{ "Event": { "published": true, "date": "2023-06-09", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-06-09", "timestamp": 1686355382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "f30f8df7-a389-4ab6-af01-f58b2223fd74", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e44f78-06a8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686302978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302978, "uuid": "072285b0-4ce8-412a-ba54-5af963373449", "comment": "Malware payload (Loki)", "value": "d7def482986719cf5b174a54ce4ddfb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302978, "uuid": "9bcbdf04-eaf1-4a9f-93e6-379092c8a61e", "comment": "Malware payload (Loki)", "value": "01b0afd5519e0f4b6602dcb0387e414fa65ece3a6b7338dc2df10abf2d1c5a01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302978, "uuid": "6c40a9dc-7d9d-483f-bb29-426c5fa545bc", "comment": "Malware payload (Loki)", "value": "7995d0cde67552fff5aa336624b2938455b0edb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302978, "uuid": "88c99aac-bd8b-46e7-bd66-598d3f503dd2", "comment": "Malware payload (Loki)", "value": "3d3b868c971d1e56c05a2c3dd0fb6bc9927cf9d0adc51cf68ae2a4469d4c59aff5b6ce49198e0d379dd7b9aa79e512c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302978, "uuid": "761fcc41-55f5-47cf-b552-3ea9f6e0a5db", "value": "T1B1E4015933F7151ECAAE7F7D1D4A0AB9CAF8A6023513C2478EDB744DEC68F498A00257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302978, "uuid": "c00295c7-221a-4352-85f0-1dc520bcaa41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302978, "uuid": "4b42340c-394e-44f3-b6ca-6889352b42d7", "value": "12288:Cd6L7PVpfhi+bhaDnLMzIL2q+RTdOL8MBL5EBC0qrvTLqiMUQGZGDDuGMG4PruD+:JOyqGUL8MyQQGQHub63dx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686302978, "uuid": "07ff71b3-aefc-4405-8282-47c1fbca0ccc", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686302978, "uuid": "e0e5aa3d-c9c8-4da2-940f-40ee9c5f16f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302978, "uuid": "1c511829-5e20-477e-82ab-5220bea26b7b", "value": "shipping docs S14-213008.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52a93a3a-06c2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1686314217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686314217, "uuid": "2198aba8-4ca0-479e-8bd7-7cecaa5074d9", "comment": "Malware payload (STRRAT)", "value": "a25fa173093bf047bb4e789b79bfaa63", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686314217, "uuid": "a14f60ff-7af7-4168-94e0-5c3b2da91c0e", "comment": "Malware payload (STRRAT)", "value": "028376d3fd8b3dabf7f41eb68cdddd5e04054792ce328cf7ef5e320ccf32ab1f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686314217, "uuid": "1ffb6ae8-e308-42b4-934e-c6be60fdb444", "comment": "Malware payload (STRRAT)", "value": "99f8196992e7652569efb8dff2ce3505c730cba0", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686314217, "uuid": "8e7eb4b2-0842-4145-96e9-33f445e11cff", "comment": "Malware payload (STRRAT)", "value": "404ba0e1c8027804a0e1aba5686e62fc956c17078c425cac6bce65c5ad0d32314c56fb2d4a99d921092541c943cf728a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686314217, "uuid": "78188f0b-77e0-4ae4-a9e0-46ff7111163a", "value": "T19824F12AFDAAE1DAD14B40B47069C5A6FA1E925DF806813F21FD08954EF0D2C0756ECF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686314217, "uuid": "f28d58bf-5032-4d56-98bc-405b086515b4", "value": "6144:lIXAs8OwnBa8vAL82E6v4LglHQIpHEuUT7PJ4CKUjdH:ukOwnrvkDWLgfUnPl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686314217, "uuid": "4bb61c3c-42af-46e7-87c8-b8bc78253e79", "value": 224793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686314217, "uuid": "c0fb02cc-4e23-4487-8976-51460f3fbefa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686314217, "uuid": "18bec8e1-657f-4232-95b2-7ca0049fc1ee", "value": "SBS RFQ 00926800230609_pdf (93kb).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10dd8f98-0698-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686296068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296068, "uuid": "1a687fdf-0dbe-49db-ab43-86305949ea05", "comment": "Malware payload (AgentTesla)", "value": "d2b476e328f06b3227e427b29acbd380", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296068, "uuid": "dceb03ba-bb10-455d-80bc-843a264fdceb", "comment": "Malware payload (AgentTesla)", "value": "02c82d7b7be7553259a42370f46fb351f5c65fe771c1d6616fefa3f19fd542dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296068, "uuid": "900f28a0-4966-4a89-bd4f-3c5d6c4704a3", "comment": "Malware payload (AgentTesla)", "value": "119ce5dc688bd534d068051fe6441303451c1f29", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296068, "uuid": "e68afd05-b5d7-4dc8-b431-3ec6bdbee1ae", "comment": "Malware payload (AgentTesla)", "value": "cfb57fc760346798598864ca0ef08f858d260ed1d0dae2145351172af29308dc4bae459c3234c311658c62c5161486cb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296068, "uuid": "1941ab47-c231-4de9-8417-56570fd2b4b8", "value": "T18EE423E00EE86C0C6A079151F533095B479FFF112AE504CDA73FA866AF2E1D7E82B591", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296068, "uuid": "baf14ba2-04df-46fa-bcb1-1ce086f0865c", "value": "12288:wKYvfDBWFPutyu2CpA97e758QDA55tkTpR7b/iMIGJu3hEaEtPE0s0WsE+hu+:w5vfDBsGtp2D97eV8QDkGEmM0s0dESu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686296068, "uuid": "1052e342-a16b-4fdc-b267-2115ce061165", "value": 674163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686296068, "uuid": "c9cb94d4-05ea-4f7c-9c6c-d9eedd0611a2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296068, "uuid": "69729afd-e394-416d-a520-b3e3b24e0c9d", "value": "804152064.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ace0b7-06a5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686301844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301844, "uuid": "b30ed654-749d-4cc7-9241-c080aa81af7a", "comment": "Malware payload (AgentTesla)", "value": "67c434d6f5255fe2df5fb2971c6e2e29", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301844, "uuid": "452c0146-3da7-49f1-9127-41ddba2fd7d8", "comment": "Malware payload (AgentTesla)", "value": "03a7428ff100bafa1ab62ebf5888293afd81ea78d34e2e8556df4ef198850ab5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301844, "uuid": "0140b0a4-ebc5-447d-9a7b-fd5c7fa608a3", "comment": "Malware payload (AgentTesla)", "value": "56ae61d31fcb1b3f15358bc5fa6532ad5818b38d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301844, "uuid": "100f9770-1c8d-4e85-9dd2-e950ed104798", "comment": "Malware payload (AgentTesla)", "value": "d7a9df18afb44b9bcf3a3c4ba967938c214c0bd36bcb68872a7240cc751fb2a309fc17133a483e6a70efa089fa409831", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301844, "uuid": "8cbad101-9d28-4d0d-a5e0-603b86acf42e", "value": "T1178423130399DDC8854A46EEA8ED8376E7425931E83658BDF438BF073E35223EE61853", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301844, "uuid": "535d6072-a945-4c9a-889e-6146d46e4fa8", "value": "6144:j1AmD9sx90D3YqBnceWaW6PG7gEniLLK0m7FnMK6chV+2C4IIzNuin9zPl5TAw0B:BlBsxoYqBncrd7gEiXK0m7FndhV+BsNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686301844, "uuid": "7979e2cd-23f4-43d1-aea8-8d651d6c1a9c", "value": 374377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686301844, "uuid": "15aa2dec-3400-4e18-bb2c-19ed253b3aba", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301844, "uuid": "13219c2a-d1f6-43a4-ba56-534001a29356", "value": "SOA 900371836.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78646fea-0690-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686292805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292805, "uuid": "8cc389e9-ad9b-4d16-9888-25af836b43a0", "comment": "Malware payload (Formbook)", "value": "87142634f097246b41faf70c20d45455", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292805, "uuid": "7754fcd7-4d86-4118-8193-3adfb6318538", "comment": "Malware payload (Formbook)", "value": "03f51ffa9c987630724a451ad872f52bf97bd257ad06b58b6194f5dec29c8f13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292805, "uuid": "6165852b-d23f-4779-ad0b-bd4f38fb8694", "comment": "Malware payload (Formbook)", "value": "6d1a5e4eb73299336ca3190ec7be841360a2195f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292805, "uuid": "5a61a1a1-d225-43b4-a3f2-60e3c0f664ef", "comment": "Malware payload (Formbook)", "value": "f33f4e774288bd22d78de651f907de3a9202d61a97b679779a05bda2575bb37ce8587c70d8faad1f9b7652d2467f51ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292805, "uuid": "32162053-6798-4160-9160-2d52bf57784f", "value": "T10E156F3915AC052783B692BD6AD0F807FB809CD33A0D8E5F56C74F861522636E5CBD2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292805, "uuid": "1fd0ed27-e301-403f-9015-5fca46ad492e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292805, "uuid": "ae993f9f-1b77-42d6-9050-4f8a9659cfe0", "value": "12288:x3ZATtfLu43u2aNC9qMvZjgfZaRnSZZRNWhUrK1AU0PVDWl:xJATt6f2b9JStNWme1b0PQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686292805, "uuid": "10127dbd-f948-4162-9048-63459e45deec", "value": 901632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686292805, "uuid": "decce310-1280-474b-962c-4f11746d7f18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292805, "uuid": "b24d2634-1279-4cdd-a078-f3fe5b383b3b", "value": "OUR REF RFQ 6000066536 - PR 10023150.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c71ac70-06ad-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686305214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686305214, "uuid": "80337511-975f-46f5-905b-a0255a515e3b", "comment": "Malware payload (RemcosRAT)", "value": "cb620a582a5810e90b4371cd49e90d47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686305214, "uuid": "ef1b8c2f-ae38-4acf-a5d7-57730528ec9c", "comment": "Malware payload (RemcosRAT)", "value": "0457877267dc59b12e52c15a7167ab493eb2a25cfb5daefb6c008144e9da5f43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686305214, "uuid": "d67316dc-6a63-4b5f-b71e-82c321d9ec9c", "comment": "Malware payload (RemcosRAT)", "value": "ff53a6175dddff9f95053c66852a55f9a23ba927", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686305214, "uuid": "48837c6d-1daa-4cac-b822-b2093cff1dc0", "comment": "Malware payload (RemcosRAT)", "value": "07165f78c61c4ad15833c548612b9af10841adbf4a6aef2d54b2477bf391b044f67d2284ec351102176e2c66441cd02a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686305214, "uuid": "40cc155a-dd9a-48ba-a725-66f7e75cce84", "value": "T1BC05AE27E6A089B3D172263D4C579F74B826F991293859862BE4DD8C4BFCFC12835387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686305214, "uuid": "69ffd289-37a7-427d-bff9-c36e8fefd263", "value": "af2ca9afa492d97dc6357fbf055e1ef2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686305214, "uuid": "7720ad65-6fb6-422e-87a5-cd063f98ae06", "value": "12288:qKvF+303jOMsKaUyz3zrW8UR1Rf75Nz8lJORw9oYIwn1qwRYR/LQqbmwz:dNlTOMRaDHoDvKCw9DIw1i9Eqbmwz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686305214, "uuid": "c5594332-928c-4db7-a696-62539fc8231c", "value": 834560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686305214, "uuid": "4b4e2a05-6aa4-41c2-86cb-0d45794c6dd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686305214, "uuid": "293ff2d5-cb6e-4f04-b0f7-96fe470b7a45", "value": "0457877267dc59b12e52c15a7167ab493eb2a25cfb5daefb6c008144e9da5f43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acfcd9b5-065e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686271419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271419, "uuid": "ec9ac97b-cb37-45eb-90d8-9f8c62268762", "comment": "Malware payload (RedLineStealer)", "value": "8f654e302b0bbea238f03fe6e4dd9f73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271419, "uuid": "bbe66d6f-b99c-49eb-ade8-7c7e0a326ccd", "comment": "Malware payload (RedLineStealer)", "value": "053f8f45cf4934064c8e2cb1f95c36c2f72985b9c87cd5098fde69f95f05b497", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271419, "uuid": "417f2679-7f2c-4eda-9e51-7f6ebdeee9fc", "comment": "Malware payload (RedLineStealer)", "value": "93cbbb3f7485bf07a2b24cd4913831cc07466000", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271419, "uuid": "df31d47c-b012-402a-81b2-719699d705c9", "comment": "Malware payload (RedLineStealer)", "value": "e2bb22f31a9c1ac4755a39efb53e7679c3c862928ca7b9ccb8168ae35cce5b54468beafd0ebb986d39962eae73f9aa18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271419, "uuid": "92cd678b-b287-4124-b352-504dce25f85a", "value": "T1D764590372C38C79F8AA073E21D44F2DD877ED60164568FB37A89A604ED131394AB5BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271419, "uuid": "b7e18b8b-39a9-48fb-bc64-169fd85f8b14", "value": "4e895722b26aab4e38438670ee8ec7ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271419, "uuid": "ad3af279-93cf-449a-8e2f-07ef45917d7d", "value": "6144:bJieURFH3pMnTDs7UNVS49kCNQSzrs5kLJhHVugiqtciLRc1tkP:bJIRQD7NQSzrs5kLJhHVugiqtciLRykP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686271419, "uuid": "fb7ee7b1-1bfc-4b16-9063-3a978d543f73", "value": 315520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686271419, "uuid": "ad628906-37a7-4c67-8479-549e9c46c86c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271419, "uuid": "e1083ce6-66d3-4ecd-8ec0-c5863f48610a", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "167f1128-0691-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686293071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293071, "uuid": "b5d997a8-648f-4867-a2cd-1a12b42821e8", "comment": "Malware payload (AgentTesla)", "value": "59b21de6b2bef73d8b0e6b0f4b91b344", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293071, "uuid": "69c28255-81c6-44c9-8560-12f856d5f585", "comment": "Malware payload (AgentTesla)", "value": "0555b45d523ab3e53e72e309df3aff50f9bbf9073bb975b06eb77b26a780755d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293071, "uuid": "23b6337d-7005-4481-a4b1-ff09aeabef98", "comment": "Malware payload (AgentTesla)", "value": "e457163c1b51f8da1aedb304fc9e5a1b4ef20ab6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293071, "uuid": "865b84fb-b593-4cb0-a9bd-998b6de1731c", "comment": "Malware payload (AgentTesla)", "value": "070f9a38ed4a2985ba223eb31f4d4dd7b4613549391a712a69eba40b962ebda39981b6cd45a5b8e07c6ea611d9c3150b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293071, "uuid": "a8986939-f92c-426f-a617-33e097856ba1", "value": "T1BE155FBC9D07E5EBCE38E27A95F02307B3654517B65EB88C2ADA3B450D93DC1329064E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293071, "uuid": "8d0a7e0e-af77-4b11-b430-3e8f9e8a9aed", "value": "12288:dDf8fwr+78TOWEG59hu64NDkJV9eFWBVg2:dLTDEShu6O6Ey7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293071, "uuid": "4c23a32e-57af-479d-b9b8-6382a6c3a426", "value": 919552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293071, "uuid": "939ca1d7-930a-4f0d-8bc9-fad481a2b996", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293071, "uuid": "c175cd9f-dbaa-43c6-aef5-da002a68b9d9", "value": "BANKSLIP Copy.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d73a1eda-0698-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686296401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296401, "uuid": "f22a55e5-db5f-4075-a92c-bf20f1d8fd4c", "comment": "Malware payload (Formbook)", "value": "d9d1ad56f27d9857961fe2d9c3232709", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296401, "uuid": "f212ac05-3517-427d-aa71-579c6e0082a4", "comment": "Malware payload (Formbook)", "value": "055df87ee17bc10f89a3ce80d670eaad3d3c747648d9aa95aa73c7165e9ceeb2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296401, "uuid": "14a60e40-8ddb-4937-b6ff-cb93120c3889", "comment": "Malware payload (Formbook)", "value": "e8bf83ccbef6e3837e2f7992b353c29d2a05dd09", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296401, "uuid": "54100c40-6609-4883-b771-73f1e435e405", "comment": "Malware payload (Formbook)", "value": "02979f12f40b11ca1c7ed976dd2424d90d14ab107f2e074306227fa449f1c5c40f2ad323aa290d9869448e41c5c27d8a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296401, "uuid": "1ec349ca-f663-4fb3-86f9-7c039a6b60f8", "value": "T129E42389C77DB47BFA44726E82E3DBA0389687277A704B538215E23411928BF24C3D7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296401, "uuid": "5df88d20-f6ef-4492-9b2c-656a0959d2e9", "value": "12288:AzVU8HGj6aof0OlicePOvkK79SuucG0HJWTDC9oiKDskPyCI5Zy:A+ja8OlicOKZPDG0KDC9oiKk5Zy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686296401, "uuid": "61ac5826-d3cf-4e9c-94ec-8e6f00bdf08b", "value": 680421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686296401, "uuid": "a5c6a8a6-b9e1-449e-997d-f6743f228340", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296401, "uuid": "90f1ce8a-63bb-40b0-ae50-e0e2face2a90", "value": "PI.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be716b89-06a5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686301942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301942, "uuid": "da7582fb-92cb-469f-8a0a-9fcebcb80b27", "comment": "Malware payload (RedLineStealer)", "value": "d4a77e64653a362530ff866a5001ccf3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301942, "uuid": "cbcea7f0-c475-451c-9c81-69eebde3691a", "comment": "Malware payload (RedLineStealer)", "value": "06da4f2376263822172aeafefb3ab07e2d8faeded92ac9cfc79d1aac394be652", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301942, "uuid": "400ac395-dfc9-4bfe-95e5-237c592c5d71", "comment": "Malware payload (RedLineStealer)", "value": "8fd1641cad5bd706345cd3578c44f5e52a8dc02a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301942, "uuid": "7e0c5fbc-3390-4209-b8fd-b036fac62913", "comment": "Malware payload (RedLineStealer)", "value": "d300fbf50635bab7a8c902a33829e9b55ac7386306c3b17fc5188b15d5cf153e0a0f540c0faa3b05e5707687c822d6e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301942, "uuid": "a2a7c1ec-4212-4983-8fbc-d8f697b6aaae", "value": "T1C17633697FF563C1FA3A00B167729552E58CECAEA163A31E3BC27B0E047E890B4145DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301942, "uuid": "6e4794af-7b0e-46e0-9206-b26acbce0154", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301942, "uuid": "5ebd7e37-9b3a-4a30-aa1d-874ce7901674", "value": "98304:Aao9Rg96H5ZUhGyRSJpzu7mUNKh5leXOJqnEwgnNCzaGs4IrjubWtyi4PEx:ARVchGd+dOJRwgWLsprjubm6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686301942, "uuid": "5b59f76c-76c6-4818-b0b0-4d3866f4e4a5", "value": 7150080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686301942, "uuid": "1412200d-3c76-4a22-9c79-c6cc97de8fe9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301942, "uuid": "705982ee-718c-4079-8225-6560ee769aa5", "value": "d4a77e64653a362530ff866a5001ccf3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a79dcb76-069f-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686299327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299327, "uuid": "46f2eba0-d013-4e47-81ce-085847042082", "comment": "Malware payload", "value": "51209d64822c1d9a4c2594e8156d769d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299327, "uuid": "d065ed5e-a261-4488-a37b-d29825b87660", "comment": "Malware payload", "value": "07ff19566c7cb59977bc5ce270619e53f941e22ea75b192d7cfc5745a2ad6b44", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299327, "uuid": "5863cd95-50b7-4694-b7e1-15a5482c91fa", "comment": "Malware payload", "value": "994294bb107aa55d639e83941ebc8ed4be66c133", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299327, "uuid": "0ddc245e-ae82-4328-b942-add1451ea201", "comment": "Malware payload", "value": "cc3f474044c89fb623204cc977344eddc4ac9747bf1fb1af4e079560b8a45201432b634f93bebc9128f6d4626b9c9230", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299327, "uuid": "99b36c30-5a5a-4a07-b440-9a6cf3db0940", "value": "T1C4238550B3C53C80225BAF6AB72BB0E7F91B1EF93444489BC155FD985ABD209DAC0B71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299327, "uuid": "2b46cfab-9f8b-427b-87a1-16d8c791fc25", "value": "768:kbZtZUHhTbhB5vNg1KMMauYUgs3BzgJXZFvgHW8E5u59mQ/Z4/r9XzzzIWODdfge:Sdf1Hk8QBLZjOPZZzoCHmn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686299327, "uuid": "b8ec3786-0b33-4d6a-8443-79588fc7954a", "value": 47288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686299327, "uuid": "3dc319b0-822e-4c9b-b69c-994eb7ef7797", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299327, "uuid": "ca37a600-3b46-4de7-88d5-871778e1f514", "value": "341760070.