aa8beda2f96abb7e9fe647e4e10bc04a542fddb463c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719085, "uuid": "82f025e4-d666-4112-97dd-964364e80ae9", "comment": "Malware payload", "value": "01f1b42af65073225267f31266553a8247332a88", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719085, "uuid": "35c3ac38-4a5c-4ce7-ae1d-04d05c89a6cd", "comment": "Malware payload", "value": "9e67eb7e5ceae918601277af2b08863534b7be9559c40fff813932670adec33d6377618506564318cca3fc9678fac805", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719085, "uuid": "a84644e9-1b59-40c0-8558-99b139a381a4", "value": "T1B1751215FBA54281EE91D6391D37C55C6062ECC82FAD4B8372687B2E2D314B40BA77CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719085, "uuid": "a1f6ff3a-fcdb-460f-87b3-fd11acb31c9a", "value": "49152:kD+O/JQDD+O/JQUD+O/JQ1D+O/JQDHEGOKVxT5tS0T5:kDpxMDpxvDpxWDpxyHEL8t5tJd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674719085, "uuid": "03cc27a8-ba3f-4a8d-be2f-7df0d1f1615e", "value": 1666048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674719085, "uuid": "28b3e27c-d658-4cae-9e15-85e48ee348b8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719085, "uuid": "1c5177a7-2cf4-4757-a396-53c63af59d66", "value": "NEW ORDER.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e30671c-9d7d-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1674739836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674739836, "uuid": "187f451a-4cf7-406c-8d70-41c67ac95e7d", "comment": "Malware payload (njrat)", "value": "abd7d9683898b8310ebbb236699ab814", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674739836, "uuid": "394b20b2-4f87-456a-9c02-2cb0babf6a00", "comment": "Malware payload (njrat)", "value": "e282c6405e294d79e39058698eb61a115dd9b9f15ee3dd448d0821ebb1284c2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674739836, "uuid": "15daa7cb-3952-489e-a1a2-012ce85a437d", "comment": "Malware payload (njrat)", "value": "1f234a243c6b3b9079d921909e63caddb984f667", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674739836, "uuid": "0a35e8e1-db16-4a0f-a9d8-226b19dcba3c", "comment": "Malware payload (njrat)", "value": "9805dca2b364d612444f2c0dcc7ab5884ec6676adc924262c33b3cd1352cf237bccf63d66ba14c646681e291f67de429", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674739836, "uuid": "6ca80a2f-d5e3-4429-bf58-3383330e086c", "value": "T131033A4D7FE181A8C5FD067B05B2D41207BAE04B6E23DD0E8EE564EA37636C58B50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674739836, "uuid": "7e409ae0-761a-4930-9486-186ff198b81a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674739836, "uuid": "63f117e0-1834-433e-ac91-e61e81c92d8a", "value": "384:DmOs0IiejvCVLO309QmykrtG+dA+VfwvOSiKrAF+rMRTyN/0L+EcoinblneHQM3W:pFdGdkrgYRwWS9rM+rMRa8NuTPt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674739836, "uuid": "923ada61-3472-46c1-914e-0f715add6be6", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674739836, "uuid": "46a0af49-b4a2-427f-a9d3-b2960336db8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674739836, "uuid": "4bea226f-b734-46d1-b812-8a56659073e1", "value": "abd7d9683898b8310ebbb236699ab814.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76079c80-9d4d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674719153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719153, "uuid": "0b3f9006-1f13-40cd-a643-8b0f25c57571", "comment": "Malware payload", "value": "8406099a8e47e6f1732d5a022d8d6a4b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719153, "uuid": "29c6d360-1594-4d35-96db-e5a1adbf63a6", "comment": "Malware payload", "value": "e2d20d55d2028393833af36dec30320b5b5419d1b3c223d62937f65470324a72", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719153, "uuid": "57b92ba2-d55f-485c-b1cf-0eb6b415916b", "comment": "Malware payload", "value": "75f25409737dac697eb24d9e0bc5c2e615108c45", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719153, "uuid": "3bef82e3-8ef9-42aa-bdc7-3b714af1fd78", "comment": "Malware payload", "value": "f33f79514b3697eda22104569314d1a929a8eba5fbf58207c97c676687ae1a1988d9d626c135f6f7b1f929547c214f01", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719153, "uuid": "8fd81abb-c537-4426-b498-3d3f946faba3", "value": "T1E026E02279C6C633EA6F4334256ADB7B51F97AE0377380DB53D4852E0E719C08276E92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719153, "uuid": "84c4ced4-62de-4405-bbd7-74fe4f862caf", "value": "98304:oYUMV39xAlAfwrty24veHjPMNaWPlhkc/4ByWYcQ8l8zAPHEQ0BC77x:zP/eH9SPHel8zAMQ0BCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674719153, "uuid": "ad571caa-15e5-461f-aa60-60f14c236e4f", "value": 4737595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674719153, "uuid": "a9584d5d-5003-4bae-bb09-7d93b72bfe67", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719153, "uuid": "fe22fd27-93a3-4c78-a68c-9acb5af11023", "value": "8406099a8e47e6f1732d5a022d8d6a4b.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5701f6c1-9d7a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674738428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738428, "uuid": "60c1fded-3748-437b-846b-3313fde44eb2", "comment": "Malware payload (AgentTesla)", "value": "3b0c4a7e45db8f8356209b407ee121f8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738428, "uuid": "ab0c8afb-b38c-4a43-8239-84e45604ad61", "comment": "Malware payload (AgentTesla)", "value": "e31c608e7f7c15f3783ce3a0f60de2df28ac15195aa873d74feacfac98d2b0fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738428, "uuid": "e4e10b04-5e92-416f-bd96-e00398cfb1d5", "comment": "Malware payload (AgentTesla)", "value": "6eefbf35fc311b8c9d1bbafcb6b8decee18aa177", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674738428, "uuid": "57f02424-582d-4a68-8c56-087db029e89b", "comment": "Malware payload (AgentTesla)", "value": "b54245094f7f34465bf4dbd8fe8eecc1272b1bed520df582febf40cb53cc07ce40be71cf9c16c2f18cf1a956b772dd09", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738428, "uuid": "62280612-b1ba-4e6a-b75f-f513be6bc75e", "value": "T1A425CF1423E9CF86FABD4775C6B4524063F37865A436D3895EE1A0FE1DB3B008A42B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738428, "uuid": "dd429454-437d-4188-be2e-34f71067cdc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738428, "uuid": "33189783-5b0e-478e-ad90-bf6f2b4f7812", "value": "12288:ftG7vV5zxPCRgcm/WW5XDCFqIGP4nqU4/WfdMmf4RM0SA0IZpzW3L0Lon6pqSm4P:vjGgqVWFnd01ZgL006py4KU/delU3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674738428, "uuid": "4119f0f7-9328-43a6-8cea-5b151cf52eb4", "value": 963584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674738428, "uuid": "29b4ef33-9c1f-43e8-8f1d-7b0fc6065f0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674738428, "uuid": "b2fc608f-96c8-4c2a-a08d-f960c088144a", "value": "E-Invoicing 04592648.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cf8b1d5-9d4b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1674718198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718198, "uuid": "4c8226ee-073d-46a3-acc7-bfcd811dbf24", "comment": "Malware payload (Formbook)", "value": "7637d7c6787de84d4d552c6dbca87dd9", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718198, "uuid": "49f311ba-7c91-4b72-af8d-b6f246837a18", "comment": "Malware payload (Formbook)", "value": "e3b06db7242175396000220071b329ca9756f9c908c9183f7484876e7f56e20b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718198, "uuid": "ee60bc74-a208-4eff-9c1a-172d3802f471", "comment": "Malware payload (Formbook)", "value": "eee2e2e9f4d9124704ba5bd48282b419754f83a5", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674718198, "uuid": "b2ba2b4d-ca51-4566-b990-bbd827b0f474", "comment": "Malware payload (Formbook)", "value": "ab3ac2078ebf2d1324c7fe5e735a26c1542a65e8f8b73ecc6f04e0bbcf428252df6a45e29d26d23a6ee96bddaa367888", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718198, "uuid": "05ff3b00-bd1a-49c6-b9ad-e1bc30a47871", "value": "T1D1751216BBA54291EED5C6391C37C56C6062ECC82FAD4B8372597B1E2D314B40BA73CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718198, "uuid": "d31dfe33-5c8f-4743-a8da-ebc3064394e1", "value": "49152:iD+O/JD6D+O/JDRD+O/JDxD+O/JDtopiUnhCikicLiet53:iDpx2Dpx1DpxdDpxhoIkhXkicG4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674718198, "uuid": "311ed890-b3ba-4f72-9b6f-5c7271fb5cab", "value": 1665536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674718198, "uuid": "4bd7128f-8b41-459a-998d-4734ec3652f0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674718198, "uuid": "2bbb23f7-d952-456a-8540-ffd77d48fffd", "value": "pre-orderX26.1.2023.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1421b699-9d5c-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674725431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674725431, "uuid": "0059ede3-fdf3-41b6-9a63-66e5abc5fd08", "comment": "Malware payload (GCleaner)", "value": "cfa63b754d19354e8fc11481b64dbba9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674725431, "uuid": "e36216d7-74eb-4313-8311-62950a741a6b", "comment": "Malware payload (GCleaner)", "value": "e3c25564fe6a2b4e7a89b37ae60d5c6295b510e8770e7bbde6b1c9414a801621", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674725431, "uuid": "857ad261-c375-4ed7-8305-707abb01a4db", "comment": "Malware payload (GCleaner)", "value": "acbcce0d62764989fb999d605a1a7809f4d235e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674725431, "uuid": "175af7b4-89ea-4d2c-b60f-1148b1b7978c", "comment": "Malware payload (GCleaner)", "value": "b5b54f0fa61bd873c5c8162653b70dfdb214c4c27959eee4395945a0fa74be114b9d63d42a5c41d3432557adcc879655", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674725431, "uuid": "16be193d-f661-4b9d-8e5f-f76edeb7fc24", "value": "T1BD95238694C295FDE936CEB63B714008AFB7BEC3247E284A356C22CC0D75570957A3A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674725431, "uuid": "41db3364-257e-4ff0-b8a0-13f64e2f2e55", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674725431, "uuid": "3610f050-564d-4a21-b075-1ee9d29f5bd2", "value": "49152:okug+czVWYrZk0wiN+yLXIwfWRODZTH+LCgv2MR:hug+8uiN+yzIwOROFTHev2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674725431, "uuid": "d9494fec-fb1b-446f-8519-9e4db4df6579", "value": 1905252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674725431, "uuid": "fae1d439-44fa-4368-b078-fa0662337424", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674725431, "uuid": "79c222fe-8539-4a25-b912-fe73f4cd745f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986986f8-9d4d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674719211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719211, "uuid": "483aa927-63b4-436a-ac25-ddc072ace83d", "comment": "Malware payload (AgentTesla)", "value": "3bdda9dadf8edf52ebc6f8e8431ce666", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719211, "uuid": "9fbddf3f-ef11-476b-a89f-6f54f922cb07", "comment": "Malware payload (AgentTesla)", "value": "e477423f57207a25f8c56fcdc1b838ac59f452ce49129de1ca9fa141cce63023", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719211, "uuid": "5dd5b4ca-070e-4ffb-93f7-3839e8dc2af1", "comment": "Malware payload (AgentTesla)", "value": "33d17a8e32e85624dd6fa8b1586841293709d5ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719211, "uuid": "8b6e2a61-b0cc-46ad-820c-1e13e14b7204", "comment": "Malware payload (AgentTesla)", "value": "8113a3d4022abe983b345d08f232200db709aa596876729fee12642311fe0a666edf2462fee7f6504830b76681b134a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719211, "uuid": "3f7fe484-212f-47ea-a7cb-24883630499c", "value": "T13924381470EB204851E6B6874FCBFAA5CB77A6F5003D7E2B44DC490B67EE811AA063F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719211, "uuid": "6198fa29-235e-4b25-991e-7469e52086f6", "value": "96:mEKs1VkB3wRu/u/u/u/u/ufbu/u/u/u/u/uzu/u/u/u/u/uDu/u/u/u/u/uyu/uL:mE7VkB3wBnGfQk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674719211, "uuid": "01d362c6-e85d-405d-aba5-c85ae8511fef", "value": 227972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674719211, "uuid": "80d7c55b-49be-47c9-814f-5ede9ea41e54", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719211, "uuid": "5d5b6c86-f286-4ad6-8516-f9136a77b8de", "value": "\u0395\u03a0\u0399\u0392\u0395\u0392\u0391\u0399\u03a9\u03a3\u0397 \u03a4\u0397\u03a3 \u03a0\u0391\u03a1\u0391\u0393\u0393\u0395\u039b\u0399\u0391\u03a3.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "302c9fbe-9d10-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vjw0rm)", "timestamp": 1674692837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674692837, "uuid": "5c56a75a-f1c9-4ef9-92bd-a3b732a123a4", "comment": "Malware payload (Vjw0rm)", "value": "8b786459da668bf229d67be2f0723d3e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674692837, "uuid": "40e7d0f7-85c7-4425-949b-10cbe8adadb6", "comment": "Malware payload (Vjw0rm)", "value": "e5949068ab9d6e134134a471fda48012a5052bf8e4fcbd5801e0df0d617f2336", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674692837, "uuid": "d2810893-b6dc-457c-a96a-36e6638d7454", "comment": "Malware payload (Vjw0rm)", "value": "a049cdb8ababa353f6680203104d94df4fd8bebb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674692837, "uuid": "4384c37f-f036-4432-bbb9-32b8f2e345fb", "comment": "Malware payload (Vjw0rm)", "value": "08bb56e3ba448b8501424169794121c29ddbba869cf8dd0e5e44be1819e01b30bc55a15ef32942229c67870e7311101e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674692837, "uuid": "1f7056fc-46e8-406c-b420-5a22d426a2fd", "value": "T16255D060EB845B9DEA9C0E0BE07D1A0E63F35B4AC4A3B1CD77637D07AA6FE4C1605485", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674692837, "uuid": "5dfc8079-2fa9-4a61-9c39-6beec0964603", "value": "24576:n+qRVuZ86lSFd1dLImyZDe83TrXYpPJK/msejpyqI8bFt3:n+qRVk8eo1LImytlYLKc+8P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674692837, "uuid": "c67b3508-5068-42a0-a7aa-2d15c929d074", "value": 1391459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674692837, "uuid": "c07f032f-60c2-44fb-b008-b36e6734dea8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674692837, "uuid": "086366d8-82ed-4caa-9907-99567c5ca505", "value": "8b786459da668bf229d67be2f0723d3e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22cb2a96-9d41-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1674713860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713860, "uuid": "808a7747-4711-4bd5-9508-cbcae0362165", "comment": "Malware payload (Gafgyt)", "value": "d83d24d9f75291c4ed08187164015ce2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713860, "uuid": "e91a61e8-b472-4cd3-8c0c-6206d2b9b236", "comment": "Malware payload (Gafgyt)", "value": "e5e16ee101a0fdf64935cc6c617f5a8efd4b83a2c12699a57b7e54a4177d5b58", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713860, "uuid": "ba3a5b8a-2712-4ac0-bb44-689bdc193468", "comment": "Malware payload (Gafgyt)", "value": "c7f0147c1545808e5217a7c27ba167065140ec0c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713860, "uuid": "61e99b45-f8fe-4c00-999c-7567e7181f2d", "comment": "Malware payload (Gafgyt)", "value": "5f007f9ed0a1e101292106b7ffeaa65a873fab09b5e473714877c6eba98450f0d3a9266144f1250df9aa40f1b0c8c0df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674713860, "uuid": "79eeb310-e90a-4862-a93b-a0e55b39a835", "value": "T147E30813D6254DB5D14548F2216736505B8792BB89EF22C7F9294EE0AF8A88F243FFD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674713860, "uuid": "e7114bb5-eb40-42c8-b91a-483e1ef0c979", "value": "1536:Wo7Wm11j8P8Zv5WKf9pDwqYEOSz+UOCkcBdddddzuufYY4h56m/jW0PGLh7fbIv:37R1gW5pf0PEnORWuurmbW0PGF7fbIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674713860, "uuid": "f33651f9-2d28-4d17-9863-d5f30440ede9", "value": 149841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674713860, "uuid": "06870fad-a4c7-4555-a807-6d595e36f72d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674713860, "uuid": "b60e28cf-3d33-42e3-9a4e-0e26cb253d24", "value": "d83d24d9f75291c4ed08187164015ce2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "514703b2-9d35-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674708784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674708784, "uuid": "d7b4b7d8-b184-4940-adf2-4338688ebf9e", "comment": "Malware payload (AgentTesla)", "value": "7ae60aa8491274419f456cad43ff2812", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674708784, "uuid": "6930d693-6329-40b9-8767-ff1e13846930", "comment": "Malware payload (AgentTesla)", "value": "e6c4f27c74ef1e7af054304d895c1923ef54eb3530980b1e0d0b19d49c95faee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674708784, "uuid": "164fc308-a22c-435b-805e-af4393285c01", "comment": "Malware payload (AgentTesla)", "value": "29de67c1f34b5ed7e18ae81e355c06d4192b1258", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674708784, "uuid": "b7a546c4-c335-4661-973d-4e897987c749", "comment": "Malware payload (AgentTesla)", "value": "3f31d22f0735bd378884ede8d7172f6c2f89ea259f9b4e7a328dcec4f6841d112a594f6112ce6c3a58e34fc8209c8358", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674708784, "uuid": "b714ed54-cab8-4399-97fd-49807c07ad16", "value": "T18A055A3C08B826DAC9BDF2BE6B85E5D0FE93805EB2758E9F4AD60441D54357222CBD1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674708784, "uuid": "672cefab-edf8-4a20-83f1-e8e9e8d2a5f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674708784, "uuid": "5e069724-11a8-449d-b240-2fa4ae1480e1", "value": "12288:b7w59hkX3b+S18REDHjrg0x1oQJVlavm8uaj+MCdF7fAOjX:IDMt18gxx1puZ3W7BX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674708784, "uuid": "97d73cd5-b5a8-48e4-a969-9c022f211dbe", "value": 830976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674708784, "uuid": "5d454dc3-4f99-4680-aaf5-cc068e67cafa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674708784, "uuid": "6d2a8f29-61da-4820-9d05-63a2fe66e09a", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b66cd92e-9d32-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674707665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674707665, "uuid": "fd5c6a1b-f11f-4c8b-8a7d-dda52c45d55c", "comment": "Malware payload (Smoke Loader)", "value": "431085b165e2673fcb23810b7db0102b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674707665, "uuid": "eafd044b-b33a-49b3-bd2e-2013f4192a32", "comment": "Malware payload (Smoke Loader)", "value": "e6f8b4a726841d9995449132e2b587d577863bdff0304017feca7e20e6129757", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674707665, "uuid": "0a234b6f-b598-45a3-ab11-a1f7661f1b4e", "comment": "Malware payload (Smoke Loader)", "value": "8ffbcc0190fde4f864eda8ce080b4f165a78f7c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674707665, "uuid": "a7d82bac-62fb-4535-b8fc-ae59075d4daf", "comment": "Malware payload (Smoke Loader)", "value": "f2a357574d91b6f083d486fe9cb03ff88f00be9fd11e83f94910e1b473063db5ba06991aef87239923d177a87e488f38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674707665, "uuid": "bf7cb7a0-2e56-48ed-aef6-f9b69a0ffedd", "value": "T13764AF1275D0B863E91A4636CD1ADBD4392EF8D28F3C735FB2C46A1F19732B1C52621A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674707665, "uuid": "cd4abb33-b4fb-4ee8-89eb-05478dfdb7a8", "value": "e5f35c047e0fdde323b83e51e689dfb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674707665, "uuid": "0bc923d9-035d-4889-a36d-423e8bc46e22", "value": "3072:ewKwv0ngrHxLGTXF9IHoARJs+CpNGuibSh0q0xDZ6zPhY0+L4Oi/XcLYr/UT:9TLoF9IhyNGuibEP+cdY0+MOKXhUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674707665, "uuid": "b2c5f33f-b6e1-4639-bb40-97ec08a9e2e9", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674707665, "uuid": "754a8cf5-3c01-42be-8fb0-5cc32426c1e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674707665, "uuid": "eca1472b-c841-454f-b3b0-ed29f6d4af10", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73ef1441-9db0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1674761670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674761670, "uuid": "02e79def-e92f-4438-8cc0-bbba59954ed7", "comment": "Malware payload (RedLineStealer)", "value": "c9c9e0c7e8b4e2de62eaa13e17a1c2ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674761670, "uuid": "cc48889c-a047-4a2d-ad3f-adcc0cdcfb6c", "comment": "Malware payload (RedLineStealer)", "value": "e700a3bc9d80b594341d5903db234ea0dcab74ed370fac4485a1b66799772f5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674761670, "uuid": "f4cd8611-052c-4638-8d89-fd123ebd356e", "comment": "Malware payload (RedLineStealer)", "value": "6b47d7316529ab141176952017aac4df8127211c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674761670, "uuid": "12951600-f6da-40c7-b146-33544fe9ddb6", "comment": "Malware payload (RedLineStealer)", "value": "7c9d0985ac42d8b233c45dfeb53ce4934b51286552b910448991cd20544b9cc918ca6f2b549c689fb4dcda1b8dffe9db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674761670, "uuid": "239086b6-8083-4037-983e-ec6c9c4500e6", "value": "T14A14E0213590D472C4A2463C6C64E3616F3BB93256B9958B3BD80BAD5F303E2A37734B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674761670, "uuid": "821effa6-1b7b-4266-9eee-0fc9a8ce480f", "value": "4dfa6309511cb75d1093a1ac55cf0bae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674761670, "uuid": "bafffbf6-62bf-4c9e-a94d-e89f8659031b", "value": "3072:bBN2BXiu5uzLHTLr1erOA65ccv3sUmreucIjMTJlW:F6SLHBerZEsUmr+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674761670, "uuid": "50801184-d1fb-43e3-b23b-abc57d461af3", "value": 203264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674761670, "uuid": "7954b53f-16b4-4a7a-a032-4c8c48c63c12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674761670, "uuid": "b083955b-1a18-4d73-8004-5d401beaeca3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a1fb0ff-9db0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1674761734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674761734, "uuid": "5a13e1d8-56d2-48e9-8245-841c1360efe1", "comment": "Malware payload (RecordBreaker)", "value": "24085f579497e4adda77ea8e3101efe4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674761734, "uuid": "2280b5a7-f98f-4504-90e3-47cbe18a3dee", "comment": "Malware payload (RecordBreaker)", "value": "e7f78e22526692e61b0df20f2f6a7d22918d6b8ed0d8489db583a0e60952ff67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674761734, "uuid": "03e8dedf-bb28-4929-840a-5d7e2ff7fbf3", "comment": "Malware payload (RecordBreaker)", "value": "fe29633a73efe06ffed1954be236aa9e49e2a762", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674761734, "uuid": "80a86cbd-c175-4256-8b7c-451bfbf5c155", "comment": "Malware payload (RecordBreaker)", "value": "6fd1f46959fc52805576a4f17ade05258d7d94c36a48a7cd363f4b755662bdfe9012319bd9a7c2f09fdd706757adc95d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674761734, "uuid": "d630fa24-1526-46ac-a522-43d07d3c0963", "value": "T13B5623F323559309D0DF8E34833BFEA4F1F40DA66B63A93926C636D559322E76212943", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674761734, "uuid": "19b693cf-4ca3-4208-b81b-b33b1d5649b3", "value": "11ea24073ee65343ee563e3160c77fde", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674761734, "uuid": "658b6762-9305-4ce6-ae7a-4d790bd8f20a", "value": "98304:2d+HKGRyh0wuVmd1USdtQ1TdEHSHBbmXLXKDSxWdyzxN0ARU6CjvpGbSrvLCoWwj:2UM8s+GoBbCXDxPxNaNGb6L31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674761734, "uuid": "3551ca19-a93a-45a8-9dcd-be4ce6d6889e", "value": 6462464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674761734, "uuid": "c667c5a3-87db-49c6-a16d-21c3e0c2aa51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674761734, "uuid": "565343c0-4a5b-4019-8721-21219002f39a", "value": "Autoplay.