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46472044-065e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686271247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271247, "uuid": "0f97bf84-908e-4a0d-90f8-427779c9ae08", "comment": "Malware payload (RedLineStealer)", "value": "de89ea7596a2762de338938c57f0890d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271247, "uuid": "b03f343d-e43e-4779-b83e-c9fa0911ce07", "comment": "Malware payload (RedLineStealer)", "value": "08b8668c1c976afd120ca53dc72123bda5ce5e4e73aa415d0011fecdccb8b3ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271247, "uuid": "66e85d7b-7027-46ed-99a7-0c673e1e03ea", "comment": "Malware payload (RedLineStealer)", "value": "09d7dd4c52befbe2a704190972c667ea293210de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271247, "uuid": "cf3f4d83-6edc-4225-b6d5-42c64cd0457a", "comment": "Malware payload (RedLineStealer)", "value": "71b867da2a03c9a94b4a017e7c8e045f00676163819f0e8f68d2a0054c5f614e715ff0562fa9a187c9a7b220ac33b43b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271247, "uuid": "a88f44fb-f06c-4a5e-b29e-dd5054dc4eff", "value": "T10264590372C38C79F8AA073E21D44F2DD877ED60164568FB37A89A604ED131394AB5BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271247, "uuid": "d8366a3c-ea50-4c8e-aa35-b9b2916db63e", "value": "4e895722b26aab4e38438670ee8ec7ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271247, "uuid": "a9bb9a88-d960-46b9-87f6-1f51b833ed89", "value": "6144:bJieURFH3pMnTDs7UNVS49kCNQSzrs5kLJhHVugiqtciLRc1tkP:bJIRQD7NQSzrs5kLJhHVugiqtciLRykP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686271247, "uuid": "4c3bfe11-e3e2-4a2a-83fe-7a3c962768fe", "value": 315524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686271247, "uuid": "3edf5d8c-fb21-4982-88ad-1b7701421953", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271247, "uuid": "3a49e72b-5e74-4756-a1f7-21527d467cc4", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea0d205-06a0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686299527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299527, "uuid": "a5386bb5-35c8-4ce4-b01f-60d5cb83e2d0", "comment": "Malware payload", "value": "2a58b15aa0715cae34f4f56d317671dc", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299527, "uuid": "03c04cca-fb64-4bce-beb7-b30b904e67f1", "comment": "Malware payload", "value": "0c1ab26f8ca14755e03c6daf6a04c887631b33ef55edbf7e5ffee526c851345b", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299527, "uuid": "4266b408-9b8d-40a1-9184-c0c46e52ecaa", "comment": "Malware payload", "value": "7423a7c721fe49af671f3d37d42da09e8a60772d", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299527, "uuid": "df536e09-f9d4-4f81-afd5-0973f3b183ca", "comment": "Malware payload", "value": "6579307feb20b0d0a91c3adac4f45f09df947f239799e9d3ca4b40b9e893e6053afaa1969696f0bb6c7a29ccdcfc9688", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299527, "uuid": "9a3ee421-e963-42c9-a6f5-817cd7bcaf8c", "value": "T19AF43343FF7AF0D149E8794862260BDA48A38B4DFB0EC29C08BF5516163BE56A057B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299527, "uuid": "55c937f4-eb6b-4fd5-bee9-cc4819920801", "value": "24576:fFdnqihza4l1Aa6zLDupFyLEWHY1ZS1Yf1GdM2p4Iyx:XqihzJzAa6CpFyZ41ZlO4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686299527, "uuid": "7bfadc16-2626-4ab9-bc0a-3701707969b3", "value": 790071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686299527, "uuid": "ab2bbe23-c3cb-4b17-a65a-f3b84de7f967", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299527, "uuid": "f4fae9c1-468e-4e81-9f18-b8640f7c85e6", "value": "Inquiry.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f0794b3-0698-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686296279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296279, "uuid": "b770917c-376b-44aa-8db8-6524fb90aaf8", "comment": "Malware payload (AgentTesla)", "value": "0eb996bd6aa78d5ecbaecc72c5184f84", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296279, "uuid": "2fd6360c-1d3a-4038-9ba1-d5a20ef49a96", "comment": "Malware payload (AgentTesla)", "value": "0cc4c4f58b1fdd9c6891a79782eb888dabacc3c3e51e77e9f706443be7abc589", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296279, "uuid": "a61e6dd5-664e-4407-a904-3b7616148b54", "comment": "Malware payload (AgentTesla)", "value": "40dbba3cd1903c3c04754e97ef85ae0c6f96e8c4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296279, "uuid": "97c140a7-51ba-45a7-9367-203d2497bef8", "comment": "Malware payload (AgentTesla)", "value": "e4d0c3d39334493e3f1cc644b56b037b82958b824263e30603efbf06b1f07bbe51c4744653f3223d03c44036d300c3fa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296279, "uuid": "8749795e-3f5d-4189-92e9-5c9a09d67500", "value": "T1CDD423FA4E0D9FB6A6E9CD2D6708899A7C8AF00C41105DD21B095CCB94FF4D2A7F1728", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296279, "uuid": "bbc4ebb6-871b-4e7f-ad33-7f12e2d3f3ad", "value": "12288:v7kzySmIx9Z8b+Ij04eCXAODJWZTyjKGxQU7kVqNORU+MZ/3+:v7kzySlLabzw8s4nZIVs+Md3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686296279, "uuid": "386cffe8-f7f7-4cb7-b9dd-4b764215c91a", "value": 650332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686296279, "uuid": "8d26b943-2b7a-4924-b125-0926285a62b3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296279, "uuid": "c0d16955-9ab2-4701-bf2b-860f31714481", "value": "HBL draft.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fed9a464-06c5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686315794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686315794, "uuid": "e8a6735c-46c9-41c8-85f9-a93f507f40b2", "comment": "Malware payload (AgentTesla)", "value": "86c3db80eaa437e32bc3534273c8482a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686315794, "uuid": "87304250-9554-4a37-a374-9516791ec754", "comment": "Malware payload (AgentTesla)", "value": "0cc8d93630b4068b0b72119c061925754274478463014d05696a34603f88eaf7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686315794, "uuid": "cdc52116-4126-4473-884b-746db0e47ae3", "comment": "Malware payload (AgentTesla)", "value": "7b80bab03acddf1fe65c088183736f1922ad556b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686315794, "uuid": "81200aec-4434-444e-a8f5-91df65045c90", "comment": "Malware payload (AgentTesla)", "value": "d6719673f2930d42ff46891952ccad2872860c1ce5bc62289e50dee84e3acfa67d0e040fa5fb06a63842bede9c84bc91", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686315794, "uuid": "e8bb2e49-f3f5-4403-a95c-71dc776ec579", "value": "T19454134C6AB2C59AD4A22D3A3CBD5B262BECF4121028960F7780148DB9363D6FC5E757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686315794, "uuid": "23e05216-c3cc-4819-b0c9-76395dc2d5be", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686315794, "uuid": "c5f1a3f1-e5e2-49b9-be04-5d070d837a6a", "value": "6144:JYa68Xkr+X/z2VKZEf2KYg81OroHK6jkxwusUB85eg+x6:JYOkraCKEf2Kqk6YqdUB8s6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686315794, "uuid": "7f04f2f0-b2bd-4afa-b6d3-0b1a21a17c3f", "value": 295313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686315794, "uuid": "a6de7f87-15ae-4c19-9b0e-3380f00009b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686315794, "uuid": "322dba84-6bf0-472f-92d3-21c614d08207", "value": "Enquiry E0359977A-9122.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae31936-0698-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686296407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296407, "uuid": "d0e21c06-58d5-4336-b198-8cac1688b7b6", "comment": "Malware payload (Formbook)", "value": "7845e18bd435dac2db3e03456a513471", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296407, "uuid": "9db29dd4-1200-4f64-948e-ce604306f6fe", "comment": "Malware payload (Formbook)", "value": "0cf35dee450f97c6292a678eec6cec2c682abe638925be45ab06d865bbc5a1bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296407, "uuid": "25a0745e-16eb-4b8a-9a32-16efe40d15fc", "comment": "Malware payload (Formbook)", "value": "9a736efed39443d2615280239748a9db60491c6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296407, "uuid": "2c85fae4-cbe4-479f-afce-edf0fb28150f", "comment": "Malware payload (Formbook)", "value": "06a1d80503ecf962b3afe296d5fce93212502e794f252a49b916d684e62306ad7f6e4c461d40e6b5123ea03577cdf6cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296407, "uuid": "64835a5d-a036-483d-ae06-e9328d9f8a2c", "value": "T1ABF4125C32674A0FC05A3FBC0C012632D3FA6A41B063D7DB9FA76CADDD65A9029851DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296407, "uuid": "db48dcc1-5b86-4dad-94f3-27ebdb199c0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296407, "uuid": "6e697863-1003-413b-8e72-95b7e688cc85", "value": "12288:Ag+J/M+Jhewx/NscEQ+vgXK1HsaPC+77jzk/+Ls59f20uPvqr/JEOmo/D+T6dQ4S:i/thewlqB6pbcC+I5920UvqDx/Da4G9R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686296407, "uuid": "2ff088eb-3e95-4b8a-ab01-9ff66febcb2f", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686296407, "uuid": "211d4ec5-72bc-4105-8426-dfc250da13b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296407, "uuid": "cc0876c7-0a3e-4617-aed3-7c4ddad6c1dd", "value": "PI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d001c5d4-06b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686310132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310132, "uuid": "a7235cf7-32fd-4815-8a9a-3fe2b52e9db5", "comment": "Malware payload", "value": "dc2ef2fc66df9f23efefeb620ee37266", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310132, "uuid": "51443edd-9f2e-4b0d-a0f2-cf6354481b14", "comment": "Malware payload", "value": "0d80969bed36c40e3cbf8e66111c6d7dbc4b75afbbc34814864e9f09010f9173", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310132, "uuid": "35957430-b540-4f33-ba9c-1889c07b61bd", "comment": "Malware payload", "value": "41d83805c36b1a62824fe9aed9403328e831ef84", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310132, "uuid": "b5962297-9c18-4bf0-b6da-ef28ac1c7d20", "comment": "Malware payload", "value": "f93ba28976328c0b8e7ea960181ca17fca9c9a1db206dd0b735fcc5505fd5b3e4ba48ff3a618b40a63b82008464f3b0f", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310132, "uuid": "ec07468d-7730-4ab2-bf83-c8c3881882f4", "value": "T102B22A03FB6D8661C2778B3FCDFB910403A1E1566703DB5F789F235A18123AADC4665A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310132, "uuid": "2d101d51-e030-4d25-813e-d88538f7ba1f", "value": "384:OhUQUW7YpXRWsYfKsHjIJMlN5/1CVQWR65kPT8YuNc8YRryBgig+jabPZ4pL6zyA:tQH7iRoSsBl4pOkPT8p+yBgnhbCt6zP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686310132, "uuid": "15a6df57-9525-43a5-93d0-7b64ca5c9e69", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686310132, "uuid": "c9b87c8d-6177-4d36-b74c-f17c205bbf2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310132, "uuid": "26bc4500-841d-4a26-8947-c33eab3e08e1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8489bcd2-06a8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686303134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303134, "uuid": "6d0a1bbb-e1bb-466b-8c18-a30a0aca7415", "comment": "Malware payload (SnakeKeylogger)", "value": "9f38ad628df5355a61f35e886a72f72f", "object_relation": "md5", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303134, "uuid": "6737450a-d6eb-410c-934c-75f4eeac67f2", "comment": "Malware payload (SnakeKeylogger)", "value": "0ddf09c2928e632df5b7f567b44fa5d8f1605aece9b19a9ea7da97f12ac18f75", "object_relation": "sha256", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303134, "uuid": "2b145845-86de-4b27-a54f-ae61160c26d0", "comment": "Malware payload (SnakeKeylogger)", "value": "86e7f7ddde840f38b9fcf0a436d9818b9003cf57", "object_relation": "sha1", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303134, "uuid": "9781f348-1e0f-468e-a7cb-9ea36975df29", "comment": "Malware payload (SnakeKeylogger)", "value": "0cfe17acc568cad78aa88dd4453e49807b0167da131de0b5986364bdea5fc00ebc32545b8a3b7aae9d23ca3d0267cadd", "object_relation": "sha3-384", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303134, "uuid": "2efc4d96-0e47-4de7-bfd3-e5aee83e990f", "value": "T134D4234418CD5C669EE74AB04085BBE172DF3ED21653FB7D9891F1CDAE4E2A7308A053", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303134, "uuid": "a4907a71-2d54-4c45-b2de-79aa3b9833e8", "value": "12288:7fpIXt8Y92qmlo1QWghs0eETtXxPwM/e7Us0mG4ans0fdpeXIwk0SW1vyjUzspCT:zGXt8YTmfWs/foae41mG4Ujnwk0SWUjc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686303134, "uuid": "eb24acb9-f467-4af6-ad3d-b6a82790262f", "value": 625614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686303134, "uuid": "b0b176d3-2fa7-4055-992e-f7f95d367cdb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303134, "uuid": "bcafe01e-b578-415a-b6a2-34cee423197a", "value": "PXU422.PDF.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfda037c-06ba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686311018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311018, "uuid": "f665cbb5-31fe-41a6-8f6f-d03ec10169ec", "comment": "Malware payload (Loki)", "value": "724eff149c2bae4dcc3d50f35fe0bf0b", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311018, "uuid": "7a7b19e7-3dad-474c-a4c1-25e0cbef4d35", "comment": "Malware payload (Loki)", "value": "0ea0b0f9793ca919080fe3dc6568ce4eea7911c4f4c651569c6db95a5eaca160", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311018, "uuid": "4df2fb2a-6993-4071-ba2f-882860326193", "comment": "Malware payload (Loki)", "value": "77afc1e1d0ffd969cd729a8dfa0fdde11f0d7f50", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311018, "uuid": "9d82e3e9-33a8-446f-b136-11f4383e443c", "comment": "Malware payload (Loki)", "value": "5c8e10f386fc0f25fe2351bf8b2d638d11e4570792971a382e1a9446acf4def04962dcdabec34fe32b46454fec33cacb", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311018, "uuid": "42f41afb-69fc-4fbb-933b-deba86321c60", "value": "T101D4239E84EAB674069F6DE28B08C99D34F6ED4D6805AE4244D40B4C78DBBCF7C9C05D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311018, "uuid": "e4971759-afbd-4674-871f-5412b326f3b4", "value": "12288:PHDKyXFFJVWS95/vnAzUOQ6O2tyB0iXMU3zHR+/3RO4ynggjrVkNamFtfcWCcnD:PHDKQVbb3Azlty+iXMU3d+/3RIjpkN3P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686311018, "uuid": "67692bc1-1faa-43f4-807c-9d7323655bc8", "value": 615783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686311018, "uuid": "a76462f0-5e46-40f2-907d-c8c071afac07", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311018, "uuid": "dededb28-4e1c-43f0-9d0e-1b6faeb7e69c", "value": "AWB No S14-213008.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a68eb95c-06bc-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686311781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311781, "uuid": "511dfd01-9279-4bec-a42e-923c055a4a74", "comment": "Malware payload", "value": "37199f9fc1d76ca996c1882931226766", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311781, "uuid": "c2ec4d68-7106-4274-bdc1-4677006f9298", "comment": "Malware payload", "value": "0ff14d96591998201073300e2b3c9114717104f05d31bcc95f72557c1d1c8c08", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311781, "uuid": "83e3d024-3654-46cd-b1fe-181c9b51dfdb", "comment": "Malware payload", "value": "f4f19afa2dee6c4039e5a9d97122fac57a6fe616", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311781, "uuid": "90042ff3-81cd-40e4-b7f6-8719b5440fd8", "comment": "Malware payload", "value": "50c85bb26b702dbea1f4bc04070e7ebe0689be9a25550ae75d6b2c8f5716598ca4fb930adc228890fc1407fccd02a45d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311781, "uuid": "c6f722ab-7520-4391-9e95-1e224a4a1338", "value": "T1D7429E39C5437966C363A97AE16532F1FA4F2A52D379B06E7112F28C93022EF835A14C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311781, "uuid": "4587a6ca-1e93-44a1-8951-280d786a523e", "value": "192:ScIMmtPZDZtaIXVpAtHe8I1t8s5z/TshEAzmDEAXtsn1jQaGlDWwRM:SPXprNX7ARePtnzLxo4EaLlDWEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686311781, "uuid": "c0e0b968-abfa-4e69-8de6-14abd6646e36", "value": 12038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686311781, "uuid": "adcb4a5c-e24d-4333-b238-c72a4845aff7", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311781, "uuid": "f0b5dd5f-a3ee-45ed-bcca-e7f6422c14c9", "value": "MESSAGE.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cca5d76-0692-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686293591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293591, "uuid": "bbf4f64b-adb4-46b0-ad0e-a78b80eae27c", "comment": "Malware payload", "value": "e0340f456f76993fc047bc715dfdae6a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293591, "uuid": "e7356069-55d5-43bf-ab5e-93384509ab5b", "comment": "Malware payload", "value": "1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293591, "uuid": "1f0ba7e9-1a1e-47cd-974e-dc1e4645c4b8", "comment": "Malware payload", "value": "d47f6f7e553c4bc44a2fe88c2054de901390b2d7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293591, "uuid": "34d48159-1172-4b30-88f8-20f675f05a0a", "comment": "Malware payload", "value": "922c1b16487469dc8a96601b18dbd41e188652c12f7d031600d13a5dd8a6272d642911c67df09203b1ac0291330c9a8e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293591, "uuid": "97b0621e-7293-4034-8cbf-b583964d661c", "value": "T103452394A452D017D2C67AB9C036DAB45BA4B831EEC2391BC354F651BD70383CB67B2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293591, "uuid": "f9774497-46c5-4241-a613-7f34a54a2fdd", "value": "fc6683d30d9f25244a50fd5357825e79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293591, "uuid": "4ad371bf-c1ed-41a9-8988-45e48030643b", "value": "24576:/4GHnhIzOasqUgEOr69/BRH7dCibu+XoAX0eOTva49ttrSpt81ekHPyWe:AshdasJgEOrGBRxCihH7OO49rveMG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293591, "uuid": "1f116962-ac16-4b4a-ba95-c2af3c6192f8", "value": 1246725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293591, "uuid": "8d969158-c004-4d47-b22f-f65cf1a9a2f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293591, "uuid": "3afb542c-6af5-4d0f-9180-361e1f355bc9", "value": "06230999.