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37229ac9-9d3c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674711746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674711746, "uuid": "c0da674e-fc0f-42e7-9c9b-b22ac12051fc", "comment": "Malware payload (AgentTesla)", "value": "8dcc6d0b57946d786705863e1bacb658", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674711746, "uuid": "6f083b77-caea-4d2d-bb11-d0e43ef01a5b", "comment": "Malware payload (AgentTesla)", "value": "e87092e93a1a144894d2221cc206afad0989a352a3eb4e9460dedc51af542597", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674711746, "uuid": "ab835ca4-b988-44f1-863a-4668f476248b", "comment": "Malware payload (AgentTesla)", "value": "abe13f22469fd8d2256a5c5cf38ca33675781460", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674711746, "uuid": "efb250ba-f139-4b17-9d58-b786ee7ca657", "comment": "Malware payload (AgentTesla)", "value": "8d5149ebeefa988f523adf7f71b2344107719493fda85cc074a44d667b8b7d46926c44c51449df2e13ff969030000e72", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674711746, "uuid": "4b306609-15da-4370-a89b-fc20272f4577", "value": "T11FE49D4023EC9F41F6BA4B7896B9505103B7BC877533E21D8ED120DE4EB2B14AB46B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674711746, "uuid": "d2d0c775-99cd-465e-ab3a-7ed098d587b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674711746, "uuid": "236880a8-057d-450d-b6f1-10e7dfefd261", "value": "12288:8SkOvbnR8ey/ZhNcXDyzFqIGby9s9EEstgmyPrmhan6Jjb3/MWn1B7Nz:GvNrXGG9sNKg/Paha6JEyN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674711746, "uuid": "98a92f7a-61e9-4b4e-9822-fe81e24d0b54", "value": 676864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674711746, "uuid": "3cd4b464-5059-4217-8c5b-ac162a9ef9a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674711746, "uuid": "77a308a1-2bbe-48f0-8a02-13f6fb4a8798", "value": "Contract Draft & Drawing Specifications pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5138e2e9-9d4d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1674719091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719091, "uuid": "2d153d91-24f2-498b-9068-ff0192be9e1e", "comment": "Malware payload (Loki)", "value": "c3c39f13b005910981453d9b4d88c960", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719091, "uuid": "edda9c2f-6b02-4821-a7f0-5383f6122699", "comment": "Malware payload (Loki)", "value": "e8fcc57271e5b1ae0f4d26896a06af86d31b84a84985fe984e42b2b018a19bab", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719091, "uuid": "a8924b35-58b2-4c18-aad2-16492baae711", "comment": "Malware payload (Loki)", "value": "670bbb56884e014c58b8e1dee1b244759347ad73", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719091, "uuid": "1bea770c-0556-425b-9a05-22d21ef09262", "comment": "Malware payload (Loki)", "value": "1baba5f5287ba23c4e2d307130601f394747778db701a3bb9f449e4c7ccf17b987106bf1db7dc29c4040d7c8a02611a9", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719091, "uuid": "812552eb-d405-4456-a7c3-692778452d24", "value": "T16C45121AFBA40282EE81C6351D7BC55C71B6BCC86AAD47877254BB2A7D304B04B837C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719091, "uuid": "5c449c11-79de-44db-b014-7febd29bbac5", "value": "24576:ZhfQw+O9JJehfQw+O9JJ7hfQw+O9JJghfQw+O9JJ0TYDNbaQDgP6wz6d:nD+O/JmD+O/JdD+O/JUD+O/J88N2QkPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674719091, "uuid": "bc8294fd-ab8b-4d31-b0bf-e5d8c154cba8", "value": 1250816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674719091, "uuid": "11bbcdf5-7b8a-4066-83e1-ac42276838a2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719091, "uuid": "56510d9f-9523-4ed0-9ebc-1aa629c85b19", "value": "MV COMMON CALYPSO.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a08649-9dd1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674775651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775651, "uuid": "aa2e4099-d0f5-4a7b-9210-9a5edfa7dae1", "comment": "Malware payload", "value": "338e3079c391a6307d48c8230af4fabe", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775651, "uuid": "96768a0b-443c-4b5f-9106-eb5443fa3abe", "comment": "Malware payload", "value": "e9bbdc5362f85cf5b89b80fa6d61fbb8e16528ba787f6fa00f0bd7049bad85d6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775651, "uuid": "e26a2112-1964-409d-a43c-1292197e0d11", "comment": "Malware payload", "value": "0ec5a89e4c398af05ea17e1fd1f5bdc1e5793b4d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775651, "uuid": "8d4b3ad8-02b6-4c36-b50a-174012787e06", "comment": "Malware payload", "value": "104ab69728a7d728a5547ff3c14bc48efe35fa83ba02f1e007cbaf9aea2cf75956b96fca449a5d006e60c595cb2550a5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775651, "uuid": "3ed51f00-06f6-40f8-b813-42876326b1ac", "value": "T1920144AF1C5BFF8E99F2B6C64DEEC36C90C415A61498543C00F0746419323CF7D18515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775651, "uuid": "3abc8c52-9daf-41e9-b554-da45957e5cba", "value": "12:kxvsCk9cE3MxpJFuqOJOnZXTtaLTXxTQ/XwdtJcJxJTeYkOi55sc+nYI:kbxxpJrOQnZDybxs/gI7aYIz+YI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674775651, "uuid": "0f83ddca-57c5-4452-8861-28392fc86cfb", "value": 731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674775651, "uuid": "203fd610-be90-4b70-a057-cdea459640e8", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775651, "uuid": "8ffbf3f0-d8b4-4edb-b03c-e65a9bdf3457", "value": "0ec5a89e4c398af05ea17e1fd1f5bdc1e5793b4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a388ef10-9d3e-11ed-88f6-42010a9c006e", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1674712787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674712787, "uuid": "7a83ea8b-14ac-4fea-931b-9f46c0d93a83", "comment": "Malware payload (ArkeiStealer)", "value": "d2bb692ee404e793cfcb774e8c878d05", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674712787, "uuid": "1a5cbb67-6c21-4ca0-9676-3b08ecc7daef", "comment": "Malware payload (ArkeiStealer)", "value": "e9d91c295cd270dd97a7b07183a8e7c181ca6ba43a6a71251b9c6f4b19312b12", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674712787, "uuid": "4ea26fd2-c562-40cd-8454-92187e33ae86", "comment": "Malware payload (ArkeiStealer)", "value": "4eb75db0f1d7443b2d1b291c3114fcb63dd3cd0b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674712787, "uuid": "82239f73-2ca5-4934-8b15-77cab96b5bf5", "comment": "Malware payload (ArkeiStealer)", "value": "aaab64c0ddc00fe888f151c55ba8ac29824c57f218f9e363ccb0093533a40b72815609cac46a82cd8fda1c99735fee29", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674712787, "uuid": "140b484c-57c3-4c35-80d3-bb0448bb2c10", "value": "T19935239759217866F5D917F6930EA549E34F0C0CB8FB3B869E0A0212EC4B2CB5F76532", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674712787, "uuid": "17b8095c-efd5-4d42-8f56-180d7e1ec156", "value": "12288:Bu5RIW5HAxPqOmy5JiGKzg5QMdSwwoyMLma5gtLWnS:s5mPqOhZYgiamqgtLWnS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674712787, "uuid": "514da057-c6df-47ad-aab5-2b84adeb8310", "value": 1099319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674712787, "uuid": "48dcc8ee-5841-4957-980a-1d77a0f5e39e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674712787, "uuid": "350f3e9f-77b2-49de-9683-d316eb9c3ea5", "value": "Setup_x64bit.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d14483-9d26-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674702263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674702263, "uuid": "1c68f110-3e88-47d0-ba3a-5574e63e6650", "comment": "Malware payload (Smoke Loader)", "value": "813e36d3359eaf0bbc4735417c86b76c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674702263, "uuid": "704b04ff-1c3d-4460-85be-4b7685474395", "comment": "Malware payload (Smoke Loader)", "value": "ea2e3d117ce894917aa964a4a7a342632017277c3900e8dba6ecef2d6e682f46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674702263, "uuid": "3cf7f2be-0ab8-44b1-ad19-dc81c169bb15", "comment": "Malware payload (Smoke Loader)", "value": "cc2f12389255c0ef362d89dcf08b4022d31992de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674702263, "uuid": "17c2d17f-5167-48a2-9d30-b283d65ec8f8", "comment": "Malware payload (Smoke Loader)", "value": "ec2c5e855544a115114e72647c9215af12778e5aead2beb817e4e04280a05a941c691648d6a5f978e0cce96c6dde9b3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674702263, "uuid": "abc9e15a-b5c0-4c82-a3c9-cb357bd62b09", "value": "T120649E227690AC60E91A4736CD2BDBD8392DB8D2CF3C767732D4661F18722A1C56723D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674702263, "uuid": "1be17c17-604c-4325-8ff3-f3580587e0ac", "value": "e5f35c047e0fdde323b83e51e689dfb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674702263, "uuid": "a2dd2a2e-ce12-47f2-92bd-05c6cb4bde41", "value": "6144:A+LpqzJX9i7e+h74+Gh7wjMIxY0+MOKXj8UT:A+MlX9i7ZEBWsUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674702263, "uuid": "9da4e850-5550-438f-a89c-538f720ca4d5", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674702263, "uuid": "1d730a2b-b5ca-4508-ae43-cdcf8284a3a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674702263, "uuid": "53b7eaa3-dac5-4fb2-9ae6-a7a730417a4c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f7b943b-9d29-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674703653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674703653, "uuid": "d8d6b0c7-edbd-4ef0-a102-b9e2815b8d49", "comment": "Malware payload (AgentTesla)", "value": "92ff6f1715dbff4c8e045890353dfb11", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674703653, "uuid": "1fd1a4fa-c0aa-4a8a-b341-5e285cbd49d7", "comment": "Malware payload (AgentTesla)", "value": "ea4684def9f3926d666c908edb9fa2646d33c2d84e7b502afbb987c5b2302cd7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674703653, "uuid": "7067902f-063d-4d04-9ae6-1c670ea5d8b8", "comment": "Malware payload (AgentTesla)", "value": "4dc9c036247a584f7a60188e2d86e246c6d85107", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674703653, "uuid": "208af3fa-f6c1-4032-b9e8-28fa5184677c", "comment": "Malware payload (AgentTesla)", "value": "67c2516f4609830714827e5de3d463d2c8b909369090fca137dfea5f717c4e408d5ce8bfdbf0b03149e41aedb256a12f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674703653, "uuid": "7981e996-bf23-4486-a3a4-fb99cde3a6fc", "value": "T17305383D1D7B97F2D434F97252E5A0A0FA9F4492B3A7C9A9C9D61BC04F022826DCE11D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674703653, "uuid": "6b37f7e0-cf95-4a4b-8982-b4ddece8e79e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674703653, "uuid": "7b4c4c41-cdba-4d38-915b-61279d43199b", "value": "24576:NuT8irmdjXHNOrAe/Iubolr6Ue8gCa9Vo1Qk8ldW/ngfDx0:7lr69DxVo1QkydEgft0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674703653, "uuid": "6f230e1a-1ee0-42b0-980a-908bbeb0e139", "value": 826880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674703653, "uuid": "27099b22-2dc4-4f7b-ba22-28113ac9dec1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674703653, "uuid": "df4ac9c5-cb60-42c0-991f-5347f674ca2c", "value": "Revised Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93f2db67-9d1f-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674699447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674699447, "uuid": "b6912d64-2243-44f6-af40-76ad283aa646", "comment": "Malware payload (GCleaner)", "value": "f4f91022a999b3c3f6d88c65b9382cb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674699447, "uuid": "f380f719-c5b5-4b55-83a2-743fa811182f", "comment": "Malware payload (GCleaner)", "value": "eb31f1a7364e0af5e26d9dbeb6b4b2b286b31bc76e1361e74673844e9d1f80f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674699447, "uuid": "50177c6f-3a48-4c60-9a9d-122b1b144a7d", "comment": "Malware payload (GCleaner)", "value": "4d66ab1c297fc8fa58850b37a5352c7e8b5bf724", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674699447, "uuid": "c68c64eb-90ee-4ff6-8e01-98713ecb0ca0", "comment": "Malware payload (GCleaner)", "value": "1554b7236d79f2417f101a2034f20911ee5393954030607367c20e4e3b85ff2ad58c1783e082811edf1089094f52c433", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674699447, "uuid": "29251187-835e-4ab7-8b0a-12d88ff834c8", "value": "T18A85335680E9C871C1A3CDB69E7911A0DD7B2F2A3875330D339D950F1FABAD0E808697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674699447, "uuid": "dfe9075d-76f8-47c0-af16-a2428298fa0a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674699447, "uuid": "37b51645-b631-4546-a549-4d4290e9f576", "value": "49152:ZoLktmd0F8f7I+cyahcJqiTLi0KY8BB0E8RuD3KMxLCgv2MR:EkMpsfULDKY8BB0WD6Mdv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674699447, "uuid": "ce191a56-6c27-486c-a3ba-5d74f02290ce", "value": 1810737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674699447, "uuid": "c4b589e6-e94e-4130-9431-d4969bc58ce8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674699447, "uuid": "fa75d237-f5be-4c72-bddc-34751d99b171", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f6d1617-9d8f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674747408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674747408, "uuid": "84192369-f9c1-451e-868e-518e8f6fcd92", "comment": "Malware payload", "value": "59ef461d682680228a626c02d2b94ec2", "object_relation": "md5", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-wesoft2023", "colour": "#443768", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674747408, "uuid": "4d243325-d134-4456-a280-49ee98ed7cb6", "comment": "Malware payload", "value": "ec3905254d0c8eb09b4aa9bdb449a3cba64e5bc2034033bef85704b3da7c8998", "object_relation": "sha256", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-wesoft2023", "colour": "#443768", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674747408, "uuid": "718ef2d0-8366-4e09-8bbc-cbaa7cda3636", "comment": "Malware payload", "value": "ac2f02dc2b2c891fd9738c83b6823b73e9b0abdc", "object_relation": "sha1", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-wesoft2023", "colour": "#443768", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674747408, "uuid": "d834f1fb-a635-49fc-9a42-98d29ce36857", "comment": "Malware payload", "value": "9e9e89e94a843b78b296f6107ef5d070f0bfc1c05c45417e5dcf7762b068ff30eb037172eeefc407f292a184ff8fb5ea", "object_relation": "sha3-384", "Tag": [ { "name": "fakecrack", "colour": "#E25CDD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-wesoft2023", "colour": "#443768", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674747408, "uuid": "8b58b12d-aefa-4306-982c-7dea9afabe1f", "value": "T17E95338250D90DD0A6D63B3542FC01B1EB3D3B19EDE2D0ECB89F0486DF57EA2652E1A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674747408, "uuid": "58c53369-d4a2-49d5-9409-505637298a14", "value": "49152:Y6TgNQOZsTulJJhsVaBAt0mXa1sJd4/EvKWrzlDEDa8EmOiU:eCOZsTulJNBq0RsHQEyWxEDazmOiU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674747408, "uuid": "732ea0e5-d0b6-48f0-bbb7-b6945b994b16", "value": 1998318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674747408, "uuid": "cffbbe96-e2a6-4e23-8cb9-97905aa2f494", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674747408, "uuid": "34b3d79b-7133-449e-a4cf-5b4c3c0a1e71", "value": "WeSoftApp.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9daec00-9dcf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674775102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775102, "uuid": "8a9dcc8b-161d-49c4-85f4-716c57265495", "comment": "Malware payload", "value": "8dd319ffe1f1650934f444b516c63aae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775102, "uuid": "e6cfd6de-d3c5-4d0e-aaa5-8b2c8dd961c8", "comment": "Malware payload", "value": "ed5225bcf35b63d220552d1a6fb95c9653565dfc4c33b6ee9402390e56db4f9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775102, "uuid": "bad11265-b9b6-44ca-be88-202dd0d49adf", "comment": "Malware payload", "value": "465342ee8febb10afe9124c39e45e5d94e3a00ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775102, "uuid": "b33a307c-7419-4958-8fbc-990e84b7ea32", "comment": "Malware payload", "value": "abc533c2a5957a56a65fcf82ef76b2ab27f728606a80abc907e71a78dab66e71876a2c03a262f7b02260025748b558dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775102, "uuid": "5ac2aebb-381d-4540-a3cb-88faf490154e", "value": "T1477633513FF1C8BCE256213759969F92E2D1DEB30BA0E46B6391C10E2C7A20DC54AE7D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775102, "uuid": "6e73202c-deee-4e47-b9c9-3173e74e5a23", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775102, "uuid": "045e75c8-e515-4623-93d7-040738cb194b", "value": "196608:91Oo8LgLt1w7V2mwE6Bfpr9A4hInOYRVOp55P:3OLkRi56A4hIn/opnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674775102, "uuid": "19c0e4a3-be3d-4d18-a6fa-c46c2be335c5", "value": 7604524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674775102, "uuid": "203d2907-1a13-44cd-b1d3-9171c81327e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775102, "uuid": "71c3f345-7662-4127-a722-5f38e4b65b22", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13351c20-9d86-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1674743469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674743469, "uuid": "caac17ab-910c-475b-b753-2e5ae766c937", "comment": "Malware payload (RemcosRAT)", "value": "1c72fb093ace75fffb093c6541ff4940", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674743469, "uuid": "a21a6bbe-c159-44e1-a504-654de2716367", "comment": "Malware payload (RemcosRAT)", "value": "f00982603a693995cf32649df28ac390ce839638751f04d11517454466061785", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674743469, "uuid": "b92358ea-c0db-4f31-8e01-2e5653c2e006", "comment": "Malware payload (RemcosRAT)", "value": "7034c12131cc2e28fcf9235850a36b08e9983dce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674743469, "uuid": "2f09b52b-e7d1-4aa2-b667-e6e6e24e437c", "comment": "Malware payload (RemcosRAT)", "value": "1b030a53ccff6bf50061f81faa01f9746c476059716beb2436eafa0e09d3dfa801607f41345333d3b010287a26aa3153", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674743469, "uuid": "d78095fe-6a84-4643-acd9-601086ab0b41", "value": "T1A0E1F811E7CC4337EEA647368D6363921A78F351995BCBEE3494620F9D167A80A23B60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674743469, "uuid": "a4d4e96d-6156-4d1b-b7d4-d7eb2d2db558", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674743469, "uuid": "0ebc3e75-4fe9-45f0-9a76-b47a087a77ba", "value": "96:lTlsnKYgr+QLZCMqm18WQ2juY+wq+Df/8tEkajtR/zNt:lpQELZCMqmXjuZ+z8zaj7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674743469, "uuid": "b5243305-6f85-4c22-a045-6974c5d18a36", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674743469, "uuid": "8b876787-7060-411b-8e6a-60b62a00df79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674743469, "uuid": "39fc79e4-afe4-4efb-9819-b05fa98e77ea", "value": "Purchase Order Inquiry_190123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dde07abe-9d85-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674743379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674743379, "uuid": "0b230be0-5c18-42e8-8975-27c3df351e6f", "comment": "Malware payload (AgentTesla)", "value": "0172e22c44174c1a72395169757359cd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674743379, "uuid": "aa51553e-9445-461b-a642-081cc654c1f2", "comment": "Malware payload (AgentTesla)", "value": "f01102bc0d4dd2e2508bcf195df1e52fe46afeba7b079cd7d9f51007ed9b6141", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674743379, "uuid": "8f54a5a5-3d2a-4a52-a669-92bffac2248e", "comment": "Malware payload (AgentTesla)", "value": "109bb100a50bdfea6f07150241832e0d15dc57aa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674743379, "uuid": "d407da99-6138-4731-9281-785d1385ce46", "comment": "Malware payload (AgentTesla)", "value": "4b46bc6bd42eb2b637b51027d2c033db03273417e55910c23d33ee697acaf83bc6d404b2f7e99f0e5df8c45916df3bf3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674743379, "uuid": "6bfbe183-c1db-47ed-bc50-a3490a47642b", "value": "T1CD93F75573FC461BF3BF06B87A7518640EBAF91BA522D7582D9D20CE0A227C08B5137B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674743379, "uuid": "4ad1910f-e72b-4d7e-92f2-36489fe45a88", "value": "1536:JhkXYQqraJZMrFSq06312wR7JEuaXKNVcb5uXlWoaPbZVWZvwgET5N6Zm:oYQqraJZMrFf0+R7yueisgkoaP1VYxEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674743379, "uuid": "51068e02-3e7d-4610-af59-47f851179a19", "value": 93184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674743379, "uuid": "fdf0355b-f98c-4143-9388-44d7cc0efe60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674743379, "uuid": "dd8d53af-fdca-423b-b7e6-d4007fdba1a8", "value": "Bank TT request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bd6fe7d-9d62-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1674728075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674728075, "uuid": "a0e53653-3af9-4e66-8d3f-2ede7c9d099a", "comment": "Malware payload (Mirai)", "value": "7daa804d64555cf73cb35eb7b3e5e964", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674728075, "uuid": "7e7c6cd6-7fd3-401f-8b5c-886fded7830c", "comment": "Malware payload (Mirai)", "value": "f0180e250a6a0537755642c0176be6e4255feefdb75db645a02fa11d43bb6d2b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674728075, "uuid": "365e89ff-d4c0-4d1a-a10f-4410bf4e6207", "comment": "Malware payload (Mirai)", "value": "9b682dfe1b64c264785370af0cfcd237a92fb4e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674728075, "uuid": "7f94f694-74d3-492c-9a59-e360c705b975", "comment": "Malware payload (Mirai)", "value": "a41693c9c7ff1a31e4f642508e8a2b6f4feb6ae4d9ee831191ab4c9966135d0b625cd622e727b35e683df8abed0c8855", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674728075, "uuid": "471e0297-99ac-44bf-b8af-6e9c816ea397", "value": "T1C3E2F192B21D60F2D0F11075EA34434B147B61D3E3E7A3F6676A022DAAE41D624FC55F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674728075, "uuid": "b626024a-491f-431b-8379-f37401231357", "value": "768:EhGse5mHrDvrEQbzc+pwpmTBz0Bcgi8kslOgzzKo3UQ:yGse5krJbz7pwuh0Bcgi8kslO6WK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674728075, "uuid": "f8fbd8cc-43f9-4cca-baa8-1b4e1a8e0622", "value": 33436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674728075, "uuid": "e554d552-92e2-4ffb-8859-f2c53a45f741", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674728075, "uuid": "108de45e-8d0e-4441-8f2a-25a057a66d10", "value": "7daa804d64555cf73cb35eb7b3e5e964", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0398f67d-9dd1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674775655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775655, "uuid": "42233bc3-bd38-4746-a1b2-1da734a504ed", "comment": "Malware payload", "value": "de86964021b4feb3f8cb2ec5cc885367", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775655, "uuid": "71674124-115d-4def-9e85-53be620f8b2a", "comment": "Malware payload", "value": "f170ba9478114fa360d41b803180a297c8338cebe1d0920ea0fedc5a493c3370", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775655, "uuid": "06735cfd-1031-4c93-8473-a262351eb2ab", "comment": "Malware payload", "value": "c8f91ec7cb62549698198bd7f1634d945442ccd3", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775655, "uuid": "601f5e7c-26ed-4823-a3a2-b21909661739", "comment": "Malware payload", "value": "e3faa9b3c38c7aae44c2c19b148c693849177e46b8fa76fa43a104d7792ed4fca193dcefa3a0a1ba953dbf9d047d7fc1", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775655, "uuid": "ae764db7-6607-47b0-ac99-4a7248540905", "value": "T1E0E0ABB61A514C4A91B082BC7885B19CA4C7D08957CB4E10B1CD7E272D9039BB8E3188", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775655, "uuid": "2651b088-63a5-48c2-8203-789d97f80520", "value": "6:h4QzhqIKAEtaMABuVzYkx1fAbplgCMLKT62J8E9xETLt7gErzWh0Mw8YXcVCObq2:hPEhkacFVZELt7eLfYXcVxbqXrFMqGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674775655, "uuid": "f06ffff9-ca39-452e-a600-655f8f05e22c", "value": 423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674775655, "uuid": "c259f419-0c68-40f3-8476-55d5c3c59759", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775655, "uuid": "1070c98c-f918-46a2-8245-6291648352ce", "value": "Payment Remittance Advice.