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "056da5af-069b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686297337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297337, "uuid": "aeb4fbff-0693-415e-bd5d-22af3a46da78", "comment": "Malware payload", "value": "5ef7a556614a5011c2f032bd44521f89", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297337, "uuid": "9975c88f-9917-4fb1-8a9a-b60164090f03", "comment": "Malware payload", "value": "1089430b22ba44e3e20691ef74553daac2b6cc283808a08c8c547ec4adff5b0f", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297337, "uuid": "28e6098d-c02a-4ce2-a677-222e588d2c05", "comment": "Malware payload", "value": "23e0ca5808d3d3c3e4d9a3b5a9c012488d0abb28", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297337, "uuid": "f063fd0a-06b2-48a3-9ead-e5de9a92f8a2", "comment": "Malware payload", "value": "87770cd02a0da2b02b672841770ce96e37e726faf60f62e0aa78a2bd341bf21bc83dd96511c3ffe57b93920773a45305", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297337, "uuid": "efe33774-2c4b-4736-aa48-9712e036bdc4", "value": "T14005237C62B7B6BC6D14C116CCC44BE622C25AB41699BB65834313829B3E48FCDADD37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297337, "uuid": "a218f0bd-8063-4b20-a771-dc6f20212a03", "value": "12288:Ap3S+amX9phxKRHNpq7HdpHJr7YF2M9MGt3pEvZ1tMTiPrxWl29te/crzb7wjWkE:w97xKrEXHY5b5EztXo29pkE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686297337, "uuid": "a39fe7c1-5bc2-463f-bc74-540c64a6ffee", "value": 816210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686297337, "uuid": "e899372c-ca64-4539-8809-41fad99170f3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297337, "uuid": "3c39bb0e-7ceb-429d-846f-b4401441b2e7", "value": "SWIFT COPY.CAB", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e844aae-06bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686311338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311338, "uuid": "2b61e28a-e17a-4adc-8dbe-b36c3aef8cbe", "comment": "Malware payload (AgentTesla)", "value": "3f44e6cb225efe5b640353f568a99acd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311338, "uuid": "3cd0347e-b69c-4951-a2e7-e10a415c1615", "comment": "Malware payload (AgentTesla)", "value": "1214fcf60b88a08f596efec828f1ea8744b30aa6ff141c8a98f45dc6b2a51658", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311338, "uuid": "d7e4e991-136b-481d-bf95-95d036568a48", "comment": "Malware payload (AgentTesla)", "value": "89bbcdf4a0c1d210a656b007ae3c754367ba3bc1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311338, "uuid": "47fa0b5b-bbf8-4118-a8d9-9a329b243b70", "comment": "Malware payload (AgentTesla)", "value": "f9bcb7f5328d5b2c7b8c99479339e20ca04c0a584b3147c9bae8229a15233062a53c3d65daa864a53aa8a9e7699837e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311338, "uuid": "1a2da48b-39ef-4ab6-916f-a4b4b08b8f0a", "value": "T17BD3CE13B24B932AC42C097594EF282813F2ABC65637DB993E4D235D5A533636F83F49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311338, "uuid": "3a3d1fb3-70f9-4bcb-a5ab-513d98c77759", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311338, "uuid": "69e99432-8a63-493d-b4e0-9297f8c7397b", "value": "3072:duxPI6JmMvHaXQtMJo+rEG7mAeedlZk52/Id4r85fwH:dgSQcoHG7R9Id4c4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686311338, "uuid": "645b2b5a-1ab2-47d7-83b0-10211cd4778c", "value": 140800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686311338, "uuid": "98ce1165-2d78-4aea-ab05-1b619a109a91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311338, "uuid": "ab1c3e81-37be-48b2-9b6b-e0d7fb209f5a", "value": "1214fcf60b88a08f596efec828f1ea8744b30aa6ff141c8a98f45dc6b2a51658", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d901797b-06a8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686303276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303276, "uuid": "7546bc0c-184b-48d9-afc2-96c5e25e5697", "comment": "Malware payload (AgentTesla)", "value": "e53033dc9b8ed0fd7da29aeaf23624e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303276, "uuid": "0702bd6d-7b4b-4e9f-b320-b4da63436c96", "comment": "Malware payload (AgentTesla)", "value": "12c8cd7e47fa7772c327531fea04d42327a236c2a4bd064619c6a6378fdd3378", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303276, "uuid": "da1beb56-e8a3-4eec-918f-3649df3deeec", "comment": "Malware payload (AgentTesla)", "value": "5ca37a686ea5b3a6a56e3d97434f7cc695ce4b47", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303276, "uuid": "9d611ffb-37f8-4b48-b547-656ad910d39e", "comment": "Malware payload (AgentTesla)", "value": "e1beac9fc14531c593c65582cc5500a970e658032d614debf38b9627bf0228b1d1707270751d1cab0ff99c74647676e6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303276, "uuid": "2ceeb3a9-f9ca-44a1-810c-5886656d4c14", "value": "T125E423161A08A835B941D9FFCCC78AC46BEBFDBD516E2BDC1106F0B2165F2469A01F2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303276, "uuid": "69975cd1-a118-4f12-b68a-e14bdcc4fb37", "value": "12288:hZdWthkyS5BZ9EItnO8xMoXuEblUFrP6LUKYPzW744N:BWjkJ+AlxMoeEblUFmU9b+bN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686303276, "uuid": "4c3d1604-c994-4757-9362-3de6e155af4a", "value": 676124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686303276, "uuid": "3a0aa798-cc85-4d30-8a52-4d70384ab9fe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303276, "uuid": "1c9af57c-c214-4df2-b970-f66a705fc715", "value": "RFQ-SIS190523CS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8d97453-0692-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686293746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293746, "uuid": "149cee36-ae8c-4aa7-9ecd-f9b69decc9b3", "comment": "Malware payload (AgentTesla)", "value": "da2016b84be807eaed663a146e3428b8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293746, "uuid": "cf24efc8-b0bd-4f46-975b-15644127eab7", "comment": "Malware payload (AgentTesla)", "value": "137acc4163cf5957ffe8fd34d70af35d996f442fd2700bfa66f589647c2206db", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293746, "uuid": "e5b4c64f-b6b2-483c-86a7-8e2c1b6b4767", "comment": "Malware payload (AgentTesla)", "value": "a6cce55afeb88fddea06676362f21795599700ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293746, "uuid": "f9f8ffbc-d065-43ad-a1bc-cc1596db4674", "comment": "Malware payload (AgentTesla)", "value": "8d3ef48b53711f9c350540647cc613eb3f889214fb81278fb18b4d2694c8eb4293e08e2a3c4f781928cf7f09e81dfd4c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293746, "uuid": "c2026330-2d16-4147-9b57-05387ab532f3", "value": "T16001F50839E4B0D652CDD2C0860424EB5C45982FDCA4A62F516D8D52AA20DF9CD2F7CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293746, "uuid": "6a88b64b-9ba5-465d-b034-b7dc1718b179", "value": "12:aUTatXYGmWeTys8agTiSCJkQBf4jkOPBxmew7oFyVloA0QSqtBJcR+nMPDVaXtsZ:GYPWMgTiSCJSxnw8F+GASqtBJcR9nUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293746, "uuid": "3b758fe8-f620-4456-8ac4-1b88af14717b", "value": 795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293746, "uuid": "8a7cb438-be2f-413d-823e-18ab648e4099", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293746, "uuid": "f1766f47-834e-45fd-a1ba-dae9c9d5d9f3", "value": "transferencia,pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "270a2178-06b6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686308990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686308990, "uuid": "70c0abba-29c3-4fe1-9e6c-ad3f41cb9985", "comment": "Malware payload (RemcosRAT)", "value": "9ba41f60c3eefe303c3d52faf20161d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686308990, "uuid": "bb275e49-96c0-4658-be5d-631ee1fcc63e", "comment": "Malware payload (RemcosRAT)", "value": "158c503fea108104f179c5f3dd77ca6a426383c4b0da19c82e40231a3eeb60de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686308990, "uuid": "3f5e8a69-7351-476a-9100-77e46ab7134c", "comment": "Malware payload (RemcosRAT)", "value": "241354ce4d0f2b5c815f09390cf3ecda82a50c2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686308990, "uuid": "58161184-e014-443e-bc20-dba01d894382", "comment": "Malware payload (RemcosRAT)", "value": "fb1eef10b2f2960bcaa719c4e2828e7ec8a725812eaddec9ccdee6bcb6b7725b98e699fd29966dc4add40ee95d1115f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686308990, "uuid": "b5fd09f1-d327-4ef2-8e4c-48980fd32ad8", "value": "T157259E6772B108BFE29B1D368C9BD365592A7E201A385446B7E67C8CCE362417C35EC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686308990, "uuid": "ef3a9ef7-6dcb-4eb9-8b2d-3c33d154a5b7", "value": "17581eeef5c5b8e0637670877fe87bb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686308990, "uuid": "b4b773cd-db48-45be-937b-0b5bc047055a", "value": "12288:jRmIcCn67ZSgSZcKqe5aITzOFjHYsHlTs6EJqdvcFsymAkm4crYF6T:jR8zS0GTzA48InMvamcrY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686308990, "uuid": "a007d191-2a0b-41ea-a9f0-d23e0aedc98b", "value": 1047552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686308990, "uuid": "d67b29ec-99b0-47ac-90dd-66522978fef6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686308990, "uuid": "83a9b555-167b-45c1-953f-0945641b038e", "value": "158c503fea108104f179c5f3dd77ca6a426383c4b0da19c82e40231a3eeb60de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf6c2c4-070d-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686346661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686346661, "uuid": "5f32262b-c1a4-44da-af74-18614ac7cffb", "comment": "Malware payload", "value": "462f6836195fe80f7146cbbae25bfb55", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686346661, "uuid": "92976e8d-a0c2-409e-93f9-b4f61f44dcb6", "comment": "Malware payload", "value": "15b5552337689004a2489aa0c9e1b00bc8bfc624aa251e2cc296c571fc1d12ce", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686346661, "uuid": "ba1008ce-d18e-4c94-909c-dc13fb86a0f7", "comment": "Malware payload", "value": "5a49c9190ffba483a5722c78d9469fe23847ae77", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686346661, "uuid": "1bf600ad-a4ad-4f9c-9829-f02a116bdf9a", "comment": "Malware payload", "value": "64906a6e8fe0b71ee2cfa1a46d34d18656fbb06ae36a9c3c5a998e8b1446abe0eae53bb96280be67d2c8e8f39f6cae8c", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686346661, "uuid": "fe81b88b-4438-4a81-ad4e-9495a5e2d19f", "value": "T184963B2F72A48219C65ED73BD0A78F40E53378B51733C1E752A413A91F229C59EBFA60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686346661, "uuid": "1d055aab-d0f6-4c2c-afce-5973cfad317c", "value": "49152:7IfJDIhUt3CcyLef9T404A42Zh0CQPDPnPeAyhMMfP6/BvvS2kTceXrLhJikRuEy:hhUdnkMaJODJugQOA0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686346661, "uuid": "1b9683c8-f938-4c6d-8ac0-7003366cbd11", "value": 9238016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686346661, "uuid": "88826739-e640-4824-a3b1-3616de606574", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686346661, "uuid": "497c7eb3-03f9-477b-be2c-08f9967f6206", "value": "Archive_2023648358d22d6b1.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d3809b9-06bc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686311577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311577, "uuid": "5b984c32-d0dd-4668-a9f7-20434fe9ecc3", "comment": "Malware payload (AgentTesla)", "value": "14167d46ab702d6b50fe1d3c77f8f1f5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311577, "uuid": "8144d376-8507-4201-873b-dab9364b6ddd", "comment": "Malware payload (AgentTesla)", "value": "15e42a2b2e8289d8690f08bb2ec3bd0f56769e7c84e509f1b71c63c329769a4c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311577, "uuid": "b2d53038-1ed5-40fb-a1be-a158869cc61f", "comment": "Malware payload (AgentTesla)", "value": "b4c6fe068b3ad1fd2195f43ffc46cc43a77a4738", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311577, "uuid": "beabdb0d-d55e-40a4-8db5-402b99cadbfb", "comment": "Malware payload (AgentTesla)", "value": "cc10677de26b1de04033586ae2a681bf13b1809b5a4aef12cd0fd63dbb7a2140f846a50c0101ae2c334ccffeea9f9fce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311577, "uuid": "7664613a-4035-4e55-8fdb-d1858a646d92", "value": "T1FFA4237B12B9FDDF06CB950BF69373BC8F0E60EB49147D4068AC84152974D4E626398E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311577, "uuid": "feca9e69-a1ac-4cc0-ad08-9949e591f7f6", "value": "6144:11rsyT/ZE2opEMgRHXx6y8IlyjbDEY/RV+gj3Mq/kHG6pTmbFLuRJauY7v+tUlOA:b7/22oqMglXgy8iYX53Mq//6sFiKuYFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686311577, "uuid": "5db64f8b-e00f-4f28-97f9-1b4d9257a63b", "value": 457172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686311577, "uuid": "57b94bb1-82b3-483f-8018-20718521b586", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311577, "uuid": "b49f1fa4-c3c1-4142-b389-b3be13626a67", "value": "Transaction_Receipt.LZH", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d782fb1c-0691-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GoldenEye)", "timestamp": 1686293395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293395, "uuid": "d2a25ebd-c02a-47f8-958f-fa912cd87983", "comment": "Malware payload (GoldenEye)", "value": "ee33c75ed9799db8d45078a01de53447", "object_relation": "md5", "Tag": [ { "name": "GoldenEye", "colour": "#AB7511", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293395, "uuid": "7bc1ff34-ec28-4ab9-b5dc-a26b047ac4e4", "comment": "Malware payload (GoldenEye)", "value": "170680a09289ac6969171ff4173cd7a17106b8a5a3443ca4c987cb32bdc39808", "object_relation": "sha256", "Tag": [ { "name": "GoldenEye", "colour": "#AB7511", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293395, "uuid": "4a6729fc-294c-4877-b9b6-70ded4064b16", "comment": "Malware payload (GoldenEye)", "value": "434215fb9b1034f8d4e19a54e4d83979249a1294", "object_relation": "sha1", "Tag": [ { "name": "GoldenEye", "colour": "#AB7511", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293395, "uuid": "ffed5e2d-d6f5-418b-8d97-35a8f5d214f1", "comment": "Malware payload (GoldenEye)", "value": "38b87c3c9a120e5dcf15bb503875e8e4c5b07ed662b34ad5d2e99a9df5e9e96152fbf8614f3d2b73d50a96f1a2ab5415", "object_relation": "sha3-384", "Tag": [ { "name": "GoldenEye", "colour": "#AB7511", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293395, "uuid": "94c4c7d9-0a82-4a6b-88c3-985f8825ceb4", "value": "T1D58412CFD33A1803C42655B517E28B55AE7E1FAC20D9A318512BD77B2FE06AAF9D401C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293395, "uuid": "148191e7-150d-43de-a2f3-1099ac9f3640", "value": "adc91e78c31ad4f7f2dc94e73db3a3f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293395, "uuid": "6effc57e-810a-4326-b997-8cb23405f73e", "value": "6144:sLh5iWs5gArF3LDd84ESQoCGhWg2ZQkyDfTbjfyLX1WYaaGM6Btc2:sN5iWs5gZ4E6CyWgcQBzvja4YaaUtc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293395, "uuid": "7b91420e-2e28-4a6d-8ebc-d035f87ea9a4", "value": 375160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293395, "uuid": "4ddd4843-52b5-456d-b48f-db316292ae51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293395, "uuid": "5985e410-ba4f-461b-aa5f-76bfd3508ae6", "value": "01227799.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cb7da15-0693-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686294101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294101, "uuid": "6a40f9e0-7cf5-487e-987e-a74b9ae30683", "comment": "Malware payload", "value": "b44b94df840da5bae058ac996ef0a875", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294101, "uuid": "939a0107-2000-4064-b230-53de14c2dd08", "comment": "Malware payload", "value": "191254f5d9a61ca1cd6df8818d1d57bf2d9f68dc30bb53da450f84745a8580e6", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294101, "uuid": "ea6fd29c-5fea-47da-99db-cd6bd3b98c89", "comment": "Malware payload", "value": "2debf9c96fd3d0eb5d60ee637660aa4db4933d8b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294101, "uuid": "3baea36a-a621-4178-ae84-1192182e94b7", "comment": "Malware payload", "value": "426c7f4035abca7a0ebbfb06ca056453238956cfee40cd7f84a9b21f11a2c3602d8ac9653297504abcce9f67b8e823bb", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294101, "uuid": "f204cbe4-aca0-471b-b57f-fd98b265cc05", "value": "T17B047191BA27ECA7E910063476B5F22311476E237D15CE592AD3B20E43F3B907C79E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294101, "uuid": "dcbab795-d8d0-4169-b612-33466f8c3f78", "value": "3072:WkZ+RwPONXoRjDhIcp0fDlaGGx+cL26nARXN2frXiG3Z9Muit7nLrFu9kLwvGCcd:jZ+RwPONXoRjDhIcp0fDlavx+W26nARX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686294101, "uuid": "9e0caccb-fbb0-4a69-85c9-1d435a3d4f95", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686294101, "uuid": "0712e3e8-7d7c-48e8-aaa1-1b3619a5888f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294101, "uuid": "3b336f2b-228e-41f1-8240-e778efc15196", "value": "TransactionXreceipt.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0780461f-0714-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686349310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686349310, "uuid": "29f330da-15fe-4b0a-9c33-de6179095bdc", "comment": "Malware payload", "value": "fff4df320bea4d52f826c74d11a00121", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686349310, "uuid": "997283bf-ab16-4a58-a334-3d718fd7d9cd", "comment": "Malware payload", "value": "199ca464a6d10d99d4a30af13429c05dce5f5c275a57455b3d8e621b97016469", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686349310, "uuid": "11f7174c-0bfb-46f0-8f17-96e6a1758a4e", "comment": "Malware payload", "value": "ed81cfd82bfd1cb4c7325bc1bde0fb9fcffb6bf5", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686349310, "uuid": "30f2e93b-881b-490f-9705-7aca63f91bee", "comment": "Malware payload", "value": "9a2efd24a59eb73f024f8040905f46b6d96c46c9e9eb9b4dfd59e9575a695fc3253ba6a2af6f3dad1679257a8a014c8d", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686349310, "uuid": "e16c3ebf-e7e2-41f0-9a35-cfe476863b92", "value": "T184612C472B09074D57B8FA9442CAE0F84D61E008F1558588F1D973EB80A168F7BB64F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686349310, "uuid": "e56491fc-cebd-4cc9-99fb-2ab7a3eb9ac1", "value": "48:QEkhR74PakVs994MF2PQr+QB1aHJMiUyHdhRnt20mBMGmFQSlOpoiAAM7W8ZrVEo:u+Rozq2ANnt1DOU7brm87NxA8BHD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686349310, "uuid": "f2b24c13-16a3-48fb-af57-4f51151710e7", "value": 3273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686349310, "uuid": "eb9f1c56-e8f9-4fd9-96be-6a3cccbda1f9", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686349310, "uuid": "d755db78-6d52-41ac-9ab9-8c20955e10ab", "value": "5.php.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6c52dc1-06b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (PripyatMiner)", "timestamp": 1686310090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310090, "uuid": "1142a11a-2cb9-43b4-b0da-021e242ce585", "comment": "Malware payload (PripyatMiner)", "value": "cda9cad10259f666b2274e711e2ed9fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PripyatMiner", "colour": "#2B62D4", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310090, "uuid": "7fba2861-1635-4153-82f6-b7ed3cc861d8", "comment": "Malware payload (PripyatMiner)", "value": "19aedf2b14d90e4cf5df0a8d533b1b9024ffa46ed56434ddc5d0ebcaec2487e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PripyatMiner", "colour": "#2B62D4", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310090, "uuid": "6616f122-a2c2-4de7-bf89-e5dee11b27b1", "comment": "Malware payload (PripyatMiner)", "value": "f08103e661d2b6647471e8d43097674e3fbefd1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PripyatMiner", "colour": "#2B62D4", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310090, "uuid": "8d89edea-bb45-4559-bb0e-683d4db73faa", "comment": "Malware payload (PripyatMiner)", "value": "703e2e11014c934c1764a7a2ff3382047b5be0193ef131cbdd115d7ae3f86436124493710651c30f62eb121a93f134b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PripyatMiner", "colour": "#2B62D4", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310090, "uuid": "903f6254-7d53-417e-82d7-b371299ba835", "value": "T1C3A6D1719C962E8BF712CD3C58B0023A8C95718374992CD52A6572F3446DFDA2FF9A32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310090, "uuid": "6d39c6af-bb2d-4fff-9579-fc3a32eb4a29", "value": "f7505c167603909b7180406402fef19e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310090, "uuid": "d76fc712-fe78-486b-b818-aa861d32a5cd", "value": "196608:EoIRq1Ed0LseErZ4ZHafDIl7lf6YC1zmAuIV:EoEq1Ey5Erqkfkl7ezuu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686310090, "uuid": "e0580323-6fd5-401f-92ab-b58489e5fbd2", "value": 10384384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686310090, "uuid": "c3b75d2d-17b1-4f8a-9961-fdd87d98c506", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310090, "uuid": "64156a47-1e34-4da1-8f71-1a00852bd3fc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e5be2c0-069c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686297808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297808, "uuid": "66b02f3d-d0ec-4b74-989e-109faa7cb1ae", "comment": "Malware payload", "value": "40c7e552b9a985a5433d8c0a64436fac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297808, "uuid": "6ef275c3-3fe2-4b59-b1a3-d7002a1e4b8e", "comment": "Malware payload", "value": "1a3c864ad6aeeaa132017752d4eb49d8f23a7da4b651117e28176b6b2c630741", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297808, "uuid": "7910ead0-4727-4b49-bca8-99ca04966147", "comment": "Malware payload", "value": "ab55cac0c20b6d3dcb25b2e69fb0051905a7e475", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297808, "uuid": "3ed6ddd8-00e1-4c93-b6bb-68588d0f8873", "comment": "Malware payload", "value": "1e8f1e37492d279f6b8b0f6b65aed66d6122561ac48665d7bcef6426cdda75dc467ad03c6ec911eac3fc7682607a1775", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297808, "uuid": "6192e88b-b15d-4ecc-87a5-354f2c943677", "value": "T18983BF022B24ED80ED464E3070EB4B316B31FD55ADD087E72396F16B8EB33526B5619E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297808, "uuid": "a26887bf-8ef9-4984-a72f-64a90291771f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297808, "uuid": "4d64c929-8baa-4625-84b2-6eef029964eb", "value": "1536:BEid53rMhvjln5lOtjzoACK+yw09HXfqkSZZZ3g6SibIWLPxRG/PxW:iib3rMhvjln5otjziK+ywMHXNUzbIIxp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686297808, "uuid": "3d9c4225-8014-4ca3-8572-6605d384166c", "value": 81880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686297808, "uuid": "f651ab0f-daa1-4e73-821f-6aaacab1e518", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297808, "uuid": "5b277b20-4746-4a17-919a-529c595a2488", "value": "purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb7639de-06a7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686302904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302904, "uuid": "6aaf1155-7955-4052-977a-a4fdcfd47df1", "comment": "Malware payload (AgentTesla)", "value": "a36881112d9b6cb8abb0ff8fb3c3dbf4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302904, "uuid": "4d50f110-7c5a-43ef-b0da-fae9a453b49a", "comment": "Malware payload (AgentTesla)", "value": "1b80b9d58bb6b3f95abaab07a58e5fbab1d070a3a0c0df2f67ac628c9f7be058", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302904, "uuid": "72213f8b-715d-4b8d-860e-d72be272b9b8", "comment": "Malware payload (AgentTesla)", "value": "e1e7198b8b7669abfa8f7fb58ba1f6833f5ffbc3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302904, "uuid": "5079b0fe-665f-4216-b50a-fe51d2a52ffe", "comment": "Malware payload (AgentTesla)", "value": "539e3af89568116a54a701934cc3fd1df5aad03c79b8bc530f39fb34f62f2ef88f905997b7500d8d98b6fcf79aa661d6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302904, "uuid": "f8652d03-93f5-4e75-a018-28eba2d8ef3a", "value": "T1CBF373D3B21288D6F93847719D23C98915A7FDADB8B4156EB09EB7780B773830412B36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302904, "uuid": "b139144a-c499-40eb-9d1e-efa903020bd5", "value": "768:BNLE6ewSRmSTY94dWN2P7b1IzPrXMkN336DX2AAV:LE6ewSDY94du2PmfMkN3KDmAAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686302904, "uuid": "22da0a71-3831-4530-867c-03d358c4144e", "value": 157696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686302904, "uuid": "87ecb34b-93ce-4508-833e-49d2d72c93cd", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302904, "uuid": "9bf4966f-5e4f-4be0-890f-cd4f68476978", "value": "Purchase Order 11013.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f50c1f6f-06ca-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686317925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686317925, "uuid": "a40c47a4-bce8-4f3d-aebf-bbeb5dc297bd", "comment": "Malware payload (AgentTesla)", "value": "42eed95058ac69718526e24712aa5f3e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686317925, "uuid": "9398ebd8-4050-4cab-a851-2d2e7a89c9b8", "comment": "Malware payload (AgentTesla)", "value": "1bf200243f1f9227d2573320292d1d0e7dad67b17b85ca3cec0515cc39a5edb9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686317925, "uuid": "51b87f42-6eb1-4bba-bf67-eba9b08eea68", "comment": "Malware payload (AgentTesla)", "value": "0ef22f33a50d9e18e104b6243eb4a2ef9ac44862", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686317925, "uuid": "34f3fbe5-ef6b-4991-9549-00784a524ec2", "comment": "Malware payload (AgentTesla)", "value": "85f4c72492539e8df7a1193260020b427867d9a84a3b1912112d2782dd7ee586b1f05f3c378f985e7829fa9a67f588ac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686317925, "uuid": "76243c71-1697-4417-850d-9ae3bfc0c465", "value": "T1F752A410AB5CD521C9B54A35DC1213F00223AE69D975971F38ADBF0E7BB77831A32396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686317925, "uuid": "49197b79-ce97-4b9f-8212-6b6faf33d9bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686317925, "uuid": "51c7b9f9-5644-443a-ba6b-92c2f0da3a65", "value": "384:hhbpf8+i/Niun/vzmLEySxFv5JQzKoX98:nc0M3GmTJQzKy98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686317925, "uuid": "6a9510c8-4597-4d34-88ee-9afac32372d3", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686317925, "uuid": "fc620939-fe93-457a-a359-f9a7def38d07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686317925, "uuid": "8cda16de-2d27-4601-aa7f-2357aa975133", "value": "Products_Sourcing List-#June Order request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0920ea49-069b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686297343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297343, "uuid": "0763b9ec-023c-4eaa-b9f0-894aa3e986ae", "comment": "Malware payload", "value": "176692d86cc4d89bf731ae3639eb5313", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297343, "uuid": "07e00ebe-e754-484e-b576-9bc8564da203", "comment": "Malware payload", "value": "1c4ce65bd75a1093b173417455db9fe48fc948cd5e35ea9418018b33e0dcecf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297343, "uuid": "3e82c558-f16d-406b-a6d3-61ab13ff10e5", "comment": "Malware payload", "value": "022a777e22b8066b907c57113d6a7547a1d31cc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297343, "uuid": "4844be03-f2ae-48bc-a3cb-8de90f46cf3d", "comment": "Malware payload", "value": "e1c7e43afcdecd4186f4d90ccfbce94d1c11c9ff1aeac32327f90ec0f7a4aee2f3de77a85a93981a08e21c60dd4987be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297343, "uuid": "35d38bd1-58b5-4d58-9d4e-dbfc700b7214", "value": "T1F605127C22AB861EC59A7FBD0D222671C3FC99817863D2070FE72D99DF61B1089D1993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297343, "uuid": "b88dee72-18d1-4cc1-9418-7439da2da404", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297343, "uuid": "2d99c7ae-5145-4663-99bc-0769ed6f55bc", "value": "24576:l1iewlqB6pYmppeD/QcccsTyWImuxpUzznI1zU6:lQe2q8p1ELFVxpx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686297343, "uuid": "07084db6-4532-4e41-9890-b1133c57982f", "value": 870912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686297343, "uuid": "08d92821-0f55-4006-9c45-3561ed37adf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297343, "uuid": "96b8a130-de23-47c7-a687-af55f092b419", "value": "SWIFT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1c0206e-06a0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686299801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299801, "uuid": "3e8b7eab-fa98-4653-837d-620370d25faf", "comment": "Malware payload", "value": "2bf23bb093d9b2b429211aaf8763b217", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299801, "uuid": "0132ef53-2206-4fb0-88e3-e14f6d1966d4", "comment": "Malware payload", "value": "1c50164262fdd6c49319dd933537a41ed3f60d55d60d182d5b8f6acb446192e4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299801, "uuid": "dee9c906-5645-416b-8f93-0eb8f908d792", "comment": "Malware payload", "value": "97e205092c82d844ae08a36ada8e3f0b9ed67fd1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299801, "uuid": "7a1a676e-1888-42a3-95b0-ae0ab19665b2", "comment": "Malware payload", "value": "9b2a05f8a36a4a5adbb20c90be987d819664d62ffe2c87729b307ed2c11d65c57d66660c484948688714477ce03230b9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299801, "uuid": "88f04a4a-9aaf-4a7a-ad09-78d3360f6078", "value": "T14FE4230CCA43BFE4CBB5CA0AADECD422D7EA199D572CD61F3AD0CB77055886890B505B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299801, "uuid": "cd6c51d2-720a-4985-a014-01324bcf8a64", "value": "12288:6JSNNpXPdysloHnpv2g9wMQgUgedEzagY0vq+dBuxQKNVipNGYAZon3aUxZAJ:6gzJPCHh59wMtUgedEzaH0vqiAOpNGYy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686299801, "uuid": "dcbb50c1-0202-4c7f-bd99-9707980b371a", "value": 702503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686299801, "uuid": "794526a7-0f4d-4189-bcb8-e82b787424b9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299801, "uuid": "8b250d2d-374b-4df3-8f04-4d6adc8eca4d", "value": "PI_1304021.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "167503de-068f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686292212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292212, "uuid": "99e29302-f76c-4316-add8-8c2c571180ec", "comment": "Malware payload (Loki)", "value": "373f95c61da8ab642b0346667e27a49a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292212, "uuid": "dc0f8954-1118-4d6c-9868-2ce49e262cf2", "comment": "Malware payload (Loki)", "value": "208c3dad7d46073d474f2bce39c39bf465f4b008f50c06163f8879c230719a1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292212, "uuid": "cbfb570f-88a7-4701-ab18-00d5ec3e82c7", "comment": "Malware payload (Loki)", "value": "4b6711d2ff632364e106dd17bc97ba7081f40264", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292212, "uuid": "0faf30ab-7c55-495e-a10f-7b3b2eabaf32", "comment": "Malware payload (Loki)", "value": "8fc9d49e842b8bb457d69d9600e47ad6daa44b3faff413da71c032fc4bd9182722bb3f5fc3ebafe2bdf84a6a9f141e98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292212, "uuid": "89d0b903-b2e9-4d91-9fe4-75f423ea0468", "value": "T1D01581242AFBA01EF173EF715BE4798BCEAEBA633606A45E105103474623D41DED253E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292212, "uuid": "1a67d726-12dc-4bea-b99a-2aa9c7d5713e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292212, "uuid": "ca94b68c-5fef-4a5e-b40a-97a6b99dc324", "value": "12288:W4YuyJOl3GHjR/vBDOdgcvyzSFdHejalCBCYWuywkhJ9g7/U+7GJEhsxhop++KGV:WINGHjR/vBEmkX1DgA6KG/9BBBBBB4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686292212, "uuid": "06931abb-de95-4f05-a7d7-87d45f3bdd97", "value": 948736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686292212, "uuid": "ba209765-148a-4b88-9ba2-ece7340ca97c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292212, "uuid": "20f5a332-3516-4ade-87f9-8757a83a195e", "value": "IMG01367822pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cefcca77-06a9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686303688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303688, "uuid": "2022ebd3-e131-4dad-9564-3e6fd0564792", "comment": "Malware payload (AgentTesla)", "value": "f8e8ebeb4ca5baa0fa1e259cd75266f7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303688, "uuid": "61699e97-6f09-4721-a18e-2dc935b3bc8d", "comment": "Malware payload (AgentTesla)", "value": "221cbe3d9337980d54b25da354e9668353bdce5fc307905821617dc767265d90", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303688, "uuid": "9aad7224-ec06-4d8b-a44f-67dc38d584d6", "comment": "Malware payload (AgentTesla)", "value": "68896d9d7f58db84c0823e314ff78c40d7c749bf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303688, "uuid": "8efbe1c0-b9d5-4d32-9ed3-19390239bf60", "comment": "Malware payload (AgentTesla)", "value": "a867526b1e97ac8c002f0d944947fe420b428dffdff48b1aa7596a93ac72de829e09269212dbc441c3c6e7cce77fc563", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303688, "uuid": "a6319650-cf21-4b84-a190-357f076711a4", "value": "T11505D054337B5F25D43A7BFA4810593447F86A1A783FD24A5EE2B4CA5D60F610E80FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303688, "uuid": "5bc0c3c8-b087-44de-b2b7-8d481a657be2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303688, "uuid": "10627937-1780-4c8a-ae18-7906f73cd513", "value": "12288:WHr85haDnLMzIL2q+RTdOL8fnhningrzHG3ulgU306CboBGm07/YwhVDs:WAOyqGUL8fhrzmPURQoBGL7AwzDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686303688, "uuid": "3028dc9f-8a5e-4e6d-a583-75fd1495f843", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686303688, "uuid": "6f02580e-7bee-4850-88ec-f315ffa12548", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303688, "uuid": "36612920-5fcd-457b-badc-2ef86980170c", "value": "CREDITED PAY SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f42c5040-069b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686297738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297738, "uuid": "67ce8b04-d22a-4987-a430-9ca72680b8df", "comment": "Malware payload", "value": "d3dc5a3c9621864bba383e22d08df74e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297738, "uuid": "d2f7e8ea-139e-4425-bd15-ddf69262dc45", "comment": "Malware payload", "value": "245a20192e8a60b33f64b2b7d118c9d5db7cd4a91179df7689a37e8ce7d29d20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297738, "uuid": "ee8dc479-f778-491c-b197-c2e020fc6d11", "comment": "Malware payload", "value": "3c8218060391449a2014b517488db08b9a19ea16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297738, "uuid": "528be061-2681-4f69-a420-c67aa90bfd04", "comment": "Malware payload", "value": "41dd3f1d8d4db5d48d250f4378ac7cd7661c4b579e4966bd43bc95457b72152a37f62d52401438ee644704811f8c1155", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297738, "uuid": "1db3c47a-e345-4359-a9d1-f6d29ff7dfc0", "value": "T150F4126822BB565DC4AB3F7C0D201675C7F81AAA7463C1234FAB6CDDCE62B140EC4997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297738, "uuid": "a5dc3ef0-6c17-46b3-aeb0-02cf2336ddbe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297738, "uuid": "89d4505a-8041-4cc4-b5c7-357540c93b6f", "value": "12288:Y2iNUewx/NscEQ+vgXK1HsaDuOv8Bsi66d7CoRZGmH1eG6qNuy3+nVqoh9G/q:Y1iewlqB6p2Oii3rGM6o3+Vqo2/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686297738, "uuid": "813d1365-6370-44b8-9ea3-5dbf6a0744de", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686297738, "uuid": "ff8c01e8-146e-41ff-b8bb-ff3569f78cc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297738, "uuid": "6bf3a66c-6b97-4b26-9ba6-b7f38a87fefb", "value": "PK01508Q0014968PKKHI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d165b8cd-06be-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686312712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686312712, "uuid": "003c7d09-e96d-4b84-9495-6b94c627a5e0", "comment": "Malware payload (AgentTesla)", "value": "5cc5088875572366cabf7f50ff7b795b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686312712, "uuid": "dddd4eb7-53aa-4812-95dc-b3c7183d27f8", "comment": "Malware payload (AgentTesla)", "value": "246178e5a70ad85c7932c2d594bea255f5acb9bf18ffbfefa55319fa6f3a40a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686312712, "uuid": "a8749dc9-64be-48d9-98a4-fe50a0201bdf", "comment": "Malware payload (AgentTesla)", "value": "46a954429d5afabdde461c2caae839113fd8bcaf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686312712, "uuid": "dca6312c-8add-4fb8-bf2e-1b99eacae6c2", "comment": "Malware payload (AgentTesla)", "value": "0a60969f6b49c37550e229280dd9f2fdb7689aa8ac0a5bb260dafc6f7baf006e1a07122c274bd3706e62c04de3895775", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686312712, "uuid": "d770afae-d35e-40a6-a239-8339fcd6a628", "value": "T1F2E433191BF4D86B67C3F61328129685329803E792DBE0D4F1E085BBBD6EA4F31D2257", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686312712, "uuid": "2cf39467-1372-4d57-9648-c197112d9fc3", "value": "12288:8D7y+pMQA7fW8sPv9NLy1Sqc16S6vNVC098OQsnTrycW6WXGBR:8nSQA7Iy1/26S6vNkrA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686312712, "uuid": "356ace2b-a845-4c8e-b04b-1f2693f66ec4", "value": 680552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686312712, "uuid": "2bf3c470-ad39-496d-8850-4e4986d0fed1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686312712, "uuid": "23a848e3-75b4-47cf-aa78-51e3040bfbab", "value": "arrival notice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef930e57-06f5-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686336385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686336385, "uuid": "6870f023-83f3-47a4-a294-8d40215095b2", "comment": "Malware payload", "value": "3fdae1de5817471f8ff3cfbfc8337368", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686336385, "uuid": "d22aaf5c-728b-43ec-95b7-3efa5321df23", "comment": "Malware payload", "value": "24c172f53a9b74a71e0467d35513d505ba1f000f78b4c98ab22a317fa7c43d7e", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686336385, "uuid": "82f20fe6-4aa3-48f3-9dd2-098622ed1cf7", "comment": "Malware payload", "value": "da80e991284573258da8adb3e552cb83288acc02", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686336385, "uuid": "6dc2c429-b65f-44c7-9c5d-33aaa1e982e2", "comment": "Malware payload", "value": "a43dfb16181315394b7608681b8e07754c03517d90c186469f2435bc58b4e231009559c9499aa62eb85446ab2e2cc80e", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686336385, "uuid": "996f3b9a-5730-471b-925e-9585ff373ef1", "value": "T1DA14D02A27D8CE7F5CA8B05877863F88C30F3C89DA54829507DD52CCD5D82AE259EDB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686336385, "uuid": "4d92718b-bd07-4a0b-ac77-6643642d11fa", "value": "3072:E2ZGW7iNQ0bLBavnNouS9J0ZbvKx451BSeCsz5mLSjJPjYjgnQas1t+:EWGvuZv49J0ZfgBsz5YSVZUD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686336385, "uuid": "aecd2495-8bbb-4e6a-b030-a0c039a88bb0", "value": 197792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686336385, "uuid": "01ec0f5a-10dc-477f-b922-5142acf6e22e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686336385, "uuid": "714399f8-d8eb-41cd-be44-c026d83ca7c0", "value": "rhipolito-da03669nit.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a78e207-0690-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686292782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292782, "uuid": "9bb92458-0636-466f-8bf2-19375f792c43", "comment": "Malware payload (AgentTesla)", "value": "49904bd0157d8180578bbea3058e7b31", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292782, "uuid": "1db3b1f8-78e0-49d9-a501-f4f14cef1970", "comment": "Malware payload (AgentTesla)", "value": "25300a6afdd9084a8ea11d4881387ab2545652380643603f8e5fb1da74d57486", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292782, "uuid": "92496a21-9957-4d44-b304-a607fa64e860", "comment": "Malware payload (AgentTesla)", "value": "5253ff713d7584ccae0a88c141035d2ccce709f7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292782, "uuid": "5b7ceb4e-5f17-4e04-813a-2e7c61a659fd", "comment": "Malware payload (AgentTesla)", "value": "dda2c07f1d8dd9564578d70c46149965edab50963e52b9c5e5c00ce8c110100808d96af1e50959583c36fc05b2db7ae6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292782, "uuid": "8140c761-903f-49bd-8286-eb33e7d3facc", "value": "T197F4016F2ABB491EC4967FBD6C302AB1D1E94E477027C15B6FE6BC5C9C31A084D811E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292782, "uuid": "6d33e689-e5d4-46dd-930a-a2fef1c6c116", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292782, "uuid": "f1ebbe22-4652-4f97-a6cb-00fb85fc9689", "value": "12288:PJPWR28Le0cY+Yg9fb9guxZ1AmCeJQurDXvj6AgSQD93uWIX6+WUD+M7OE:Pt+xL9Rk9Ny4PvNSDOyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686292782, "uuid": "4fdeb879-059a-4be7-ac63-83bd3b941c92", "value": 751104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686292782, "uuid": "cb1cbaaf-ee1d-4470-8545-d9b0261495e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292782, "uuid": "90007682-e0b6-4667-b59f-4760db70d6a2", "value": "PO-MSC098376289.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aec71117-06bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686311365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311365, "uuid": "ea9ee852-8bbb-4b0d-ad5b-cc8342ba333c", "comment": "Malware payload (Loki)", "value": "fc62821d106398863e641123e0efb676", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311365, "uuid": "41a060a8-e71b-449a-bbde-ed07d74fca58", "comment": "Malware payload (Loki)", "value": "263612e07303edc09b44c6e4f3fa4ecdaf1ae8187a341283a7f9b373b77693b2", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311365, "uuid": "a8791b6f-992d-4ffc-9e73-acd92494d8c5", "comment": "Malware payload (Loki)", "value": "3820a080c1f626fdedab737b22eaadd3bfdda51c", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311365, "uuid": "bf265ed1-ede9-410e-82f9-56b7ba591178", "comment": "Malware payload (Loki)", "value": "d7ff02537139bd2b37dfecfa1f8d338ef97a6bee9c77ab2073b6762c337030ca1d92838b3ddee3ed9e8ad83fe09839f5", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311365, "uuid": "c25743a3-62f1-4f05-81d8-fa483f8c76f3", "value": "T1CDD4239E84EAB674069F6DE28B08C99D34F6ED4D6C04AE4244D40B4C78DBBCF6CAC05D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311365, "uuid": "0b8b9089-d763-4b35-a8d5-3121984c1d24", "value": "12288:MHDKyXFFJVWS95/vnAzUOQ6O2tyB0iXMU3zHR+/3RO4ynggjrVkNamFtfcWCcni:MHDKQVbb3Azlty+iXMU3d+/3RIjpkN3u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686311365, "uuid": "4daef835-2f0d-4b0f-84a9-c819038950e9", "value": 615763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686311365, "uuid": "cce27f02-b382-475a-82e1-706b663dba44", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311365, "uuid": "fd275a67-a329-4be0-aefd-13786125d7c9", "value": "invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "048af229-06bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686311079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311079, "uuid": "5a41ed37-13e4-4f2e-a3c6-863f125f1983", "comment": "Malware payload", "value": "56f5e439645b575db504a82743f93b8e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311079, "uuid": "fa972af7-2dc8-47bf-991f-674254970e29", "comment": "Malware payload", "value": "269b6c585d7475fe5df8311d2ad840bf6a99021a44d2086fd460a19daa10153c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311079, "uuid": "0ae92b7c-d9b9-423b-8f8f-c53916c291bb", "comment": "Malware payload", "value": "a8e8300418ea6de889c9e190afacadb6c61f3e19", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311079, "uuid": "77ccd803-99e8-4541-a787-ece2ed1261af", "comment": "Malware payload", "value": "4b6a346e227ebda5903489a5011b5cd180907e01294bd3914782e5aac05706faf0abbdd83d7a75e203aa873b0b19ea53", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311079, "uuid": "38edc95b-c3cb-41e0-ba38-fda78636547b", "value": "T19B73AE02B7D6CD67D13A397469AB93DC6329AE20CE2BD31F2084731E37366B92751790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311079, "uuid": "50346eec-d1d4-4400-823a-24510dc250af", "value": "1536:ehgUWcFjkyxeJ0WXQEb0rbL1cEAyjhTp+MMAxrtX:axW2jkgeJ0ME2EAyjh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686311079, "uuid": "6b752a0e-b06d-4106-a063-69c0770ed30d", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686311079, "uuid": "9201a84a-26ef-49cd-b841-49f5dd264101", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311079, "uuid": "05abf434-0a3d-4e6b-a39d-2339aeba98c2", "value": "NDA - Project AHGM.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa6c9977-069f-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686299466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299466, "uuid": "c90ac346-55a5-4b51-8ef2-f4073319e3ff", "comment": "Malware payload", "value": "52c0af09560bef0a9e8bfae88b78b45b", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299466, "uuid": "0e138e3f-2c77-4bef-8e38-40a02316ef3c", "comment": "Malware payload", "value": "2764ee1961b889dcdeebec74b04c46bd0d004d968a3d2609395b1c7cfd8bd6aa", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299466, "uuid": "e892f2ea-695f-48d9-80b9-2152c77fbc55", "comment": "Malware payload", "value": "3f92a15e6244de6ab5c5c5ce888660a143c7d632", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299466, "uuid": "b577a8ba-b538-482e-bb72-cbf72e0104ad", "comment": "Malware payload", "value": "02ccc86c21e8501dff9a8ffbac0db3ff60f9d9e52e40dea492d6b3fa0b92f56c89aa10614e5bcd77bca0942080d906b4", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299466, "uuid": "e69f8e4a-d1d5-4186-b036-5fbdc698041a", "value": "T105963103DD199B83A42987F8BE035EAC2F1A7B5CE99636FF05624DDB3D542111C9E02E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299466, "uuid": "a508a8fd-8920-48f1-b50e-59718d3399b4", "value": "196608:bVYu+WkcTtTZA/LkJaeD3W71Xg3esmVtsHU7ALYYegurw6PN:Z+W351qLkB3qUvmVtsRLYjf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686299466, "uuid": "195ef6c3-a6c1-43aa-bcf5-d1461efe6640", "value": 9247244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686299466, "uuid": "9af47bd5-9ee8-4944-98a2-7ad9ffbbf523", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299466, "uuid": "d83ea2ea-dd49-4a13-a154-afc6eff53ff9", "value": "Aviation_Services_charge_1stNov_Final.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcedfc62-0697-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686295981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686295981, "uuid": "44979e92-c546-40ba-b9d3-d4a355cfd981", "comment": "Malware payload (AgentTesla)", "value": "32f2d7c0a6af9eb96bc8a9f18a95250d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686295981, "uuid": "90bf2c35-15f1-4fb9-8475-7e01666a3139", "comment": "Malware payload (AgentTesla)", "value": "277e24866f14e56d5579dad72d309676a55f8fb446085be4679cd42b61eee918", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686295981, "uuid": "e3460437-0896-49ae-a8d4-35edb36ab6f9", "comment": "Malware payload (AgentTesla)", "value": "1f75de7f58f02640d65332cc6112fbe94e356699", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686295981, "uuid": "1bde05c5-47d3-4cf5-8d41-63dc43d2c6f4", "comment": "Malware payload (AgentTesla)", "value": "b7269cd939188bddea3d78d074e79d4e74351c266a0b47718a26a5b0e5186b5a211dcd013daa7e4211ada7153787208b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686295981, "uuid": "97f59bd4-6241-4b01-aabe-c3cd2fa2c2f5", "value": "T13ED5E6407EFBED9BD9B7BBB290C122B15660F481270BD35B4047027F4653B839D629BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686295981, "uuid": "23eacfb2-0a4d-440b-b904-de5436119663", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686295981, "uuid": "dde6ca56-7d63-42d4-8b85-105688f7da09", "value": "24576:nFQ24ZXcZ+sVM/urmZVeVBIRZFP8T5MizxHW1mSNAvRI:nsm+RxzeVBmZd8ONAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686295981, "uuid": "48372fca-0e57-4b44-bc5b-6fb5cf392108", "value": 2774528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686295981, "uuid": "51901a53-7d00-4d8d-983d-882c2dab98ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686295981, "uuid": "9772fb00-1043-4c9e-b8f2-5bd94f6ab8d6", "value": "IMG_2560_07588pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd291090-0696-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686295552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686295552, "uuid": "bdf55034-b297-477e-9e99-93db3c433935", "comment": "Malware payload (AgentTesla)", "value": "52085c6450d79958b936f97a144158ae", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686295552, "uuid": "66f8b6d9-4278-4138-914b-1c13690fd2ce", "comment": "Malware payload (AgentTesla)", "value": "28d55f0fa1aa7ef74ce845d43a76f94cd34ab5861b6aae5d565d123cb9314398", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686295552, "uuid": "8265a142-46ef-4b78-a881-56d42a322eb1", "comment": "Malware payload (AgentTesla)", "value": "6a6b2b1f7eb478413d9c31d6552ced2323712f06", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686295552, "uuid": "8ee05bd7-4106-46d4-8b78-d9faa60cf1c8", "comment": "Malware payload (AgentTesla)", "value": "e17b07987efcaa4131fe7846899b837c11124a40212e39f8a8c7892ac396dbfa6c44be27084da34c0c04654c05d4a7b9", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686295552, "uuid": "7a618697-ee02-4c45-b00a-18540aae58ac", "value": "T183D423C6551A860D636F39F2EACF9392CE016ED58D093184447E343C359EB4FADA26C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686295552, "uuid": "5c0813d6-cfe7-4c93-a1ee-40eacee12525", "value": "12288:ZfxYyhJWiFItjZ9YvrWkpbDsK4EEerdK0jvxAWo99TCsJo5UP:jYy7WiFaLkqgsK4EEeBpab9Q5UP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686295552, "uuid": "b97df98c-14ca-40fe-80d6-9672dddd71bc", "value": 600150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686295552, "uuid": "4fddc130-9137-4b9a-871d-4efb18c29c91", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686295552, "uuid": "66b17b5b-db8d-470f-bb43-56f94fa82c04", "value": "IMG_11560_0753pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a0376f-0692-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686293544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293544, "uuid": "a8f6c0f3-d041-4c92-aa31-8a80f5289c3c", "comment": "Malware payload", "value": "c4e9fc349d5c8b24c0ddb1533de2c16b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293544, "uuid": "f1955bd5-b2db-4dba-bd55-706e10332817", "comment": "Malware payload", "value": "28fd3a1d9087d7b103b7f6cfca002798b6365fe6ebcc66fa02dbb4a9e6378e71", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293544, "uuid": "008ab2ec-f1d0-45d1-b16a-c700a646046f", "comment": "Malware payload", "value": "147e938bd06709b3c20eea4ac461093d573be037", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293544, "uuid": "d58dc11b-bfd2-4884-8d0a-33f5fb3681e3", "comment": "Malware payload", "value": "3fd9c1f356f99532f7522f5ecf0f1b4cfce10dbca8ef6475b3d93051c8ec1496c88dfaf63a4c3a01f0d719161fee5b89", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293544, "uuid": "0702f3bb-96ae-4090-80de-564a0ae50bb0", "value": "T16484AF35B42F9F7395AE380D68082FED3D7607B7A9788624C44C58722165E9C8A7CDBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293544, "uuid": "9e080952-ff48-4292-b435-5960f18ccda6", "value": "6144:Jnm5mwYxm+DzkzFIDIWCy49ezGywT7PDSzT3enlJ1BJ0exGqkIb1Taha6e2T6Huv:FnaIEWeqWdnlhJ+eHHu+1Qk3C+MAQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293544, "uuid": "38cc8709-0d58-491a-bfd9-6af58ff6b93b", "value": 374644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293544, "uuid": "99e8e04d-be48-4a4a-aed2-c270798ad745", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293544, "uuid": "9fd28389-cf9d-4cbe-b77a-ec63f7dff84e", "value": "05556799.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac5a33a2-06ac-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RecordBreaker)", "timestamp": 1686304919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686304919, "uuid": "f339e96e-47e9-4013-ae29-ccee5e01945e", "comment": "Malware payload (RecordBreaker)", "value": "c9cec4f8428b00918678cc9d3e143c8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686304919, "uuid": "21547ba8-7c42-4168-8716-9e3c9f08df20", "comment": "Malware payload (RecordBreaker)", "value": "2a4477b3f498cc2c7da2e68c0719d8f0def3c85d63f931e714996829153fae81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686304919, "uuid": "278dbdf0-16a7-47a9-b86f-2c69af5d1e76", "comment": "Malware payload (RecordBreaker)", "value": "131d4f5a20dc7124179457c51bdb30f0ebf2a2de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686304919, "uuid": "4a94d0f1-e0e9-4e50-a8a3-6be24afd38ae", "comment": "Malware payload (RecordBreaker)", "value": "97a622a83f9c5313156ca5cb3d60c2dd88dd9d3a5638c85657dfb631977c95e3ebd6d6f78e9dad1ecb057f722c5575c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686304919, "uuid": "1ce73b1a-af13-44d2-a391-4330c9fc9602", "value": "T1CE0552BC9D07E6DBCE39E26A95F02307B3715417B65EB88C6ADA3B450D93DC122D060E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686304919, "uuid": "b1708acd-e273-4b7d-a0ab-9ec6838be797", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686304919, "uuid": "b136873c-1b1f-4dea-8258-4511862d8928", "value": "12288:HEyUBg6YJwr+wJ9ZRrVJeYjLBU07GFKJHRY/nOC:kI6frZTBBX7XxY/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686304919, "uuid": "e31f3a50-0a7e-42ea-a531-f94b77c5f354", "value": 828928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686304919, "uuid": "c669c1f9-297a-4267-b98d-19fb582c4761", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686304919, "uuid": "71598e83-5547-494f-8ab1-e6d558701703", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd53715e-0714-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686349722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686349722, "uuid": "9dee075d-a157-47b1-8f59-669f401a8247", "comment": "Malware payload", "value": "21367e36f6925fc865d225e26312c625", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686349722, "uuid": "4f270845-f2c7-4f9f-b95d-ef730a1e5886", "comment": "Malware payload", "value": "2b0d3e503a571a0afee6b8ec80601a8c265732daef9f727cbb0fab16531a206a", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686349722, "uuid": "ab04002d-b9c5-4a54-bff6-94c12a28a728", "comment": "Malware payload", "value": "6a6fd1f4d250e6e986eee1066f7a1d8eb677c079", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686349722, "uuid": "e7660ba9-45a4-41e0-bcda-c16327e32fe1", "comment": "Malware payload", "value": "4100e361658a64eda2efda3317283d0e17f42db889ac0b4bc91ff78cfdbbb06b00f79ae1e46f127c88f971a252460534", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686349722, "uuid": "8d881a3b-2bf6-4ce7-9e23-d7e973d71279", "value": "T1F6B533262F8307B37027946AE1207F114008A73DB6BE797366263DA7787B771A345EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686349722, "uuid": "e6989093-28e2-4221-b1dc-eaa9248e0b8b", "value": "49152:1Q6J3WM202p5GutgAJuIxyxWCIZnS85PWZ5FvcBe:e89i7JDmWjzP+Ue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686349722, "uuid": "acd480a9-2ab0-48cd-9e77-a9704cdd9f28", "value": 2277617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686349722, "uuid": "8732d57e-c563-4c5a-ad8c-5590a552393c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686349722, "uuid": "b3a486ed-c5a2-478f-b287-f6011ff0855b", "value": "6483a2d539bc1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd3bff0-06b4-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686308464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686308464, "uuid": "89b371c6-74e7-42f7-bd60-a72d2f5f07a1", "comment": "Malware payload", "value": "b7e29cf395c4f0260caed1a9627631db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686308464, "uuid": "79d0fb4e-d79c-46fb-b20c-20f7ec7baf16", "comment": "Malware payload", "value": "2b3a34c9823e49aaff649a3e2379351388f575c5715b503d0df336e3724e06d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686308464, "uuid": "ecefb0c1-b85a-4eb5-a9c8-973ad243c3b1", "comment": "Malware payload", "value": "ef8eff5961eb4e0fb87b4648e1992e86fb91e471", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686308464, "uuid": "1cf7147f-4b16-44c6-91fb-3634f8840c7d", "comment": "Malware payload", "value": "84d5a4c4a771aaa9cfbb2c9f3899d27d3e6807e35eb37a2c7b7d208bb30139d3d85320748c3220e8932d039810ca6c17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686308464, "uuid": "3f64969c-73b1-480e-ba53-832fc17dc5e5", "value": "T13A252376163A7896C6B8113824D61D4086AAD6ADD40C9D70E3F323836FB97EF3D6910F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686308464, "uuid": "81a4751c-e1dc-4b70-8b3f-4048b61df06c", "value": "e4290fa6afc89d56616f34ebbd0b1f2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686308464, "uuid": "6bfd783e-dd76-433b-be64-2c35ac7d0f77", "value": "24576:JanwhSe11QSONCpGJCjETPlWXWZ5PbcmC3f/Mxy:knw9oUUEEDl37jcmWHMU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686308464, "uuid": "032a5c92-e64e-4174-8f04-fa3b263a8004", "value": 1011675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686308464, "uuid": "bb844818-2e53-40e1-a2d4-0662173424b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686308464, "uuid": "02a696bf-f77f-4a31-b6cb-564f09b1ee97", "value": "2b3a34c9823e49aaff649a3e2379351388f575c5715b503d0df336e3724e06d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "668530c5-0699-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686296641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296641, "uuid": "06674e7e-7d3b-4bf3-b33b-dd7573b6689b", "comment": "Malware payload (AgentTesla)", "value": "26ef9e5b08e4464b71e644ae57362b1a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296641, "uuid": "4fe7732b-fb43-44e1-bc19-b5cc80c373de", "comment": "Malware payload (AgentTesla)", "value": "2bed887fca5ae34bb249eb750e20b7542c9209a169745ad2bd9176618042f8ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296641, "uuid": "4f2aa24d-376a-43a8-9020-fe8a9d997ba4", "comment": "Malware payload (AgentTesla)", "value": "fc0840cc0dcfcc94f9796619b07d4768e1902b44", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296641, "uuid": "b5068b5d-783c-4bc9-95fb-a961ff307cff", "comment": "Malware payload (AgentTesla)", "value": "f4bb23b872d5c9bb69749189444cd810c27f54d6081dcb3511b7b2616ab4be5d460ecc114f4b6d65a2e0a4436ffed82a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296641, "uuid": "53a9e126-98da-4fbb-8ac8-eba02a26a974", "value": "T168F4122CA6FB570DC05A3FFC0D214AB9C7ED5D80B413C11B9FA7A8DCDC26B141A945A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296641, "uuid": "42c733e4-f2e4-4d62-a4b7-dbd3564ece12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296641, "uuid": "3faa9af5-9867-450d-bf3e-06fb97c1fe69", "value": "12288:V+J/M+Jhewx/NscEQ+vgXK1HsaP7s4L4Sb8tppC58XMxP+B+T/9BGcgTv2wv9Pnw:a/thewlqB6pm7ITpC52MxP+6/9BWz2ww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686296641, "uuid": "33f23956-f298-49a8-84f4-213d608bfd2e", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686296641, "uuid": "d27895df-0ef3-4f10-9b42-17f5536093ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296641, "uuid": "2cfc7b5f-9bb0-4ed1-9dfc-0cd22e944c61", "value": "RFQ#R2100131410.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ec6d85-06cf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CobaltStrike)", "timestamp": 1686319804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686319804, "uuid": "ccccb3a5-4f82-4d7c-961d-dc93dd88e915", "comment": "Malware payload (CobaltStrike)", "value": "eb38a37b9be8b292438181acd45e848f", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686319804, "uuid": "2172bffc-44a5-4ed7-9459-c4b181f09251", "comment": "Malware payload (CobaltStrike)", "value": "2c683d112d528b63dfaa7ee0140eebc4960fe4fad6292c9456f2fbb4d2364680", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686319804, "uuid": "9d289dbc-a9ab-480f-8d86-4f5bc19dd67b", "comment": "Malware payload (CobaltStrike)", "value": "bf93e3d6e7d9521bbb0adcc7cd894cb78df1efe2", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686319804, "uuid": "8326b40e-a4b5-4c02-92a5-3a646ee951ee", "comment": "Malware payload (CobaltStrike)", "value": "c4a559cbb01e1c3e7fbafd27dce2774d4c9c1815037655fe80baa8cbf115233eb3bcc62d9562b77873278c76b4dc0627", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686319804, "uuid": "026374f3-0c5b-4868-be29-10b5732da764", "value": "T1C0E10478CC3C6E92465DB9807B21BD4010ED6D3B8E7DA5FCFF920450B654E4AEB32866", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686319804, "uuid": "81235a0a-7857-4e1e-b954-d1f5783923d8", "value": "192:oT8mq02tHpgnh5Ch4Sk85pm5wi1Nhriqru1rJ:oxkQnh5Ch4T85pQ5NhriqaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686319804, "uuid": "6b6f286f-c912-42c3-b229-7ec232e83b5e", "value": 7428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686319804, "uuid": "7d481836-8156-4b61-87e0-f77c88080aef", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686319804, "uuid": "4a721010-4de7-45fa-9a3a-e01915c0c511", "value": "Launcher.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0024d11-06b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (QuasarRAT)", "timestamp": 1686310106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310106, "uuid": "09dcc02d-2ee5-48e7-a46e-05ccb3e2fb3f", "comment": "Malware payload (QuasarRAT)", "value": "4693d917d5573d64bfd2a27e46e04504", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310106, "uuid": "9422a13c-c788-4266-9ad6-3103633b20ba", "comment": "Malware payload (QuasarRAT)", "value": "2d24effcdf6f620d368752b0bba8f2b96b01b82d95c36b6d5b34ddbe7740362d", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310106, "uuid": "8640d6b5-14ef-483c-a672-c65d60e44b27", "comment": "Malware payload (QuasarRAT)", "value": "fb97fec5b335804929dc3c8fb7e69073467f4754", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310106, "uuid": "e2777477-5320-42fe-96a7-7decd6a8537b", "comment": "Malware payload (QuasarRAT)", "value": "eb3f2a6c8faed5ac7eedfd50212050c46c0e0ee091cdc69b9f404a62c66ba46686a901e0dd34e3e1fe939ad7dde27027", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310106, "uuid": "918f3580-1423-4da9-8394-accea68ac9c7", "value": "T10616BF314967FCF5E7AA293FC4513A040D8598B7961AD164FD4B07EE28B2720B94BCB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310106, "uuid": "03905cef-7254-4f39-8bdb-01a5253df5a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310106, "uuid": "7c070516-e0ff-4aeb-b74f-a2a0a747a7b8", "value": "49152:k6fBW2t1NiKOBFAzHpe64btMTabv3/LQOlFIpfllgqSBZ7rQ0kV8e:k6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686310106, "uuid": "c0b5bef1-0acf-4ac4-98f3-f9107f482c23", "value": 4023808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686310106, "uuid": "792ff3ae-f2ff-4e11-a90d-38f2b6f5a674", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310106, "uuid": "a802957c-0c67-4804-8ac5-02a1d1f5f82c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06142c7a-06fe-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686339858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686339858, "uuid": "0adf1503-14fc-4119-87e9-f2110e18cc8f", "comment": "Malware payload (AgentTesla)", "value": "9a05d5df841c9eb2a2b0b007054926df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686339858, "uuid": "3bad5b39-de56-40e9-9a79-4d72373c29c1", "comment": "Malware payload (AgentTesla)", "value": "2dc7864d279868914b4241a995c7dcaed8e739a45f75496d11830b81a8786d71", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686339858, "uuid": "d52eca07-3206-4707-b970-83f79ae5714d", "comment": "Malware payload (AgentTesla)", "value": "c9cf0eb1851a98ff7b221d0b6ac15adab2dfb58d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686339858, "uuid": "7fa5f55e-82b6-4ec4-ad99-0728ccb27e84", "comment": "Malware payload (AgentTesla)", "value": "3b9b7cf7404e2dfbcac728a6a5b18e711ffcfeab66a2df97830e5b5444fa2f07cb183b583201095601d09c4abc507c4e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686339858, "uuid": "9d818ac5-0b32-4a45-a09f-0815fc1f6712", "value": "T189155E3915AC052783B692BD6AD0F847FB809CD33A1D8D5F56C74FC61522A32E1CAD2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686339858, "uuid": "4eb4fe56-8699-421a-b41d-44f9edb0a976", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686339858, "uuid": "b271bf0c-8920-4b89-ba28-41def6c9ff01", "value": "12288:b03cDgPqHVqiDkN0IKkXl+lffrFLpI+1Z:Is0PqH0KkN0IKkXl+df", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686339858, "uuid": "797ae0c6-40ff-4f66-b320-8628dc9949be", "value": 876544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686339858, "uuid": "34dd3b3c-7832-4e52-b5d6-3ad773ce760d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686339858, "uuid": "092d86dd-3fe2-4f8e-982c-7e8febd12007", "value": "z5SOLICITUDDEPRESUPUESTO08062023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f7277cf-06cf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686319768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686319768, "uuid": "49001ea5-4b2b-4960-b434-f7fb3da5090a", "comment": "Malware payload (GuLoader)", "value": "26df38174316ce0feb97ba4cab2e923a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686319768, "uuid": "00ab5a02-8a51-4a63-a34f-ebac4d95de4d", "comment": "Malware payload (GuLoader)", "value": "2e447387f489988c6164acfe8620269636a8556bd17de28aef104742e12537d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686319768, "uuid": "0a8715b4-855f-4a70-a2c2-3f0209fc7b2a", "comment": "Malware payload (GuLoader)", "value": "d6ae87e7bab6220eb21991512204fbb8603fbf4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686319768, "uuid": "206cf5a3-110a-4462-b096-7c8a2f7e1c92", "comment": "Malware payload (GuLoader)", "value": "6373f0ace4af847a3e2c9013bfaa064feb44ab257e5ae3331b7fa7a69766738f7512cb1fcc186eb1f098c12d5bba18cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686319768, "uuid": "5b8725aa-3a2a-4da2-b7e0-3f1f51b4c4eb", "value": "T1936412102F31C0FBCAE30A70447EA5FA5BEDD56364486F4B43946E8ABDA3781A45E634", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686319768, "uuid": "ecd5c24b-e884-4a8a-bf3c-dfd3ae562008", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686319768, "uuid": "15d541b3-3253-4109-b2e2-b65a1f2e5d70", "value": "6144:6mGIhap6pKOAv8L8Qqeulg49J5UeTDPthMZSkdx8W4g7Bit9Esm+eo/6E:9+wKO68YQqeIg49JBMZSkdx80titqR+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686319768, "uuid": "e7bdbeea-6927-4601-913c-200ca5081fb7", "value": 317065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686319768, "uuid": "54ece196-4837-4732-b372-126328b66238", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686319768, "uuid": "fc32878f-196a-41c1-8b5c-57afcb705240", "value": "rskovbrand.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52871cb1-0692-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686293601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293601, "uuid": "93678dd9-38cf-4250-82d4-58972d7e62ac", "comment": "Malware payload", "value": "86a3a3ce16360e01933d71d0bf1f2c37", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293601, "uuid": "8b664c28-01c4-4f99-ac08-85f634941159", "comment": "Malware payload", "value": "2ebe23ba9897d9c127b9c0a737ba63af8d0bcd76ec866610cc0b5de2f62b87bd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293601, "uuid": "c6d80f57-1456-4b61-ba68-00e99ca2abbf", "comment": "Malware payload", "value": "af54089e3601c742d523b507b3a0793c2b6e60be", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293601, "uuid": "b842a2a6-66af-4a10-afb8-7439685a4e2f", "comment": "Malware payload", "value": "a60083707f7f8d8817a5623cc590105c768113cc2e939a00767c61420c5dd0d5a2595e48ae063e064a759b48fba5a038", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293601, "uuid": "f3e9832f-aee6-45ee-9df5-8d1b59781a03", "value": "T173234A16BBA1C032E062253818B9C2B15B7FBC7352B5859F7B98077D4FB13C0AD69366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293601, "uuid": "afe8a6a9-b6af-4233-86a0-28c58815e4cf", "value": "45f43067991f331f7e6d9d92f382f3ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293601, "uuid": "b340b111-6492-4991-b390-94d0dd022d25", "value": "768:WQbWH9cNN5EM4Xk9fFhPc28F3hT/BysVPkzEDGlnwOMYsGfM:v8cbWMFO28FxT3VPkpk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293601, "uuid": "3c0e4e2e-3908-433d-9c99-47c99c5b37ad", "value": 49664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293601, "uuid": "bc588a58-4b3e-438d-b973-f6e8609b402d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293601, "uuid": "40169410-8d20-4926-b071-6cb6d1fd1379", "value": "06588599.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8432342-0692-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686293879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293879, "uuid": "1978177e-6f35-4fd3-874c-17c89cb9d51a", "comment": "Malware payload", "value": "5fac6f37c79eae2311cdb72e53f86f80", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293879, "uuid": "11c8813f-5bbf-4550-a3cc-cf00071e7906", "comment": "Malware payload", "value": "2f4f9f93cfb3b99691457b9e733982d14ca5a8af248b4130c0d5f8937faabd62", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293879, "uuid": "0aadbcf7-d8fe-491e-8cc0-fca31a60933b", "comment": "Malware payload", "value": "8dc5669d4acd4753540c980ad6953c8a5c6b26ec", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293879, "uuid": "0b0f6469-5423-4c9c-8175-7da72ed69748", "comment": "Malware payload", "value": "dd412d8b61626396e8183771c5e146183e55bea07d5fa22219167a8d31418f742c1b0448b300cf8270673a8bed3fd18d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293879, "uuid": "ddf542c3-854e-440c-b270-13727a0da688", "value": "T144346C62B6E18C37D4A21F389DB6AB65983FFF452E25554B73D02E4D4F3868038063A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293879, "uuid": "eb249a23-4cf0-42ed-8c11-6b10f126a3f4", "value": "86206264ddff2b1b67bc71652d4c13ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293879, "uuid": "e96e88b0-e800-442a-b82a-55742523a55f", "value": "6144:zmuQ2+7nqU43nITGjbU13NpUb8FywUMM7mufU:In2j4+gFbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293879, "uuid": "a8f04a2d-1436-4e67-9910-84abb599eb28", "value": 248832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293879, "uuid": "96f5d664-1cc6-42b4-a4f3-72ff0d87b8ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293879, "uuid": "b5665fe8-6183-404d-ae77-fa6b9999f9f0", "value": "07195999.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f2309d2-06a5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686301648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301648, "uuid": "bd2bc4dc-c210-4e26-8fcf-a25d81ee4ef9", "comment": "Malware payload (RedLineStealer)", "value": "e1c7c46a3ac8cd9ee53d864743a32218", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301648, "uuid": "894de286-83ee-435e-b61c-70c4fbafd43d", "comment": "Malware payload (RedLineStealer)", "value": "3035eb9f0d68f728ec08a54965674bb493bce9e4986dd360a46f752b9053ee82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301648, "uuid": "1e99d91d-a93f-4534-b871-d4baf290053d", "comment": "Malware payload (RedLineStealer)", "value": "19a9f5140d6f092ea1e4ce226faeefbaf1d5397b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301648, "uuid": "c1790597-f54c-4247-9273-79f4d93808b0", "comment": "Malware payload (RedLineStealer)", "value": "2bdfeb5002ce0d0d19e81bb3dcc5d01899cf35af813aa50b44a50a6c7621f5978d1fc7b675baf41f0ddef0fcdec10bfb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301648, "uuid": "4e9fb075-1441-438d-a604-a3b65d941a16", "value": "T1ACC4BE123759DDC5D91D40315923867321A2FCAA8CA30B5B791FFE2E3EB22023157EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301648, "uuid": "78984901-be8b-4908-b582-13d0e73f94ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301648, "uuid": "878bcce1-58dd-45dc-9fe9-46ab86175d5f", "value": "6144:qQNu9V4Hfd1tMz1phQY+ky824tVC37Tn41+x/JoSa33NVbrWJKyWf8NNgrfi57R:Q+Wpp2Lk1VC34QGSUvX/f8vR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686301648, "uuid": "a2470621-1c87-4540-99c3-8cd13e395259", "value": 548352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686301648, "uuid": "9402ff3d-a32d-44b9-a134-3891bf8c9f3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301648, "uuid": "805e327c-f1c1-493e-9993-3ed73ee70e96", "value": "e1c7c46a3ac8cd9ee53d864743a32218", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f1f4f0-06a5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686301744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301744, "uuid": "875d7e97-137a-472c-a62b-1dd051e02573", "comment": "Malware payload (AgentTesla)", "value": "859e19cd2c33cde84c88d3ef82bc04d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301744, "uuid": "d04611f0-dc8f-4b22-a1c0-569de69ec1f1", "comment": "Malware payload (AgentTesla)", "value": "30a2b97369cb49a104c48274ea39b1af4b3a1eb9f8ece684632ee00bc409daeb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301744, "uuid": "e3b5cd8b-3495-4601-97cc-20c9e7ca7d29", "comment": "Malware payload (AgentTesla)", "value": "a72367973df2fa4482b55462511447cbed781bae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301744, "uuid": "a41726e4-9f8a-499c-a6ff-bbca327d6475", "comment": "Malware payload (AgentTesla)", "value": "e4602b0f1e329e58bfd03f6deb0d3146a34afbc792e78b270dc5aa2d2a30405253d1c4f739a79145b6ed074cdafe707d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301744, "uuid": "75b10f2f-72f8-4851-b209-9508117de8ff", "value": "T17FF4026823E3144ECEAA7FBC5C894AB9DAF966073503C3434EE7789DEC58F858601253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301744, "uuid": "69b60015-1e84-45b9-bac5-b98b20c9a151", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301744, "uuid": "d2a5ca9d-51db-4bc5-8a2a-3d47744023a1", "value": "12288:pd6L7PVXf1i5bhaDnLMzIL2q+RTdOL8YbHFQom43DjlEmfssBUtrtyB21z3JJp3s:tOyqGUL8OHF1mdsBUt4BCbpl2mB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686301744, "uuid": "05d8c72a-b35b-4d17-b85c-62f40efa75da", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686301744, "uuid": "0061d28d-e04d-4aaa-afb2-5e350e63226e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301744, "uuid": "2faa95a3-1eee-40da-86c5-4f2c74a94cc0", "value": "PO#Q1024723.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e000558-0693-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686294023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294023, "uuid": "c53d60b1-24af-4c65-ac71-cd2eca18a6a8", "comment": "Malware payload", "value": "8813125a606768fdf8df506029daa16f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294023, "uuid": "01cb5f83-6913-48b4-9584-722410f1a45a", "comment": "Malware payload", "value": "323060680fed9a3205e3e36d2b62b7b5b6c6e6245e4555dcc733cf6ef390f41c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294023, "uuid": "4a510922-e055-4d71-a7ea-2d014193644e", "comment": "Malware payload", "value": "48e825f14522bd4d149ef8b426af81eec0287947", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294023, "uuid": "9343e844-c361-4a64-8edc-4a340ee881e3", "comment": "Malware payload", "value": "ff10f298075f7375f02b3edc030002d9a96dc829cf638cfcf2f84926bd99cd41d67cd97f358756d91fd995581b5de9c7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294023, "uuid": "2c38542d-2c0f-4c58-957a-04ca18a6d3bd", "value": "T19A838D03B6D184B0E9F30A310CB9D9504B7FBD664E748E572398669D4E741E0AE39F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294023, "uuid": "f2c510f8-098a-4e27-87f7-24675d3c4439", "value": "2e66f0419297ddafdf3c94b316590cf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294023, "uuid": "df2ac878-2346-4c8c-abb4-8146d8c4c243", "value": "1536:IyD2eyujEyC5YYafh1Mc8/gsWjcdjl9btC:I+2eytf3B9bQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686294023, "uuid": "a5c55876-d685-406f-b298-950402f980af", "value": 85504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686294023, "uuid": "abdb0149-5134-4347-855e-5ac34c076ae5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294023, "uuid": "47c6ca5b-a6a8-42f2-8a2e-5a408fce121d", "value": "02880599.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "292c4898-06a4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686301263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301263, "uuid": "d7803b42-7c33-406e-834d-9032ea6b6045", "comment": "Malware payload (SnakeKeylogger)", "value": "914c47b25aebed13253c66265ab1b6e4", "object_relation": "md5", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301263, "uuid": "11c6ffda-3b5a-44b9-909d-b65f279ed550", "comment": "Malware payload (SnakeKeylogger)", "value": "32dce7392d6a5e6e91e50ea01f4e78875d83aad4d624dcb43cad64269bf8db17", "object_relation": "sha256", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301263, "uuid": "75c8eb64-8c2c-445e-9ae4-8565fe2c535d", "comment": "Malware payload (SnakeKeylogger)", "value": "289f0a255ac3ec0b3e9b1e5ceb00453a5b1dca68", "object_relation": "sha1", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301263, "uuid": "463def46-3942-4628-a4e2-68e58f6180be", "comment": "Malware payload (SnakeKeylogger)", "value": "d8e5a6a3b740e0154f6baf2690220c3c3fa368b6d776520ba4623dddf0e533f2bc757916db1f829818e6235803fff807", "object_relation": "sha3-384", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301263, "uuid": "038fec80-ba59-40e3-9f8d-c97f320bb22e", "value": "T175E433D502C15C4F6A8EEC25C0E1BE254948FB284625E8DC6656E5BFF92FD84E60FEC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301263, "uuid": "633058e1-9095-46da-a1e0-fa2efff26e4e", "value": "12288:5T6XrO3tjWMjaSiQXsz1EjTjktl9uIstSqFTN/+dcBmFYPwHQMgO4NDUmVzBnD0p:oXi3tyMjaWBjTjkn9uLvr/kc+YPwJbiw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686301263, "uuid": "4fe12cee-820a-4f4e-87af-e93595d3ba83", "value": 712436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686301263, "uuid": "4e7ad371-6aa5-4cbc-b035-6f97b63d18b4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301263, "uuid": "84c67c30-8119-473b-b3ad-a94d57987b8c", "value": "Quotation.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cc3141c-06a9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686303362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303362, "uuid": "4d6b57a1-6ac1-4e1c-adff-19fa0ad643fa", "comment": "Malware payload (Loki)", "value": "45db53e7d63494df607f222711a5835f", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303362, "uuid": "9cc07ac9-2908-4ec1-b491-6a4020eef434", "comment": "Malware payload (Loki)", "value": "334b2750481ba0b937164bd3c3c111b1a9cd76c1c16a7ee0571e7da6647e7e25", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303362, "uuid": "113324ff-8eec-47d5-8852-2a00db31f90e", "comment": "Malware payload (Loki)", "value": "6aed420a7d4839a84e9879356a8778bfaf5841a1", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303362, "uuid": "2b4b880c-d19e-436c-b462-b8eb25ce6f81", "comment": "Malware payload (Loki)", "value": "52aa48f411f31c470c78c53280c2c777025bb2bfe3ea34f651f37b1ad7f0f93cb90855c6c39691985ea52d2f978f023e", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303362, "uuid": "36e36ca9-0bdc-4e12-ae79-a9598e21e4eb", "value": "T10FD423583CBCD877C591AA6B7C438E8CE26CA0709A85DF0CC5EDBC0AFD2261D8D9544A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303362, "uuid": "5c0f1696-f13c-4d06-8f18-9bd52f9bd842", "value": "12288:sgYVgf1hyA+KIqUNXpqHYg2A7EBCuupRBLqQMSQdkFIctHGc7lfnGpzD9yBw3:sFg1Mhn5q4gfKEQuIapQzD9yBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686303362, "uuid": "9cbb0377-ca51-40df-b950-44511f972cf8", "value": 614262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686303362, "uuid": "025d4476-5f70-47cb-81fa-df8d189f4c1d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303362, "uuid": "ccedb12c-10d1-42c9-939d-1ccf21bca3c8", "value": "PI_1304021 (2).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1ee265f-06c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686314833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686314833, "uuid": "dde1e519-44a4-46de-ab0c-9333a4b7a40f", "comment": "Malware payload (AgentTesla)", "value": "98aa57d8f4897419652cfabc6ef1b2f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686314833, "uuid": "97185d08-4db7-4273-87d2-750aecfaee20", "comment": "Malware payload (AgentTesla)", "value": "34b091e39fedabc27927ccdd15633881f59be237149531e7d342c86d5e9c7919", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686314833, "uuid": "54bdcb50-ff55-41b1-b5d0-891226781e61", "comment": "Malware payload (AgentTesla)", "value": "649949b3106941215b9f25ea639d8480b2e0d38e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686314833, "uuid": "2b96febe-049c-4529-9992-7f6c9b47aaeb", "comment": "Malware payload (AgentTesla)", "value": "70554ac4feb74bf13eca8b237aa36811f82736c145aa22a1c3a9699c4e52b9b8898142d962b779bf1b0444afdf2bf931", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686314833, "uuid": "6dfa0a24-eeb3-4da7-bead-7fa35c84c28c", "value": "T19DD43379BCC89D5D163CDC8FE9EC974472C6BE6029C1E00B1E6CA5127D7D879EC021A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686314833, "uuid": "d21373a0-575b-4caf-985a-79b9c241885a", "value": "12288:HttYcxEbDFvNYUatw84KgGFojrBhBt895vgyWvAxeMGRlvDnndL+:NtYcybDFv69tw8NgGSfVI5z0AxebRpd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686314833, "uuid": "bcac2a8c-53fd-417c-916c-6f405c425884", "value": 648489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686314833, "uuid": "53b8addd-c92a-4b9f-9af8-346d56409679", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686314833, "uuid": "0463914e-3eca-446d-95f2-dd137843843b", "value": "Bill Of Lading..rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b3b545-06ba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686310915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310915, "uuid": "ffce3484-90fd-4e9d-99af-125a55d22b7b", "comment": "Malware payload (GuLoader)", "value": "0b22c43af8ee5ffcadf23001259b63b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310915, "uuid": "694860f8-bb42-4943-a2d7-fbdbe762ae6d", "comment": "Malware payload (GuLoader)", "value": "34db50498fc68bd69ee687abc8634fa85228b02f8683267e70ef54e625316060", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310915, "uuid": "b709a54d-a82f-421a-b8c9-b8db370f3660", "comment": "Malware payload (GuLoader)", "value": "15b128b4d21295eb9cbb519a3d4154934cb419a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310915, "uuid": "d2decc6c-76e6-4f2c-a837-6dc5b5f9b1fa", "comment": "Malware payload (GuLoader)", "value": "c28ed4250f8808513ffefd889f9ee879121926bb1eab01c58b2bc86443d62085d561c9149a0b7ececb8a5ca7d07b973b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310915, "uuid": "27b484f7-15d8-4753-a12b-19d86b751de3", "value": "T195F459341F98C813E35194B871E1CAD8EE75FD0C326ACD52EEE7786A66786C168F9103", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310915, "uuid": "00892327-cf7c-4b26-b91d-47904b5275cd", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310915, "uuid": "77ab1543-0f41-4f4c-8e1d-6408c9afbe87", "value": "12288:9PKcWfPW1nUOMaxK6+G4ezecBquR3AhzdmgO1td:FWonUZa46+GpK6VwfOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686310915, "uuid": "468d0faa-aac4-41f8-9af6-88b3edef28ef", "value": 786517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686310915, "uuid": "5210b83f-c793-4531-bc1b-1298b941c069", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310915, "uuid": "23e9d70c-2656-464e-9cfd-3c01c8cdf00f", "value": "34db50498fc68bd69ee687abc8634fa85228b02f8683267e70ef54e625316060", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aed5b5f-06df-11ee-b3cf-42010a9c0076", "comment": "Malware payload (StrelaStealer)", "timestamp": 1686326552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686326552, "uuid": "7c4863bc-a7fa-4838-8701-c72f65ac9daf", "comment": "Malware payload (StrelaStealer)", "value": "c4475d94d4bb42345d6c559af873f2a0", "object_relation": "md5", "Tag": [ { "name": "12980215 Canada Inc.", "colour": "#2C28D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686326552, "uuid": "239fdc91-988e-419f-80f8-ec5603abe06f", "comment": "Malware payload (StrelaStealer)", "value": "35d9e93b8e7e1a2ea7be071e3d19b3a3ca1226aacbce3e5593c8219448e89525", "object_relation": "sha256", "Tag": [ { "name": "12980215 Canada Inc.", "colour": "#2C28D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686326552, "uuid": "fb075ae8-61da-429b-a8d4-680f12f1224f", "comment": "Malware payload (StrelaStealer)", "value": "cfac25acf9a78d228b97c9c431ce6a460625cef3", "object_relation": "sha1", "Tag": [ { "name": "12980215 Canada Inc.", "colour": "#2C28D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686326552, "uuid": "2f94bc07-6929-47f4-b560-a98804fc678a", "comment": "Malware payload (StrelaStealer)", "value": "12483c166266f9409cd05e2e8f10b8ce3afe909ae165015f376727ee60fd194747bae8db2c0705c3fc19997ead7eba0d", "object_relation": "sha3-384", "Tag": [ { "name": "12980215 Canada Inc.", "colour": "#2C28D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686326552, "uuid": "60a77a8a-ce56-44f1-9832-1fb21662c43b", "value": "T125728D523B682527CE8A47FFA8D397282B305B071AA8DD9F5CF12EAC5B413917201277", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686326552, "uuid": "f3c15ae1-b533-45d1-8141-91f2857ac4df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686326552, "uuid": "fee5234c-8e0f-4ac7-972b-a4c05dd5c644", "value": "384:EZ8ocMqD0PF/1tZvDJMx+N4/dpwKNsy368T8x1Xrx:LaZrv9Mx+a/Sbkwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686326552, "uuid": "fd45a058-45fa-4f13-ba4c-85094ffc4c70", "value": 16840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686326552, "uuid": "ca162207-15df-4b5a-bd39-54610041c7f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686326552, "uuid": "256ba1e8-197f-4af6-92af-ed0d83df82ab", "value": "Fattura (2).bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0788ddb1-065e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686271141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271141, "uuid": "ae9e33b2-8da6-4980-b280-c43b2d22dc28", "comment": "Malware payload (Amadey)", "value": "4a9d0e906c3a8882d7b7775de3c5533c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271141, "uuid": "e315361e-611c-4df6-a763-14532d74743d", "comment": "Malware payload (Amadey)", "value": "3776ac0f25def18aa1d95847aea747346f49f5819c498fe97c906e9695950b73", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271141, "uuid": "424483c4-dc32-4261-b087-2ce038ca1508", "comment": "Malware payload (Amadey)", "value": "e098c76fca0eb02e6153a0a03267e8aed67db80a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271141, "uuid": "f72c25a8-d18d-4051-95fe-aefd04dacf46", "comment": "Malware payload (Amadey)", "value": "35ec533b3307dbda84ffe7c708d86db29d5ac8df8058014cbbf2545f1e509e259b9c97d2aeadb397927d66bb2abff1df", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271141, "uuid": "6fccc808-a2cb-460a-88e2-ca1e5b407580", "value": "T154D41212EBE58473E6F1177018F613E30F36BC921D78475B2B0AA85B0DB1A952C7276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271141, "uuid": "27ae35bd-729b-487d-9f0a-bd3cbb3ca4c3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271141, "uuid": "4e03319c-0dc3-4328-acc1-18b2ccd645c3", "value": "12288:QMr9y90cJBE8i+SxdGhFEYVus4lUcKBGbjY4ljHqP/V34:9yb3NSxdQ3VusCCGLE34", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686271141, "uuid": "1daa1f6f-14c4-4e04-8b71-6e03ecd96eaa", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686271141, "uuid": "86acf2ad-0431-4aa3-ac37-6a5c57e09926", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271141, "uuid": "35468fee-9ce5-4b6e-b350-325bd49a4a9a", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "488e5cff-06a4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686301315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301315, "uuid": "0d15e471-02b9-4359-aaa3-420779dc594a", "comment": "Malware payload (Mirai)", "value": "8c45d90a4dc01aaad1b1eea318064b89", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301315, "uuid": "a9d83c93-c26d-4aab-b6cc-3d8b3663ddd0", "comment": "Malware payload (Mirai)", "value": "3805a3eb7ff64a53f5391ee2e3252a79c21c10045f68b9d630cf5172a2531984", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301315, "uuid": "21574b97-67a4-4126-96d2-5e2803eb48e5", "comment": "Malware payload (Mirai)", "value": "f6f447f6a1248c7328b3912e29e908bd387a3a2c", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301315, "uuid": "88dec4e9-83fe-427f-9780-0dd1c6ceef17", "comment": "Malware payload (Mirai)", "value": "f4a77a29145219464ad2b0021207b61cb3675d54739cbded576f76da06f77ea629372fe9d779896306393a15055b2bff", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301315, "uuid": "606bc568-7e89-4267-8a15-637e4dc4691b", "value": "T109B33B376251C97AC08356F426EBC5729D13BCBB0B32219A33D47D60AF368DA1E99B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301315, "uuid": "ff6f846a-16a0-4630-92e6-a36d4bc7db46", "value": "3072:kiry859a2ADJf9wHYqbgFFo8+HeAG+TRCm7FnVqfJXFWbNb:T9a2aLqkrMZsm7FnVqfJXFWbNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686301315, "uuid": "8ca0f177-254e-460c-857a-6b5de4d7385d", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686301315, "uuid": "010b0f89-9908-4447-b551-78bc1c604e66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301315, "uuid": "c1104cf4-af71-44fa-a96c-93fb9081839b", "value": "8c45d90a4dc01aaad1b1eea318064b89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f47c0233-0693-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686294302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294302, "uuid": "abc1847a-6b3b-47f5-a7e9-9147fc2674e0", "comment": "Malware payload (AgentTesla)", "value": "85b03fda436bf678863725975cd884ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294302, "uuid": "e96b080a-91a8-4bcc-919b-15a16cd09330", "comment": "Malware payload (AgentTesla)", "value": "38551ac94a802a76d2c7d81e798e65121cec940ffe30d569330e851d6723acd1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294302, "uuid": "168b3e05-0d3f-4b01-a516-d598f6ef2da8", "comment": "Malware payload (AgentTesla)", "value": "b9f6695101f171e6f8832b86b92b6bb1d154f5e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294302, "uuid": "1d8ce285-a6a4-4bae-b81d-2bbe5cc0359a", "comment": "Malware payload (AgentTesla)", "value": "8fa35ad53ff7687b3ae2bca185a6fccc86d846233eba28cab6ca1147ec2652db5ee3af18013bffc8fce40ff96500c8ba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294302, "uuid": "1ca59dd6-d674-474e-9205-2ff7ee639243", "value": "T184F4011563FA175EC8BB6FFD18301670C3FA2926B563E30A4E9278C99D25F514F00AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294302, "uuid": "e30b17e8-a042-4a93-9a76-4cb640e1a03e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294302, "uuid": "e4fa7510-4635-4f92-b488-89fda3dda9b3", "value": "12288:wC4haDnLMzIL2q+RTdOL89fBQMud26wu6xDlbuKhMRAxG6ejcdWIgRKu0t0:oOyqGUL89JQMt5hMKfWIg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686294302, "uuid": "4e719154-bd36-4b80-8918-341ca8bd53f8", "value": 777216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686294302, "uuid": "20757850-6108-45a8-8ff3-ae99da10ddec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294302, "uuid": "118cb514-5e4e-490a-a053-7f928825601a", "value": "image002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a45a5bf-0692-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Locky)", "timestamp": 1686293721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293721, "uuid": "e55e14a4-e854-4c7c-9204-8fd5c2d89f28", "comment": "Malware payload (Locky)", "value": "0d0823d9a5d000b80e27090754f59ee5", "object_relation": "md5", "Tag": [ { "name": "Locky", "colour": "#AF187B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293721, "uuid": "0e6cb456-d182-41a1-8cdb-7ecb51b58d6f", "comment": "Malware payload (Locky)", "value": "390ed1dde4ff03adfcf67c59ee02567ac5665bb5e029eaebf0332bc81e4d1891", "object_relation": "sha256", "Tag": [ { "name": "Locky", "colour": "#AF187B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293721, "uuid": "689e9e04-8245-4a31-9301-bbd13a6a16fe", "comment": "Malware payload (Locky)", "value": "b1f495b707ffaf53188c13f19a487dd94e7a0735", "object_relation": "sha1", "Tag": [ { "name": "Locky", "colour": "#AF187B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293721, "uuid": "92dc38fc-d9d3-403f-9186-9d71ecb18e8b", "comment": "Malware payload (Locky)", "value": "6cb51dcfac6308e3fed14e4732a4773ed8b7cf79813c56a59de6665203969beb63774458f106fb2dcf78c4f7da5142e1", "object_relation": "sha3-384", "Tag": [ { "name": "Locky", "colour": "#AF187B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293721, "uuid": "152da3bc-1a0f-4ecf-af48-c1c3832d0eae", "value": "T132E40513C4A2E231DF5880F34BD4AA070A4213F2E09EDE9E9B3D3F591626A41DFD596D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293721, "uuid": "e2c88e3f-8106-4662-8e75-3b9ff19666b5", "value": "7ff21f6c00d977be0f3e10fe2269c48f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293721, "uuid": "6071f5e2-e71c-4477-b28c-536dc22b986d", "value": "12288:JOSdwPgM57sv8ZqMM+ARd9rFk1S4e/NZS3peecnysPoBicrOl:JOSa2EZqeIPMelY3Cypicr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293721, "uuid": "3e781fde-879b-40e8-aa91-71c39a076bba", "value": 672768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293721, "uuid": "e62714de-d6d8-4deb-91cf-c4cf1879352b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293721, "uuid": "3d7b1ea7-fd05-4508-b948-fbb10659808f", "value": "09762899.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "183555c3-06a4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686301234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301234, "uuid": "68a1a35e-4d09-4364-be93-bc91c968a0fc", "comment": "Malware payload (Formbook)", "value": "62f18cccad8ad9056639f5894b1fa5cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301234, "uuid": "89158ada-9fff-4368-98b0-76a8d13cda63", "comment": "Malware payload (Formbook)", "value": "395133081793df5c1542b9e77a64a5271d1b358c1a7db674108a7624a9104809", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301234, "uuid": "9d8b84e2-67a8-4925-a486-eac633601ec9", "comment": "Malware payload (Formbook)", "value": "5121125ccd258ab199b60c0ef92476697d73389e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301234, "uuid": "3107a67d-d659-4942-8dfb-474a33232372", "comment": "Malware payload (Formbook)", "value": "bd88ea913108de07de15ecfbe558c2d23e9253629e0b46100dbc9d41b84c36a5d00796be80bc201f13786026a2480b06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301234, "uuid": "54d7c018-1bb7-42a3-9400-0b35ae61ad39", "value": "T11105126E96F7412CC5A77FBC5C00127ADADC2A49B433D21B5F67BC69DE06B010EC4A62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301234, "uuid": "3f809377-0f74-4ce6-a446-114b614b95de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301234, "uuid": "066dc339-cb44-471c-99fa-32ce1b1860a9", "value": "24576:RewlqB6pE9WfSRQjUBNWyu1z8VdcIcYVU:Re2q8p64zUBoyMgy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686301234, "uuid": "654c93c5-ba6a-462a-8534-fdab124a9ed9", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686301234, "uuid": "89516131-87c7-491e-9533-1447637a5f77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301234, "uuid": "a121fb06-8dea-4595-9fc2-c90536b224e9", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eac75321-065d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686271093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271093, "uuid": "ab276436-6359-4b05-8a41-4dbf92bcbcc6", "comment": "Malware payload (RedLineStealer)", "value": "9160b99f3c6c6d8ff159c221fa0f0e2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271093, "uuid": "6efd7a7f-c887-4776-8c1f-f58bab6205ef", "comment": "Malware payload (RedLineStealer)", "value": "3a8ba306599c003e05fd249525681fd5ffa78fc066773d5cd53f1c83ee8322a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271093, "uuid": "8f439853-0f0e-4550-9a11-cde684eb5d3d", "comment": "Malware payload (RedLineStealer)", "value": "81ab06dc562e8cad84728b2c4a56bf89b744f656", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271093, "uuid": "767c68c4-724f-4a75-883e-f2471523d2d1", "comment": "Malware payload (RedLineStealer)", "value": "567955fa32b87b6be9c7d191cc32a78d43b62b283f2fdfcf161b6a07083e65bf42962c0090dd43977f64b1ff2e3cd437", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271093, "uuid": "9903ab62-26f4-4792-acd6-08d005f86c0e", "value": "T11364590372C38C79F8AA073E21D54F2DD877ED60164568FB37A89A604ED131394AB5BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271093, "uuid": "7742679c-71ba-4772-8345-480b31e67ec6", "value": "4e895722b26aab4e38438670ee8ec7ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271093, "uuid": "0ff789d1-233e-4561-9718-d42ed855c41e", "value": "6144:aJiekRFHupMnTDs7UNVS49kCNQSzrs5kLJhHVugiqtciLRc1twP:aJ4RZD7NQSzrs5kLJhHVugiqtciLRywP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686271093, "uuid": "bbba0e74-8710-45f5-bf4a-e1892dcf721d", "value": 315519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686271093, "uuid": "f14e924a-7901-4d61-bcf9-60d2d66aee9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271093, "uuid": "0add6e4c-63a5-4097-9a11-a28f4f76959c", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e6a902e-069c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686297835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297835, "uuid": "7920c024-f55c-4146-8136-4afce2253300", "comment": "Malware payload (SnakeKeylogger)", "value": "615cb722b2f4f9bceac13cac05e7846c", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297835, "uuid": "c1bff8a8-b774-4d88-8fae-4c220197419f", "comment": "Malware payload (SnakeKeylogger)", "value": "3ab0e20bb4f1dc6ed5a277db08a628a16bb2b47552108373e06040f2655ab19e", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297835, "uuid": "6e4632c4-591d-43fa-875f-8da6cb99d77b", "comment": "Malware payload (SnakeKeylogger)", "value": "22a99f51b2c2d9339737c8ba66a87f07dfe9452e", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297835, "uuid": "2a2205ad-9153-437d-b655-fbfcb0cfb528", "comment": "Malware payload (SnakeKeylogger)", "value": "c7a04aecca2969abd752f19e366a1dcf09f165b6fa4e0eaf04513341c2c85ce62f585b84dcd31c32956bf185a861702a", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297835, "uuid": "32184cbc-3747-4cdf-ab9b-93944e1f870f", "value": "T159252341790BD579E1EE8F1F2A768FBC0AC8EE35196BF3251151215870E0C2B0BB5AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297835, "uuid": "adc68308-198c-437b-9e22-cfa48255e8fc", "value": "24576:hi3p4MNW3m1eyLYGSZSsREeGH5edADBPPxdyvETPTFPMG:ApZneMYiPeIUADdJdAoPhUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686297835, "uuid": "9c1edbe3-fa54-497e-a459-1e9e8c001e1f", "value": 967810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686297835, "uuid": "03092490-4cba-479b-9e7e-de429c601b7e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297835, "uuid": "6a641f6a-e56e-4a5c-9271-a5b42cb3545d", "value": "Swift.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b5db5e-06c4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686315222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686315222, "uuid": "4a4f2dd8-c253-4b8e-90c4-c234567bc5f3", "comment": "Malware payload (SnakeKeylogger)", "value": "15acff30d0935be4d601433d66db1734", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686315222, "uuid": "ea2a22ff-846a-4b75-9634-cd54c370ea8d", "comment": "Malware payload (SnakeKeylogger)", "value": "3aba02f8b1e468adf8164eb3932c56bf1082cad0f3c94a9b315e51ced8526669", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686315222, "uuid": "a0724bb4-a45f-4a2c-80e4-c5952cf978e9", "comment": "Malware payload (SnakeKeylogger)", "value": "3f115bfb24158a31b475b4fa314c8a7ec476ab32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686315222, "uuid": "2136f058-25ce-404e-a273-6051f7eb978a", "comment": "Malware payload (SnakeKeylogger)", "value": "26df142e76b5bc9fbfbd866da59453e955187f1be781f5d1de183de8ad862773ebf36ddecf18b9c61281b70cc382f817", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686315222, "uuid": "0589abfb-ed43-42b3-a9e8-f21008f64ca7", "value": "T109054D3A15AC052783B692BD6AD0F847FB809CD33A1D8D5F56874FC61522632E1CBD2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686315222, "uuid": "71159561-7319-4d08-846a-ec0795b700df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686315222, "uuid": "7d2ef651-65f9-4fdb-baa4-9612c820253f", "value": "6144:kECzU9V2fTa7sH/T1pJthdc31GlS/oZ/6fZUcHpVDDMhn6TFh/Dn3R4EVm8LMGsW:/aI31GeueJDMMFhjRxMGrd2UswtN3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686315222, "uuid": "1f68e998-a241-483e-aba0-85443ac8de57", "value": 840192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686315222, "uuid": "71a4e0aa-6e78-4b52-bcc7-d6d3addb8428", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686315222, "uuid": "6131621c-4a78-4522-a9fd-003145258386", "value": "P.O 3805.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e22d67fa-06c7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686316605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686316605, "uuid": "d7a033dd-9a02-4c14-92a1-7fac9d9dda31", "comment": "Malware payload (AgentTesla)", "value": "fb11977f722e153ea25a13673d03b577", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686316605, "uuid": "56c67f33-28fc-459a-831b-4a64494642f3", "comment": "Malware payload (AgentTesla)", "value": "3c15327363831cc1f832ff3fc3156339c546dc72ace1342502b5826416adcd28", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686316605, "uuid": "eff932d9-775d-49de-a9e8-d2cb26025674", "comment": "Malware payload (AgentTesla)", "value": "4c5f1ab8598576ef6d218955fe0689f44702de41", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686316605, "uuid": "f01f0bef-58bf-409c-9107-e39c9b2a935b", "comment": "Malware payload (AgentTesla)", "value": "9ac658623e39c491fe84f9c3fd411f85622b910924b4110684d4afd62a87dde29ffcc9d82c37723700b703fda9605695", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686316605, "uuid": "5e1aee95-a098-4110-a7ae-f07ef7838313", "value": "T1771572BC5D07E6EBCE39E26695F02307B3714417B65EB88C6ADA3B850D93DC122D060E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686316605, "uuid": "1b7ab2d7-921f-4822-90f2-cb43c9960fa6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686316605, "uuid": "3905dd41-34db-43c4-a268-aff0c21084a6", "value": "12288:q4ZPYzz9wr+K/CyApvmhZJQJgO7LH3Nr+0:Ri5pS3QJz3XNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686316605, "uuid": "f879f217-e7d7-440a-b24a-9aecaa7e62d2", "value": 915456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686316605, "uuid": "886f7a9d-fc76-4bb5-ae19-538ed1ced643", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686316605, "uuid": "ad184ab3-e068-43f1-a344-acd5d5d0a051", "value": "PO 19743.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fc1ef3d-069b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686297381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297381, "uuid": "2fb5e9bc-be20-4f41-9551-e3bb3809e3c3", "comment": "Malware payload (AgentTesla)", "value": "97af90b53a9aed23781dfd08183d64eb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297381, "uuid": "93be6ca1-3eaa-4909-9c62-2680065e6c36", "comment": "Malware payload (AgentTesla)", "value": "3d3bae78b278216bbc7d9ce0a6e0261c0a0dc6e78c0099186ee9837ae93b599a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297381, "uuid": "3e55d7cd-6eda-41e1-b68d-e2ca24c2502b", "comment": "Malware payload (AgentTesla)", "value": "fd4c69925c3bf615f002f774750b8c9719049eee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297381, "uuid": "5167ad18-0fc4-4c3e-a91b-5a80006496fe", "comment": "Malware payload (AgentTesla)", "value": "3846a2b5cb6a74c622a1b6a41b8b383c4e7d46f6b6aa2f4f696b4ef87a1cef1250ac52de172df2bef8b5e736af4a230e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297381, "uuid": "b65a3114-4bd4-4e5c-a61c-df7862a3e30b", "value": "T13BC423A6AA3E8A604E4C947F5EBDE5B8B8EE888B0117151145B468B81163FFFC44F172", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297381, "uuid": "953df088-d759-42dc-bfb7-43770f9e7d25", "value": "12288:aJ8vl9yncOFN96WUctuKN0Ssu0nYBLLHpT0/9jhqyzoxRQo9X:aaCcOfQeuK6Ssu7BvHpTs58yzoss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686297381, "uuid": "8bd0a106-0995-44e2-9a6b-79fcac50b424", "value": 581956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686297381, "uuid": "b4fa7f21-55fe-4de7-ae97-41e1c647081f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297381, "uuid": "61947db8-2a96-4d42-90ea-69623b1f9b7b", "value": "Shipping document.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "443135d0-06a5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686301737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301737, "uuid": "8f727b30-d3c2-4d01-8c25-54d4f9cf12ad", "comment": "Malware payload (AgentTesla)", "value": "9bc241f5cad10b3f3670f35b26b71635", "object_relation": "md5", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301737, "uuid": "6c5a52fc-06a5-44f5-b21b-9d3922c776ca", "comment": "Malware payload (AgentTesla)", "value": "3d816261fae9c40853c916d0ef92e0a282d885d15c6c5ce673c175c87da2c739", "object_relation": "sha256", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301737, "uuid": "cbc5229b-1686-4ace-b7ad-2652f2768de6", "comment": "Malware payload (AgentTesla)", "value": "8f1784f69827e8710afb168f8d87b3d5d894dd64", "object_relation": "sha1", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301737, "uuid": "1746545e-05fc-45ae-9d2f-6814ac8c9e38", "comment": "Malware payload (AgentTesla)", "value": "4572fb499470e7ae20af81b50b3ba466dc9f311b9fafd7e40e7a1c7c215a54696d4faa1f75a3ca5c5a00afc887008461", "object_relation": "sha3-384", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301737, "uuid": "6e4d48e0-be2a-45eb-a785-e1e8be762901", "value": "T1B6E4236E7B900EFFCCA414E8AC414379A2A97419D80F5E693CC71374FB1899AD5E13B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301737, "uuid": "9ba9b3bf-9bdb-4453-af84-de39cafbd229", "value": "12288:72Hor7VIj4yDZxg703XGwSWfdMLiAI8UxxYdMTb7d54kx2CWSP16KayfY4hpC41f:qMG4Ixg70nNSgdML5qL37d59y6J9Y4n5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686301737, "uuid": "9410d061-6f74-4010-bbb2-df85ac20a699", "value": 670427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686301737, "uuid": "b16621f1-79e6-44b5-8c0d-e25a6de72e5c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301737, "uuid": "4583e37b-186c-44d9-bc9d-5460d4693c4c", "value": "PO#Q1024723.pdf.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "000bc36c-06fa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686338130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686338130, "uuid": "da73125a-f9a1-4a8d-8821-4a32e5f1d660", "comment": "Malware payload (Mirai)", "value": "59534a7be5ed1ca60e2133fd3f6ee93d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686338130, "uuid": "08862b9f-9aef-494d-acec-1a802d75854e", "comment": "Malware payload (Mirai)", "value": "3db6b7c48d3b01217dcdac01a74947219df805d9554aab9bdd26dce699a4d819", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686338130, "uuid": "b40e7618-f269-4a75-b734-317b27e865a9", "comment": "Malware payload (Mirai)", "value": "6ceb3989767d0ce0bce3eceda5d3dbaaeb573235", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686338130, "uuid": "97f24a49-11b9-4875-8113-4e9c124efa19", "comment": "Malware payload (Mirai)", "value": "754f84324ce0ce72a7e0feeaba69bcf78ea0f91b44ca23eec5908b54d4a169c7413f6869ed8887b72cd25d76b99b4dc1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686338130, "uuid": "eaa3c0e5-7ad5-4976-b424-17f276c77875", "value": "T1A4A2E015BF1886CBC832693451E9FAD21293FC71F2DDCC092540C16FB4A33A96474F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686338130, "uuid": "beb3cecc-6d5b-4eb4-aa11-a7ffea947c34", "value": "384:Mg9Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAK1:798o08kxofBE+ZkXaqGbp2F2TWul0c50", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686338130, "uuid": "618e05a5-2c2c-42ef-940f-5a1f18515283", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686338130, "uuid": "7f8d0c00-bc0d-4232-8611-f1e0a8376a29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686338130, "uuid": "c7e597fb-43db-4205-9fb1-571130a4b932", "value": "59534a7be5ed1ca60e2133fd3f6ee93d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5c983b1-06a5-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686301955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301955, "uuid": "ff8c7735-4366-4b96-b50d-a326fd851b4b", "comment": "Malware payload", "value": "44137725eba04c72f7486f45192cb768", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301955, "uuid": "03eeb9b9-f850-4a6a-810d-4d2c89f18b59", "comment": "Malware payload", "value": "3df0f256ad5241af5c4c20fe732af0fd96166e7c2746ba0b91a0359813a9f783", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301955, "uuid": "9c3cfabb-1bc3-4565-8ddd-6f9337f53e66", "comment": "Malware payload", "value": "7dc9ef7dd261b73ba7d259c1f020d363f34823b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301955, "uuid": "50358efb-0166-4a6a-84eb-5311a8e88853", "comment": "Malware payload", "value": "c1f79db156a5b8a9e0ca033c71603051cc4afe91a75d24a18c2d09b88b3ef888a94e835ac7053d0b66555b25a9f2af15", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301955, "uuid": "8a3c96cd-8a57-472d-bbd5-de82a47fc206", "value": "T1C235331DECC1D014EBC11AF05CF86EC4844BD8E7DA67FB1BD89D98A8A56E7928D810DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301955, "uuid": "3343a187-c5c6-412c-a9ce-64ac31e4bff9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301955, "uuid": "57ee594f-15ef-4ea8-8965-f85a968ed21a", "value": "24576:bhw22EZ+KBiqxUwCf/mx7n1JaofmsTuemMy9aP50Xt:lt2q+IiBzBahmM9P50X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686301955, "uuid": "01858356-139d-434d-9e53-286587e32a70", "value": 1134080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686301955, "uuid": "af9ecb4f-b1f6-4e33-9e59-431bf4c2b617", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301955, "uuid": "6cc5a048-e7de-4be1-aefc-5ac938b8b55f", "value": "44137725eba04c72f7486f45192cb768", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e580e913-06c4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686315322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686315322, "uuid": "00ce591b-f566-4027-a98b-5300b4c0f3e5", "comment": "Malware payload (AgentTesla)", "value": "eac45e7940e2536662d67f5c2bb888f8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686315322, "uuid": "f7677b7e-da03-4aa8-a745-de387158e8a9", "comment": "Malware payload (AgentTesla)", "value": "3e1f623f0b2c1b85bcbca396bbeb79e06db39138a004c14201827ed1a8ca377a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686315322, "uuid": "387ba8a8-8a46-4f3b-b61f-dbae74ed73b9", "comment": "Malware payload (AgentTesla)", "value": "99accc50514d38dfd74883b10789a471f4cc2bca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686315322, "uuid": "fba3264d-dc83-4d45-933e-14626e571b6b", "comment": "Malware payload (AgentTesla)", "value": "c72c3df43f8c89decf0bf28cd6cb370ea00c03cceec83b47c664fa6c77fd4b20ce672af0fb90bbd3019a003f25400fc8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686315322, "uuid": "d958f330-aae3-456a-8df7-6731bc24c211", "value": "T11C1583BC9D07E6EBCE39E25A95F02307B3714417B65EB88C6ADA3B450D93DC122D064E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686315322, "uuid": "9f0fad49-f3de-4ee7-882a-78195e0bb229", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686315322, "uuid": "8dff6ab5-386c-4851-9cad-f3ea2a6740be", "value": "12288:EW0lwFqIwr+i3Tp3OQwN5V2cKxZMXdKkDkB0c:RZFwTp3duL2xxGKoy0c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686315322, "uuid": "a2b65d6a-d833-4db8-93a0-e2081b94cd05", "value": 905216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686315322, "uuid": "bcc222e3-37ea-4ed9-aa82-830b063e923b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686315322, "uuid": "ed25a564-ef08-4151-aa95-efeac5ae7465", "value": "Revised Proforma Invoice WSI116850PF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f14fedc0-0693-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686294297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294297, "uuid": "de3ec269-7610-43d0-9678-e628ee27cff7", "comment": "Malware payload (AgentTesla)", "value": "3de8c578809ee062d82c61d0f66b6592", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294297, "uuid": "c0a77c6b-dc2f-41d8-a3f4-367d9853ac92", "comment": "Malware payload (AgentTesla)", "value": "4054682c50aff7b5423a33991bee44a4a2d46b40f91606cb34f570a15ce5cf84", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294297, "uuid": "66c018fd-dc2d-4eb1-8612-7a53830c1c9d", "comment": "Malware payload (AgentTesla)", "value": "f5d96a5d570a9c9b15c7c25020c18362ee1c1157", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294297, "uuid": "ec336e2d-cbcb-4efa-8f2b-fefff70ba5d7", "comment": "Malware payload (AgentTesla)", "value": "9d43a6e21072e75d1359940401eda6632126f7f737e248a48eb5f61927532e03b09cb449e1299618b954b9917522b980", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294297, "uuid": "86fc9108-ed1f-43bf-bb84-d5afaa89f3d6", "value": "T16F55F11463FA175EC4BB6FFD08301670D3F92922B563D30B6E9A78C99E25B514F00AA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294297, "uuid": "cc882ae7-69d1-44ee-9e10-32f3ca9d4a68", "value": "12288:9C4haDnLMzIL2q+RTdOL89fBQMud26wu6xDlbuKhMRAxG6ejcdWIgRKu0t0:5OyqGUL89JQMt5hMKfWIg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686294297, "uuid": "071aa01f-9c31-4f5d-a3a5-590a5e6571c4", "value": 1376256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686294297, "uuid": "431d1d12-b5ae-4e4f-b346-e859cd9b8271", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294297, "uuid": "22adeb43-69de-492c-a490-05b5ea58318b", "value": "image002.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eefab839-0691-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686293434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293434, "uuid": "a1ad48a2-293a-4995-b556-be42d930a955", "comment": "Malware payload", "value": "f7596666d8080922d786f5892dd70742", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293434, "uuid": "a6f6e324-306b-4616-b153-6cb61f166179", "comment": "Malware payload", "value": "40a30c28d47496811450e8cd07ad3640dbba7cc270ce89b5da13312121e7d7ab", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293434, "uuid": "74fd7643-8c9a-4e83-a6ba-b9249becb443", "comment": "Malware payload", "value": "0902f46fbf15c170e952ddae88811f01f6746971", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293434, "uuid": "f4c42df7-e356-4e54-9ffb-5fefdfa4f6bb", "comment": "Malware payload", "value": "b72fcd0c29b3c23ef3418b6348f332dab46ac7fc3176e47d0e654453cbceba4ca3adba09697e77e9b104512f8873f2a8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293434, "uuid": "9288f2c9-d677-4821-a4e3-78e6dfb071e8", "value": "T14F059D33F2E0D837D5B21B789D1A82855536B9103F38E69776E81F4C0F796917A2B382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293434, "uuid": "d2ead588-3369-433c-806c-05190e545212", "value": "4359802f317d4be3b49195b674da56d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293434, "uuid": "91b5d927-2083-4b70-b846-2284c717d068", "value": "24576:uQQP8Nk5Gpc/rPx37/zHBA6plp+51CErza8GRA6JmxyJcL:wOk53rPx37/zHBA6pGPmcrL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293434, "uuid": "7a619b90-550c-4306-bd1c-221194181e58", "value": 816688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293434, "uuid": "f368c2e4-64b4-4fe2-a343-8301b59f5ecb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293434, "uuid": "503ae902-7f57-4fc7-be84-5d3852b2aedf", "value": "02387999.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "348db91d-06c6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686315885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686315885, "uuid": "481efa4b-a7f5-475c-8b37-bf70078b7ca7", "comment": "Malware payload (AgentTesla)", "value": "e4068af12e525bb241c059d11ae64710", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686315885, "uuid": "1e5c578e-9c3c-41c5-8e87-d091375d90a9", "comment": "Malware payload (AgentTesla)", "value": "4115fe52b6ea534ace04b6d75b6d602a99a1bb2ca268f420828804581a53d28b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686315885, "uuid": "12bb1d0c-6ab5-417a-8022-ac0e9b36ee83", "comment": "Malware payload (AgentTesla)", "value": "2a0401c32779099ec0a50eed1ee48aba5631fc13", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686315885, "uuid": "ff4c6f34-c5cb-4b29-b82b-98f58e708292", "comment": "Malware payload (AgentTesla)", "value": "14f3ee3bad066ee0cbf9d33872df00e1754f66146e58e6afaa72aa7b86f622f29a4126145a5288d0003c54a4fd4991aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686315885, "uuid": "96610a76-c228-42bc-b1d3-a410085aa54f", "value": "T1F1A423D1DCBC92A9CE24845024E9F556A013A35C1B7EB7E127984A1C22E215B3BCFF77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686315885, "uuid": "ee19be0b-e812-43e6-acde-6cb57ff82e74", "value": "12288:4wc3aeUzJhOFbM4W1lBzoEfPWMquVdnAyL4bry:QKemfOFbDWfC6KCtke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686315885, "uuid": "4bc20764-54b6-4def-b8ca-88a9b827c74c", "value": 473865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686315885, "uuid": "4dbca2b3-5938-4ec6-9563-8510064295d7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686315885, "uuid": "7c34bbd1-b3dd-492b-bcaf-570c4c6a0c24", "value": "Import CheckList-IMP068723-24-08-JUN-2023_04_34_PM.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc1f11a-06c6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686316006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686316006, "uuid": "309f9907-985e-4f36-907e-fefba3384a0f", "comment": "Malware payload (Formbook)", "value": "668a1c6359bb1b9d1d53df667ef82544", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686316006, "uuid": "284ca945-ac33-4911-835d-46c835ae14f0", "comment": "Malware payload (Formbook)", "value": "411866fa8b5f27b7254d3bdc1b152c33e8a6420ae444f5242023df50f06b2c21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686316006, "uuid": "eae9efc4-3907-4868-aa60-6391c26a3d83", "comment": "Malware payload (Formbook)", "value": "47d44970393519e8189fe83793fa5e33cccd7a02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686316006, "uuid": "590a13d9-9e41-4a60-b39b-9b3a01c18ac3", "comment": "Malware payload (Formbook)", "value": "6e93d6a629efacabbc436cbd7d6e7e83a24eea3def119507991fc0b0fd5a1945d22921c3019e173d3955aec4be95726a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686316006, "uuid": "fb2f2d47-a015-4daf-826a-872