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b121eba-9d2a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674703941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674703941, "uuid": "4274fd56-6277-49ca-8485-29522e63289f", "comment": "Malware payload (Smoke Loader)", "value": "b6354146b75adec1fae37297423303d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674703941, "uuid": "c1ecc7ec-1e67-41d4-8f78-b21fb0a2a2c3", "comment": "Malware payload (Smoke Loader)", "value": "f2f27d74ef6d916e4523b4c8ec2d0cc7cf5ca534360c09f8da0e937ae38142a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674703941, "uuid": "a87b3b25-22c5-4dfb-8258-3bbff067aa73", "comment": "Malware payload (Smoke Loader)", "value": "35e271e7b739d298de89d5ea95dbbcf1aacc86ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674703941, "uuid": "c7e7f054-7b6f-4db7-b5b1-6b225b91ccd0", "comment": "Malware payload (Smoke Loader)", "value": "2cc0df67b9633babdf39b41dd8a38e08166f4f5557ce72ec5e4ab7460626867e9889a9c9c686e2336ff2e488dc919cdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674703941, "uuid": "c6e2361a-22fd-4d07-a757-a2c660364c68", "value": "T12164AF1276D0B850F91A4A75CD2ADBD4392EB8D28F3C735732DCA61F29B32E0C572A15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674703941, "uuid": "0504a719-6d10-4ddc-b9c8-9edfa34d0bdd", "value": "e5f35c047e0fdde323b83e51e689dfb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674703941, "uuid": "1e510e17-24f5-4c3d-9a79-9d10e34e7e69", "value": "6144:O6LjDXlRhy0RRA2sirshnqXhDY0+MOKXMPOUT:O6r1RhLAniz0WQ2UT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674703941, "uuid": "54d59263-282b-4a66-8800-1b6b6a6ad677", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674703941, "uuid": "559245ed-54e4-4dbd-9881-a3d4308ad49c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674703941, "uuid": "4c7d9fd1-be1e-421d-94f0-a323617db17b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50469fc-9d3f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1674713300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713300, "uuid": "c99cf757-3c4f-4252-8076-cba7a3cb7c72", "comment": "Malware payload (Gafgyt)", "value": "6e5cf6d4af23b65394bff38e3f0aa759", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713300, "uuid": "1fbc9be9-8069-4a34-bdf0-66bb2e08ec44", "comment": "Malware payload (Gafgyt)", "value": "f310c291a6ed50c8b79a2cffedffa3da388e3ccdd8995d1deff49ec7d64044b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713300, "uuid": "6d5dde31-ed00-4ae3-80c9-31e95f257026", "comment": "Malware payload (Gafgyt)", "value": "70544ddc516af787ccb3c1d0068b2822e63357a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674713300, "uuid": "f773dee7-b896-417f-b991-a1e665804f3a", "comment": "Malware payload (Gafgyt)", "value": "26790f810963c45574cc74f0805b3f84df76f2cf44c61b6ff18ac348ee54b07ea5d2dff0c9739da38b927276b2e1e125", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674713300, "uuid": "8a03fd8b-ea10-419f-af68-535846c7fe4f", "value": "T16604F703D5114A56D29706F2729A2248BB1313BBC7DB3353F9285EB0BFC1A5B197ADE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674713300, "uuid": "bce2d85a-79d3-429a-8e0d-b6483de41723", "value": "3072:tVdtcudwa8uEupTquA0IBqN2i/EFxmAQ9AIXAU8:tv2udwa8uEAIBa9/YxmAQ9AOAU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674713300, "uuid": "e3f36778-296a-40c0-b596-e16625b611c2", "value": 181183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674713300, "uuid": "57f9f42b-b57d-4637-b66d-afec54091ebe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674713300, "uuid": "a950a9f6-4f72-4aa5-977c-e42682228716", "value": "6e5cf6d4af23b65394bff38e3f0aa759", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eba9b0f-9d6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674732294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674732294, "uuid": "07767c70-1d4d-4f2e-9dd2-3af7529aaa6b", "comment": "Malware payload (Smoke Loader)", "value": "7961d2f393fbc2f1fa49db7410feaa21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674732294, "uuid": "98ad27a9-ad0a-48c0-9006-9e3fd1a5dceb", "comment": "Malware payload (Smoke Loader)", "value": "f324dc7c64fe70aec3b7dceee239f681b07fcbbe59ea00ee8946b3a922107853", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674732294, "uuid": "0f803e7f-265a-4e34-a782-101b4a2200d8", "comment": "Malware payload (Smoke Loader)", "value": "d7b1b94ee117bf2a4be1f3b6044fde46d175d27e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674732294, "uuid": "e643524a-3480-461f-b258-6725177111d4", "comment": "Malware payload (Smoke Loader)", "value": "887bf14cfad069e4f6a01952e44cc554b1c38d3edfab5268a133be8aeb91971a782ff298796e64b32637cf51eebaecaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674732294, "uuid": "2c5ec1b3-3f7b-450f-ba35-efe2b8e54a2c", "value": "T1B314E03235E1C0B2C6A744B45C25DBD16F7AB93205B5489BB7580ABE1F302D4A7EA30F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674732294, "uuid": "467d52c5-c179-4595-91cb-3329a06f0af7", "value": "76acbc9b0e9b8516eed30a33559882bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674732294, "uuid": "bcf69e36-faa0-44e0-a267-aad35cf85d40", "value": "3072:CBN2KR2eVL9gdC95I1oJ/ZnJ1XjVIQPndHDssQSq:2XLGdCHFP1RIQNsV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674732294, "uuid": "c091e697-0333-4964-9924-009ee5cb8326", "value": 206336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674732294, "uuid": "279ae47c-2e03-494b-9599-f35b75c8acc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674732294, "uuid": "58f1d379-e8cc-4289-9e3c-a8e6c8888901", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5154204-9da2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674755820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674755820, "uuid": "032535b2-143b-4580-a6c1-431a2cb40cec", "comment": "Malware payload (Smoke Loader)", "value": "b230ff1fafc76346c62e5fd8e0cbd428", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674755820, "uuid": "8a8635f7-e11e-4d7e-95de-47e45954a44d", "comment": "Malware payload (Smoke Loader)", "value": "f3c85b3549f7fe2b6018dd8a7e81f019f6b91372603fdc5c257601c7143521f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674755820, "uuid": "c1129caa-6f2c-4300-9179-13244149b5cc", "comment": "Malware payload (Smoke Loader)", "value": "f5d3be72e411674e9b802bfc18484e7f4cfa8bb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674755820, "uuid": "2bde3f56-af2a-4333-a938-407ba32f11bb", "comment": "Malware payload (Smoke Loader)", "value": "ee7d733b649da4e8155d6efe1212f05081270b4bf2648adc5e442c726511001b2b99bf4c48e24d34c94c687819881723", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674755820, "uuid": "39f744fa-bbe5-4e49-b4df-4669a279bb01", "value": "T14114E1227880C472C5A601305C64D7EDBB7FB9F316A8A48BB7581AAE5F313D1273635B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674755820, "uuid": "09f5dc87-7688-48ec-9df2-841ae1e52b6b", "value": "4dfa6309511cb75d1093a1ac55cf0bae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674755820, "uuid": "82eb5e7c-0727-49a7-ae82-36f1d3cfb807", "value": "3072:9BN2uIN/w/LbWorCfufv57VKcDra61aBgVnJYDnzdbP+iac:DkALbMfufFfa611nJczdbP+iac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674755820, "uuid": "c34a92ec-1f29-4975-a5a3-b36e8151cb53", "value": 204288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674755820, "uuid": "0360d978-f425-41dc-b104-cd0a29b04a03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674755820, "uuid": "00a4bcae-5c30-4891-9eba-b8dcafa2faa6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2595f1a3-9d80-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1674740923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740923, "uuid": "51f5712e-3489-4f20-9b0a-1433a0dd6259", "comment": "Malware payload (AveMariaRAT)", "value": "c5559921fdf3950c63cba88ca2efd7e2", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740923, "uuid": "3bfe64ad-cc60-4a26-8761-2a2dae5e7468", "comment": "Malware payload (AveMariaRAT)", "value": "f520f6f73efb0658ac2ee9c61cff3bc8d95f2ab0853ef6bee3edbdfb3db7d3fc", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740923, "uuid": "8a429e70-68ec-430e-885d-87ef0e49b1a1", "comment": "Malware payload (AveMariaRAT)", "value": "4a58b42c2a82ff43d42eedc93becf741f4017c33", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740923, "uuid": "ee9d6b48-ea99-4f10-bf1a-f70758245547", "comment": "Malware payload (AveMariaRAT)", "value": "2546183a26a583aa7a4eae5520590854cd92a70d484a3621cec1b5dd78cd05f6fbf75512aa444c58ff599c2f9b2138ed", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740923, "uuid": "7f7057b8-2dc6-48b9-9d01-f4ea8c643886", "value": "T124C4F20B4AC36FB2C9788D75E3A924E847F0572B5416FB676DC802F5CEC9B4E26011E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740923, "uuid": "ce9f459e-88a9-4b46-b7da-a6425edc26a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740923, "uuid": "a9f5b7e4-b9a5-4a67-8041-98ae4a98c0ab", "value": "12288:CMjmOVDf3DES1C0MYE1/8GIG++F5IBRKYWTHK:CMlD9CIEGG+Ruq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674740923, "uuid": "83ab7c8d-51d3-4d80-a7ae-b876e2eea7ff", "value": 594944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674740923, "uuid": "dadd8b5b-603f-40d6-a17e-5e7ae6f5c018", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740923, "uuid": "b693962d-045b-430c-aa98-1df04206ed74", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "260772dd-9d80-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1674740923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740923, "uuid": "318ac9d6-51df-4120-af7c-eea057ec22ee", "comment": "Malware payload (SnakeKeylogger)", "value": "3f225419abcf7d05ce5a8c04eaae2b5f", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740923, "uuid": "f62c0413-082d-44d3-82e8-fe5b54a8aa8c", "comment": "Malware payload (SnakeKeylogger)", "value": "f523562a67bc90b2cde0013d43272d25b18c179dabd6ac64c281147bce7d93d1", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740923, "uuid": "68779de6-1221-4013-b57d-3e84b2e78ec0", "comment": "Malware payload (SnakeKeylogger)", "value": "e6aec185e6a0a7a986f35472472d81396cc3c275", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674740923, "uuid": "b7514409-26c5-4b1b-bfe0-d8e8d17b1a0d", "comment": "Malware payload (SnakeKeylogger)", "value": "be2d4edb0bb31a646b6fa515cd686e9bfdaf7efcefb152d94b6d9518dffd24b566c874b2beafb423cbf68ee0135d20dd", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740923, "uuid": "68530334-f756-4438-a78d-ddf9a7a99438", "value": "T1A5257B1437E9CE42F96A063682745E5063B23C69A42ED3495ED071EF1EFFB0C7E01A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740923, "uuid": "6676ba9d-e341-4815-a35e-16fbefb984b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740923, "uuid": "2c7dc615-4dfe-4590-9ea6-87cd22dce4fc", "value": "12288:ItG7vV5zxPCRgjb/oWDXDKFqIGB4nqU4/WPiLcjwt1TMzTV0VXzeyR1t4S0PTsJ3:wRGCqVWalpqSVXz14hPwRBo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674740923, "uuid": "95f18028-49f7-474e-bd84-cb92d0ad592a", "value": 1050624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674740923, "uuid": "41b02a80-c824-4516-a5cb-298e378b35c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674740923, "uuid": "e8cea867-8419-4388-a805-123324c82a43", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36054c8c-9d4d-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1674719046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719046, "uuid": "33259609-bc72-455c-b010-d8958d0454a5", "comment": "Malware payload (SnakeKeylogger)", "value": "3624095ab26bd8a117c70e7aa239a22b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719046, "uuid": "8415f7c4-1ea3-4932-bafa-adf7dab17176", "comment": "Malware payload (SnakeKeylogger)", "value": "f635e3920cddccde1c4981c0a4a79332c108c1249ad34421dc54d9c30a94d1a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719046, "uuid": "f935cfb2-0c27-4105-95ba-79b19a89cf16", "comment": "Malware payload (SnakeKeylogger)", "value": "870d2c4d3358364a4a1833ca459a5ee768d9202f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719046, "uuid": "49fd8f3b-6fa8-42c9-8b50-c33286d5a295", "comment": "Malware payload (SnakeKeylogger)", "value": "81e166c0396dc1e08f7007f24e63cbd75abb70d6f96943e1e220ba7b7d51fb753110435a086f39e7bf699e1e5b2b611f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719046, "uuid": "fac898c6-0239-42c9-8ce8-f2b42433915a", "value": "T131D49D1023E89F44F6BE4BB896B9405213B7BC837573E25D8ED120DE4EB2B04AB45767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719046, "uuid": "9d27ec07-e480-44ca-8898-118ea8eb235a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719046, "uuid": "54d8016d-7441-4b87-a41f-3e173816495c", "value": "12288:iSkOvbnR8ey/ZhEXDCzFqIGz+2//MW5qroz031DXuyEZ2AWdXwYr:MvZXGz+5W5qwa161Z2A2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674719046, "uuid": "fc0d4cde-1f66-4bf3-bd99-c60e2d14c1c0", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674719046, "uuid": "7eb7bf2b-2eef-479d-86b4-d6fa00e83cfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719046, "uuid": "ed08bbc8-298d-4353-9fdc-91d3fb6e4184", "value": "3624095ab26bd8a117c70e7aa239a22b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7851124-9d57-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1674723612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674723612, "uuid": "1571b0d6-84b3-472d-be4b-28dc2008307b", "comment": "Malware payload (GCleaner)", "value": "e78ffdf58d7cdc21d8ad9dee0f28c109", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674723612, "uuid": "8380f0a2-2b4e-46d9-ba22-21f246be29a9", "comment": "Malware payload (GCleaner)", "value": "f6406b411a8f0497069f90c5cb99c6cdb91d5c4de27dbe2be92f492779ad0ec1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674723612, "uuid": "093682ac-5c53-4035-8d21-f3470e8aca07", "comment": "Malware payload (GCleaner)", "value": "123ccb417e1ea83837d7f235a12c8ff80b51acd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674723612, "uuid": "97c205d5-967b-451b-bd76-edf36c276d5e", "comment": "Malware payload (GCleaner)", "value": "fed04c7bbb9bb394d1be887fdd90eebedf780360e5a4bc52b47c0a61d36825035b0fe870ffffcafa79dd1d720ae7569b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674723612, "uuid": "4f8a7018-b035-4659-810b-dee3aa5e6b1e", "value": "T1CA95234FA49284BEE96186B71B305040EB73FFCA243C1411314A26EE3F996716EB7B75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674723612, "uuid": "da93859b-fa7a-4051-a625-c1b8abaab486", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674723612, "uuid": "4763c9cf-aacc-459e-8f10-aea3a933a1e1", "value": "49152:okug+BgJwS2rht0X/BYeVeklvFJ2W5A7aPhVQ2liLCgv2MR:hug+bS2rhOieVekbkWMaQ2Kv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674723612, "uuid": "01e3a842-daf8-41e2-bff1-273b7d02c914", "value": 1911196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674723612, "uuid": "98e53fdd-d693-4a72-80f3-690136246b9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674723612, "uuid": "d5d8222f-8233-45b6-8621-c254c7587e4e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c152572c-9db7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674764806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674764806, "uuid": "cf812288-932e-4d37-bf8e-7206d3fa081b", "comment": "Malware payload (Smoke Loader)", "value": "ba08608b0b6ab693ac0835fafd010078", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674764806, "uuid": "4479195f-ca51-4a0d-8fa7-34137bf4718e", "comment": "Malware payload (Smoke Loader)", "value": "f676c74b915d273ddd9f51f8748ebb6731c2193905191d268996b2e09d748169", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674764806, "uuid": "801ea418-a1e2-443c-8cef-260fef820a44", "comment": "Malware payload (Smoke Loader)", "value": "407d4bac48dde055b18d556635dae94691872653", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674764806, "uuid": "17958bd2-7a2b-41a1-8422-f2910735eb46", "comment": "Malware payload (Smoke Loader)", "value": "72fe26bbf4236da410c99888a9dcd6b9f192b6994f9ee99936b5da3c1bbba05d93d49a90ca4c924380e37e61bfb19832", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674764806, "uuid": "d1cc91bc-132e-4e7b-b71e-660a86c92293", "value": "T15414E0217180E473C3921534583CD7916ABAB97217A8984777941AAE5F702E22B3E3BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674764806, "uuid": "0debbfc7-4605-420a-9472-1a881350cd47", "value": "f698356339eeb1f50ceb8d08cc5c7335", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674764806, "uuid": "7d5409c9-23e0-42dc-86f4-a7cec4b4d7a8", "value": "3072:nBN28GPeJALyRW0oa6g5z9tE320Ivcb79XvUiiv:BH2LyXoa60tE3200cP9ciiv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674764806, "uuid": "0281f2d1-962b-4d44-ae25-ac36728b62ae", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674764806, "uuid": "bf75e4fe-b3a8-4c5e-943b-0018b0d51345", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674764806, "uuid": "869f18a7-c5c0-4156-a887-e212a9ed039d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36e35793-9d4d-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1674719047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719047, "uuid": "d92c2888-00f6-4f65-ba05-9eeadbbca78b", "comment": "Malware payload (SnakeKeylogger)", "value": "3aabbbed7dd5e3589f2387ec1a62471f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719047, "uuid": "ebd92490-40eb-49c1-bb62-bfc7a2ddac2a", "comment": "Malware payload (SnakeKeylogger)", "value": "f6ad2dbda673f9af7b3d50ecd431d7858aa6b96a381a71cd0a5518e0c5ca6491", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719047, "uuid": "d0cb9091-bbf4-433c-bbb6-597672ce65d3", "comment": "Malware payload (SnakeKeylogger)", "value": "067d84bef48f6abc37226c6ccb981d21f7c8b93f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719047, "uuid": "b550134d-92e6-4430-95fd-9d2172d089ef", "comment": "Malware payload (SnakeKeylogger)", "value": "a9cce315edfbd87f40e8bc1687fdbd03aac6707e8b99f0b409904283e692605c20e83a3d56abaa4e7415b6ecaf2027e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719047, "uuid": "35b0f728-4fa5-4173-b5c5-720588373bba", "value": "T16AD48D5023EC9F40F6BE4B7886B9509113B7BC967673E21D8EC120DE4EB2B10AB45767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719047, "uuid": "9f7fdd67-3c36-4114-a2da-2b249b4252f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719047, "uuid": "908ab1da-4666-4828-b74d-61e21b80df76", "value": "12288:8SkOvbnR8ey/ZhNCXDnzFqIGQv+fCaulZJ1DbtmHrfm9e3Cs3TUruVjoB8:GvNsXGQv+fCjd5mHrfmvnruVjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674719047, "uuid": "2f3c0e22-25b5-4e35-bb20-e6e8b3561f7c", "value": 637952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674719047, "uuid": "a76eea61-ac2a-4ed3-bdb0-eb6b985fc5c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719047, "uuid": "74171af3-9943-4ba3-80cb-44ced588cccb", "value": "Order confirmation 223321.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "375cc485-9d49-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674717330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717330, "uuid": "6cbaabb6-2d91-4ebf-b59c-e852e0c4b6de", "comment": "Malware payload", "value": "9de6551aaa49e35f4b1384eef8b552f4", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717330, "uuid": "5c56fe47-9121-4682-be85-f5583f6b0e70", "comment": "Malware payload", "value": "f78cd843f114b2d52912e3b6f888d061959ff4b0ee3c1588a62a67a5b37d8581", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717330, "uuid": "9e94891b-ff24-42a0-a34a-318b163f65c0", "comment": "Malware payload", "value": "8e97d464013ac1633782444c271e5bd4ef1f7634", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717330, "uuid": "cec2e676-67a7-4a92-a607-7a0591587e16", "comment": "Malware payload", "value": "21f63a041fb501c64f53ea0f45c82654dce978c5d865e2fdd6f3d44fd93f134c07c662a90dfda2ce01eb8f3d2eae34bf", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717330, "uuid": "fea27b95-7793-41ac-b51a-0883affda4e2", "value": "T1F2614C694088385BC13FEDB90FA7DF93F01C80A31806D219EE93E28326D8E824954CCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717330, "uuid": "d3b5af3e-2201-49ae-9bf2-5ab8bb09ad5e", "value": "96:YUuYX4gwpVVfZn0PORZkS37Q+gZIFjqRjgkQ/:yYIgwpVHn0WPka75vAG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674717330, "uuid": "3d23f43d-0ac3-4d6f-af1f-445d46db52ff", "value": 3212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674717330, "uuid": "90153e4e-a10b-437e-8469-4d582563358f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717330, "uuid": "bfce6108-93da-416c-9880-003e9c45f612", "value": "10093948585994_pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdaf4f88-9d3b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674711542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674711542, "uuid": "f6c8ed45-b31d-4212-8120-e315268a00d5", "comment": "Malware payload (Smoke Loader)", "value": "fed791897b95804458e9b182662d85a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674711542, "uuid": "44e6aaae-f1fb-47a6-aa42-c6d9eb5b013b", "comment": "Malware payload (Smoke Loader)", "value": "f7e52a4d54c46e6147d9dd65be10784891d8492b063fd5352cf878d92b7cbb85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674711542, "uuid": "562d8dd2-e3b5-4efb-93fa-16688c3a372f", "comment": "Malware payload (Smoke Loader)", "value": "1ab286fc42686aa111536ab4c4adaa1227e6114b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674711542, "uuid": "77a21ac0-19ef-4640-878b-b8974063f93d", "comment": "Malware payload (Smoke Loader)", "value": "7bfa9f0c63eb73568ee621817511fa0b8ae72e1ccf0fb95d86e2c656bb0230df020e2c9d015c4605f64a248436f1ea10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674711542, "uuid": "19f1ca60-4b04-4156-ba7e-9b9166b8279f", "value": "T12E14D02176A0C072C46744342868DAC17FBABD3256A9CC8B37A43FAE5F706D1572B397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674711542, "uuid": "12d81c94-7ba1-4226-b5c1-c5aef4c5d2ae", "value": "2fb86d3afd3014d2e2e15a2dd2f620c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674711542, "uuid": "90260d42-877f-4714-8fbf-b814c4d984aa", "value": "3072:MBN2afVfLBE6j955WayZWFFu4yEBF0yoWd47t375bqe3g2:EjLa6j9HyZWVBF0yoWG7tr5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674711542, "uuid": "a148a5cc-3772-4e24-969d-7a2713d0b3e3", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674711542, "uuid": "04a1c6df-889d-4a33-8af7-b6c170ed6961", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674711542, "uuid": "fcdb53e8-9151-4717-a71e-caa81d676e7d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "046c81e2-9dd1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674775656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775656, "uuid": "2a7156ec-b3f5-444c-9001-0a2b13024747", "comment": "Malware payload", "value": "b85d1ef31cf3e7c6e0d663c9a3898d05", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775656, "uuid": "cd659c94-16b9-4809-9eaf-427c979b07db", "comment": "Malware payload", "value": "f8cf603c3feaf9f146d842371878348462f5a51eb74136b2c33a157bb6075063", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775656, "uuid": "b16c431f-64c5-42e8-857e-dbf4c6c61017", "comment": "Malware payload", "value": "216932fffc8a46a5d4bea622367e812c5dd66898", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674775656, "uuid": "466e1159-7dc8-419c-8426-9bd3a1dbe981", "comment": "Malware payload", "value": "bb317c15e2203ac3de8ecbeadb20966b298066387d0715bfa1454fabd65c04c834382a90151321252cc7248f1a6295a4", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775656, "uuid": "019a82a4-b908-4780-9a44-2fde6c981e4a", "value": "T13683AFB8D45A3D825DA25EA5F05603084CDAA8C3CE86FC94F1BD8875179BF1474A33AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775656, "uuid": "f4993781-9d6a-4d1b-8ac7-85e97c20b9a2", "value": "1536:63Y1Hp/gXJ5INUWgh+Ff8CrhL+9HzbyMZA2Xh:64kJ5EgmHrhKV2M3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674775656, "uuid": "d62562a7-875d-43b7-aef8-f0c0d9a85630", "value": 86761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674775656, "uuid": "dbe162a5-d3c8-4343-82cd-872c134c5de4", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674775656, "uuid": "99846654-68e9-4d9e-94f8-750088e11186", "value": "phish.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64a66166-9d84-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674742746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742746, "uuid": "d9e0a72a-67dc-486f-aebb-348552742f7e", "comment": "Malware payload (AgentTesla)", "value": "d33affc3b064b1e397901a71d971dcd4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742746, "uuid": "6bcc6dc9-354a-47fe-8bf9-947ddb03683b", "comment": "Malware payload (AgentTesla)", "value": "f8fa4a68488cfbb2c7130ee2637393f65e6a2585bf9171bcda0f0f7a7e4cffb6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742746, "uuid": "ebcac75f-5188-4a43-94ac-b34fb9ef6733", "comment": "Malware payload (AgentTesla)", "value": "c64f178ce1955b37ce8f2bc6490897b7616d403e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674742746, "uuid": "3fc99ab0-54ab-44c8-aef9-8a3fb86cefad", "comment": "Malware payload (AgentTesla)", "value": "f97e5fd65af56b4a6ee8b91672676fa5f8cae9cde1b061859a4783caa3a38bececa7b42e46e96b880c7dd9bdb4424294", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742746, "uuid": "584975ef-0f5f-41ec-94ec-4b005c8f541a", "value": "T1EBE49E5023EC9F44F6B947B886B9505207B7BC927632E21D8ED130DE4EB2B10EB45B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742746, "uuid": "0dbc0851-4580-4dde-a1f9-4b03c1dc3193", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742746, "uuid": "9e651786-dead-40a1-ac08-e76bff25452c", "value": "12288:hSkOvbnR8ey/ZhBsXDQzFqIG2HBagAaIduRSRQstW3GE4fBDU11Ib:NvBNXG2H1IM8+sW11Ib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674742746, "uuid": "9bb56113-4eb8-4264-82e4-094335626367", "value": 680960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674742746, "uuid": "f0e1a0a7-e6d9-4012-88e5-cfde33cd698d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674742746, "uuid": "44094def-8f39-4698-b043-17680ebcfaba", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f15ea94-9d4d-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1674719061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719061, "uuid": "4d9c82c7-79d1-4d28-90c6-8c631b3a9581", "comment": "Malware payload (SnakeKeylogger)", "value": "3012ead88bb446b410086c5240e44d5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719061, "uuid": "b014783c-53b8-4b2e-911e-edeb583cac27", "comment": "Malware payload (SnakeKeylogger)", "value": "f9c212cb52c220cb7ec19f77cfbe4b80c4cf2536507be9c6f86830d34901345b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719061, "uuid": "123cc987-6cdb-4d66-85cf-b8ae4f941eb3", "comment": "Malware payload (SnakeKeylogger)", "value": "ba1ffcf1c8993656d787c1a1be070be46af7f980", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674719061, "uuid": "8b9a4e7d-917a-4cc3-a5d3-3674bb1eca53", "comment": "Malware payload (SnakeKeylogger)", "value": "274c459d8bf5d331a543477be6e5f57cc25855fcd9cb33dc835ad284704842859288a5238d8f7129c21dcfe6c9497cd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719061, "uuid": "6a658c2b-da65-4da8-9cc5-2348d3929ae9", "value": "T1C205172C1D7697F2E174F93583D4A0A0BB9F488273A7C9A9D9D62BC05F123826DCE11D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719061, "uuid": "5517fd7e-8ef5-4c13-8e5c-ba447db41c15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719061, "uuid": "c36d9b3c-3f5c-491a-be4b-3680eae85b92", "value": "24576:vT8irmdjXHNOrAe/IuBihmBDCzwrqhTPVcaT5uxzHZL232Nn:ihODewrCPVcEUrdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674719061, "uuid": "57f672fe-c845-4508-9e78-8436ef09c991", "value": 808448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674719061, "uuid": "e0511a15-727c-4374-a530-f89b01dc6bf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674719061, "uuid": "5a368dc8-5b59-41c1-ae48-08bd64faa761", "value": "02602301.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede8dcb8-9d49-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674717636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717636, "uuid": "6290d180-bdfd-47bc-bd3e-5b20601b0148", "comment": "Malware payload (Smoke Loader)", "value": "300f03084232e7f550ca7e5bb6deb4ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717636, "uuid": "9e3b8d29-5e2a-4201-b45f-275f882781bc", "comment": "Malware payload (Smoke Loader)", "value": "f9c3bb321f2cd1046b28b072c474fc17e7c9d53c035c5d1b4049cf1f03c00f92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717636, "uuid": "577bdefc-3816-4655-b9f9-4f3be0c6293e", "comment": "Malware payload (Smoke Loader)", "value": "0ac678ec7a2706c315750c19875618b2e03b2359", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717636, "uuid": "5df3e799-2e57-4458-9cf3-3d81aadbf005", "comment": "Malware payload (Smoke Loader)", "value": "41bf694ebab0fe50c14e5369cebd988c0eb8cd15a0bac1eab7d34d3bcad65bec3e56127c98ad585a7515c1e5b68a8837", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717636, "uuid": "6efc9a43-4ee6-4b7b-91c9-9e98a3f09bca", "value": "T14414E0227690F072C59645304C64EA947FBEBD734BA988CB77981ABE1F307D0562E387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717636, "uuid": "e9c40d81-accc-4db3-ab06-3280c8d68477", "value": "2fb86d3afd3014d2e2e15a2dd2f620c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717636, "uuid": "6fcb0e1b-cadc-46ce-ab6b-cf98e5e1e51f", "value": "3072:oRBN2SIaWLWDsNxs5Hv4cTawg8s/CskOZMia+Nzq:+qLqsNx+raw7sKO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674717636, "uuid": "08affc09-c073-4e20-a356-92f841fa1007", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674717636, "uuid": "b5bcfd01-cf58-4624-ba76-606fad34ee68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717636, "uuid": "f87793df-bc67-43d5-8fcd-b0c67604bc15", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05ed76dc-9dae-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674760626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674760626, "uuid": "43189d09-1a28-4557-96ac-8f14118404f8", "comment": "Malware payload", "value": "9d62eda2d552cb2f7e1564209de10310", "object_relation": "md5", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "bomes.ru", "colour": "#3AD5F4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674760626, "uuid": "ff5cc01c-2013-467c-9e5e-1b29e2a098a8", "comment": "Malware payload", "value": "fa031dbd614e7231d329906a6aefdbeea4c6b2ceee847e909ff66126a370ceaa", "object_relation": "sha256", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "bomes.ru", "colour": "#3AD5F4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674760626, "uuid": "a5ef80b6-6ba8-4172-92c3-3d9820baa0bf", "comment": "Malware payload", "value": "a0a5da7e38bf029ffa91b7b6f16f4da10f2763b0", "object_relation": "sha1", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "bomes.ru", "colour": "#3AD5F4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674760626, "uuid": "f11493b9-b2b4-4a16-888d-e6ede1f8eed0", "comment": "Malware payload", "value": "81250287b931421276279dac057d69022f6ad6701c88223a946ff3e8364eb02089dc57444f952fb8852b6d1e7d99dad5", "object_relation": "sha3-384", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "bomes.ru", "colour": "#3AD5F4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674760626, "uuid": "11330a24-ad14-46ce-a15a-b448380a1b99", "value": "T151D50131E7D0C8B3D4275B785C17A79AA925BF102E24AD876BF41E1C4F35A812C3A19F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674760626, "uuid": "13feaa2f-5b73-4c92-9a80-c3ddb21db2f0", "value": "22445fca902fa02b5fb4e045e1a5ab04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674760626, "uuid": "a279e152-ee2d-4b74-a489-0524aa33acf1", "value": "49152:vfc6jJzftLicMY1xMHeNBHFAJyye2IwF1q9emDAZ:v0617tLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674760626, "uuid": "976cb847-dac4-471c-96f8-5cb4e0474797", "value": 3010048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674760626, "uuid": "1293d97b-8912-46c3-89cb-b902a04e190f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674760626, "uuid": "d68602ca-f434-4638-8965-e9437581381d", "value": "Confirmar Transferencia lista.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5d83064-9d49-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674717542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717542, "uuid": "3597649b-b155-472d-9783-d8b91f4970a0", "comment": "Malware payload", "value": "b68a2f4655014949ef1a04aae5e115a4", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717542, "uuid": "15a9a3d7-6763-4983-b9ba-602edf0d6e46", "comment": "Malware payload", "value": "fa665226fcf35d190f5d52ff268fd6767238ffeb7c533161e163158ccc834b33", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717542, "uuid": "a128ed06-a8a4-4a52-8cc2-6c2209bd4642", "comment": "Malware payload", "value": "0e26dae75c454b9021350097dd9bb75bc2f40607", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674717542, "uuid": "8a23f466-c79b-4b44-ab2a-960546643499", "comment": "Malware payload", "value": "4554557ca7e883bdaaab626ae81f2b3ae51c6fa4981bdf6fb1e6d2c10464eed2be2720e71308e436f4cc8fc1975ac429", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717542, "uuid": "71c6bc53-57e7-4e48-853d-48f5633c440b", "value": "T1F5A4233BE26A9DF31825F4B5C06D46A92CE74C942B394DE0953952B0DBFCDA5F322342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717542, "uuid": "35ba79dd-c1f7-4319-b57e-6b0dc713ac9b", "value": "12288:7lraKwQBeGHwp2YvCx9Fp9iPg/uwd5jiW6YphZnNHE:xm+HMmx9FyJMi8hZn9E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674717542, "uuid": "7f904f12-b8b1-451d-9fc1-0b11d730c9a8", "value": 477768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674717542, "uuid": "1d4d534f-cfcf-4024-ba26-acfaac5006be", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674717542, "uuid": "64b707c6-61cd-48d9-be71-9b8930956060", "value": "bank slip.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72cc6271-9d6d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674732892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674732892, "uuid": "b82fee8f-9f3c-4b8b-a3de-78cd0339a2fd", "comment": "Malware payload", "value": "2a3381847159b72ae7f98e1d8dc5d0de", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674732892, "uuid": "8e18eb18-d28f-4952-a6e1-ecfdda37e5ff", "comment": "Malware payload", "value": "faf099054697cad0976da7005827a50d7a1bf8921aea65f459f8764dbe724fc9", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674732892, "uuid": "83f15574-c336-46c5-b2c6-998cb8c60c5b", "comment": "Malware payload", "value": "e75669f6036d39f74ea6b73e522daf4551325a50", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674732892, "uuid": "ab1853cb-8566-4cb8-8fde-f2633edc1e0b", "comment": "Malware payload", "value": "bf45a10fc25be4a3e6712adc59cfba3c8b9fee7f5a28369ee306d4c828f8c99e47163a4d97142c778a0d9074c3cead74", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674732892, "uuid": "a61ff9b2-b7a4-4718-aa3c-d6351ec806af", "value": "T1F5F5EF37E8E77CD5944C88EE7E083BE4DBE2229495ADE713AFE91844464350728CDCB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674732892, "uuid": "a59cb9e3-4c0c-4392-9113-738674a3ee78", "value": "24576:YnKfoBF0CyMdcdQafO2h4IgGeNtGSxvd7VY/O3vP:EvF0CyMK+af8IglE5/8vP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674732892, "uuid": "5e187242-1b1c-45ed-a70e-9cd55212f704", "value": 3400501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674732892, "uuid": "dbadf2f1-092b-46d3-a578-224ca21ef823", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674732892, "uuid": "d0fdcf68-b4c9-4356-8752-59ffd3e41ef6", "value": "the-new-testament-church-franklin-camp.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e22513c-9d9b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1674752533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752533, "uuid": "80cbdaaa-0b20-4569-b796-e918b6bf5745", "comment": "Malware payload (Rhadamanthys)", "value": "3420308d5256defc14bc70907f991302", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752533, "uuid": "c6631f67-ba1b-47b8-bf71-a6f3f4a99901", "comment": "Malware payload (Rhadamanthys)", "value": "fb529c3191fceef49fda9225104b75086d089df2a7ce544642a45bbe74e11e26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752533, "uuid": "cc61d9e1-1158-43fa-b261-1ca7d827af85", "comment": "Malware payload (Rhadamanthys)", "value": "e70504db0603e7744ec0b0e88a9ae3bfde2a1f6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674752533, "uuid": "4ae57d7a-3530-41d3-8625-629e526bd2ea", "comment": "Malware payload (Rhadamanthys)", "value": "d1cd376df76f0a38aff459105eba4d84e588ba6a9987c39f4d853fa2b9da5c413b3ab4b8def50cb051dd58b590dc579a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752533, "uuid": "3e44ad02-29a9-4ed0-bf49-3184021aab8d", "value": "T1D914E0113590C072C1A601B55C38CBE16A7EA9F2CABD589B7B991B7F4F702D1633A34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752533, "uuid": "f1db3fa9-06f0-4b51-9f4b-8f0a63e799d7", "value": "3441d27f999e45e989c5f0204be01528", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752533, "uuid": "c4772609-97a3-4e5c-a1fb-0f221ed74941", "value": "3072:3BN2VC0UzpLQT8vsn+M5iXvMy9apXF04dMcCuGCB+1HQKDDXNQq9D:RZtLQEsn+Nnac4B1/E1wKjNQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674752533, "uuid": "61883ac0-15bc-44b3-b077-5f20dd3cd37d", "value": 203776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674752533, "uuid": "6524d886-2425-4756-af95-88a4b419f66a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674752533, "uuid": "2eed89de-4ed1-4003-b5c0-3bd07b41af81", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b120125-9d86-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1674743562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674743562, "uuid": "4a03de75-2e03-4e58-99ad-22da9378673e", "comment": "Malware payload", "value": "1a9fc43e49a403d8ebec004626492384", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674743562, "uuid": "99def898-d5e3-459c-a21d-540e5fbd486c", "comment": "Malware payload", "value": "fb8fdb08cf7984a3bac0cc7daeea3790a92306467543cf556945fc479a165dd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674743562, "uuid": "dc96df13-140b-42c4-b8e5-98d560af0480", "comment": "Malware payload", "value": "4b99953586f19060824c491dabea6ef8ab329188", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674743562, "uuid": "395fc627-36a4-4be4-8d70-6f6633abcba1", "comment": "Malware payload", "value": "d7ae0a2be24a804fb3a94d46fc32d9aa234a2ec752e3272637b857e123f32a112ea65984b5134869ec96105f7d821a1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674743562, "uuid": "247b195d-6581-456a-961a-90937a0ea82a", "value": "T1A415C6C132E94448F1BE0B75EA735DF10731BE4699B9DA4E099978CE21F37408926B3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674743562, "uuid": "ddf92762-b716-4bf0-8fe0-a8bb93f4c28c", "value": "6144:8Np9UX3HMi9Z5xd94cDy5LooPuYANPcTIDsGYXvWRtq8816SjG2B0xisBdwt99pb:pX7RYY4ogsBCt90tr8BQ8mYEAB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674743562, "uuid": "d35ba270-58da-4212-be56-3337b79ef57c", "value": 905216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674743562, "uuid": "e5f55ce7-f3aa-419d-ac53-3750b04d4ebb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674743562, "uuid": "2a2a8618-0fa9-4e6d-8b59-d912ed2a00f9", "value": "S O A -474-84RNEHDR8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45689a8d-9d87-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674743982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674743982, "uuid": "7be46fa6-a295-41e8-9041-a81711e68077", "comment": "Malware payload (Smoke Loader)", "value": "46157bda96845fc63f26380230a98c0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674743982, "uuid": "c2298f5a-e5d9-47af-800a-d0a785280de9", "comment": "Malware payload (Smoke Loader)", "value": "fba7594bc32b79cfa13997c673f3f70e55ce2300cb3c6173fa1d6ebbfd472fae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674743982, "uuid": "3ca5b768-a077-47d2-91b1-f4208c783884", "comment": "Malware payload (Smoke Loader)", "value": "527111dd814d0f0d459758bad01a8509b32ad8e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674743982, "uuid": "5b5528a0-1077-4392-8128-fd053f09ba94", "comment": "Malware payload (Smoke Loader)", "value": "931580c986227103259a155d56d45682c9ba98ed254e005697d6ce00b22f5e99282ee098538909f312fa17119efafdf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674743982, "uuid": "915492d0-24ae-4c55-9ed7-826e22cd510f", "value": "T12A14E0237590C473C0A614755834FB962F7AB72316E98987BB940AFF0F313E1672635A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674743982, "uuid": "284be049-c799-45ca-bf78-bfcf2452f3f3", "value": "0cf7da7ba6041e7b7038cd2e90d72093", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674743982, "uuid": "bce3ce01-fb52-4dc1-85c1-a077dd465ee3", "value": "3072:qBN2J8XULdwXUXCzRD5+AvjsLg1bhh87PgqwOB5:+qLdIWCzRPjTbE7PPwM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674743982, "uuid": "736c055b-5693-4e90-b1cd-94ecd2fdcb2f", "value": 204288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674743982, "uuid": "94214948-b552-4021-850e-67721cc93aac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674743982, "uuid": "09ca24bf-9f8f-41e9-9279-bfd2a690e1ce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6853158-9d51-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1674721006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674721006, "uuid": "6ae6544b-94c8-4b37-933c-4494f446f727", "comment": "Malware payload (Rhadamanthys)", "value": "8c6334431d3b48e23a60751cba829ca8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674721006, "uuid": "9ca8f476-f873-4756-98b3-4a0c5dc7a4a1", "comment": "Malware payload (Rhadamanthys)", "value": "fcf22373d82254cac6b8c3d10a5568f79f0c53454ce600499b433627480b90b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674721006, "uuid": "d424e0f3-d442-40c2-9ae8-f1da314fe59e", "comment": "Malware payload (Rhadamanthys)", "value": "2c3e893e36f90d0e7def30749391d36c74e9d139", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674721006, "uuid": "9b40e74a-6c23-484d-968f-726669b6803d", "comment": "Malware payload (Rhadamanthys)", "value": "68117d7bb21bdf00d99e4b0ab02c40a79c65be1601e5fd43d1629d9a2b1c900395f25ec4b202c1802e05dbddae02c98b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674721006, "uuid": "85a7badd-a5fd-4965-887d-e631fc77592e", "value": "T16814E121BAB0C032C45706781831DA917F7BB97307BD884B7B981EBE5F706D16626397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674721006, "uuid": "414e4b45-d727-4b19-abe0-59a94bac88cf", "value": "2fb86d3afd3014d2e2e15a2dd2f620c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674721006, "uuid": "ca31760a-c2a5-40bc-9202-d2cb61e9c03d", "value": "3072:/BN21hw5/LWEp6h7Z5aPeC7Fnyp48DviIYIQ+Sfhm/H:5GaL5p6h7yeGypTr6IQpfI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674721006, "uuid": "24d19fb1-363a-487e-88bc-13d85ecc689d", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674721006, "uuid": "37d4edc9-4a66-4f82-bddf-6b4c4bd06c2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674721006, "uuid": "c9e7890a-67a4-4646-b793-c06c6a28aea3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e3246e-9d7c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1674739341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674739341, "uuid": "82b4cc29-4749-4dd8-ae6e-a8a440aea36a", "comment": "Malware payload (Rhadamanthys)", "value": "ba352a3c2b7e4adfd32be156ffc0b431", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674739341, "uuid": "cd622518-c538-447c-80b4-06cfa913f216", "comment": "Malware payload (Rhadamanthys)", "value": "fe424f7a9315099d2babc7f040d56c5eb809d16614a18ebaa3096c55ec364f8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674739341, "uuid": "97a028b2-9816-4f45-ac21-de58c039a7ad", "comment": "Malware payload (Rhadamanthys)", "value": "4b3bece83b7b6001c52556cefe8c3242b42086e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674739341, "uuid": "3678365a-757a-4da0-b596-fc530bc38bdb", "comment": "Malware payload (Rhadamanthys)", "value": "7b566c62d22215b8b8fb27e4cdccc84ae0399cc2bb18d12f42e626e6a7b245cb8066be0081c16ca235707d529f566a83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674739341, "uuid": "49fa5457-070b-4f97-a629-2e20301498ea", "value": "T11814E02379D0D0B3C59745742C21DAA0BB7BB93262A4884B37981AFF5F753D0972638B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674739341, "uuid": "5a7a2324-cb84-40a4-ba01-c01b191c9744", "value": "76acbc9b0e9b8516eed30a33559882bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674739341, "uuid": "5d179eea-fb5e-43fc-a7b2-d91fa20f74ae", "value": "3072:rBN2oNYfeXzLg0fJga/5BhAqzYDylHzX959GC2tP3eahkJLcL+iuY1Dq:VZLgeJgajh+OpzT97UvyJLnIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674739341, "uuid": "568b366d-5a3a-4aab-b300-564f72d87ccf", "value": 206336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674739341, "uuid": "d7bab968-006a-44f8-8a0d-a3e4672cc466", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674739341, "uuid": "a986e412-45a1-4a00-9f0b-438773e19d2a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ee62d8-9d94-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1674749857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674749857, "uuid": "a5fd906a-f23c-42ed-b845-a853272a6b2c", "comment": "Malware payload (AgentTesla)", "value": "c7d4479bba435e3afff65d74c163ba24", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674749857, "uuid": "677cc663-fb77-491d-ab80-556c8397bc2c", "comment": "Malware payload (AgentTesla)", "value": "ff01fd41f8c9957f36aea6b42191ebcf557c75b6e503ba81e3b1c928ac75025a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674749857, "uuid": "04b90455-0398-4ead-a6dd-47a07df48dfe", "comment": "Malware payload (AgentTesla)", "value": "0732f1a19d4afaff6f62fb03392a8361c5f9cf7a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674749857, "uuid": "f63e6478-b11f-451d-ab42-33209e4b6736", "comment": "Malware payload (AgentTesla)", "value": "112c0a9079e9aff2a08d3ad642569dd413ab65d1e0da65b7edb47852f885a6ff8180b1e974f4ad6260b75414379c185a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674749857, "uuid": "851e0eff-4e90-4b78-8dcc-768eb3e43827", "value": "T18FE36B9D726072DFC867D072DEA81CA8AB6074B7931B4603A02705ADEE5C99BDF540F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674749857, "uuid": "8aa2e38c-f2bf-423e-85ed-09b3e7afcf94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674749857, "uuid": "a8af3cd8-1475-47d6-9420-395fcb486814", "value": "3072:L6HLty26E4RF7d09WvdUBcP7TW7yrKvyHCogYVLBlr//OVpxMr:Liy26EGVd0Uvdb7oypzgMlr//OVpxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674749857, "uuid": "3c508a04-4d60-4ce0-bb0d-65e15e916d84", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674749857, "uuid": "6439f118-8e5a-412e-a67f-f283c291e059", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674749857, "uuid": "e912f995-432c-424c-8b75-04e39b4f6e23", "value": "e-dekont-20230126-.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b437f77-9d1e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1674698895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1674698895, "uuid": "c53938a9-3164-4bda-b90f-166132e07810", "comment": "Malware payload (Smoke Loader)", "value": "878ee1ff8491c9b38cd1148e8b9ba635", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1674698895, "uuid": "52cf6609-6a2c-43ff-8a43-470201ec450b", "comment": "Malware payload (Smoke Loader)", "value": "ff8803c4f33bb1174d898bf28f8c914d106dee521715c5ab5572af890a4c22fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1674698895, "uuid": "3cfd364e-4fe2-4ddf-8474-7580335a4dfc", "comment": "Malware payload (Smoke Loader)", "value": "f2001645ca20dba719fc8eb98ead59133a40915f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1674698895, "uuid": "0dd331fe-cf3a-4442-97d1-5fefc3f570d3", "comment": "Malware payload (Smoke Loader)", "value": "f78fa69cfb61ed04751744cb053ac4e44e1b86c67033e7161f59f075cd27a4bd1e667c4428d9d4b5f4d177f5a4a1b306", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1674698895, "uuid": "a434f3d1-f687-4fd4-95d6-96da4e52a553", "value": "T1FD64AF1276D0A8A0FD1A063ACD1ADBD8396DF9D28F3C735732D4A61F18732A2F526215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1674698895, "uuid": "8a2eba68-68dc-4a5c-8b30-ace8b2f09c6e", "value": "e5f35c047e0fdde323b83e51e689dfb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1674698895, "uuid": "e720dc31-d810-4389-aa06-cf7d9d46657d", "value": "6144:ZvLiH/coCT3eJXMK9X9rY0+MOKXhlaUT:ZvmkoRVTGWFAUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1674698895, "uuid": "ae5ce27e-2960-4be5-ad73-1be4171f03e9", "value": 332800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1674698895, "uuid": "ef649a31-034d-457b-bbad-34147f41f2b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1674698895, "uuid": "79c2e859-53fa-41ca-8ae9-c2c5fb76a6b6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }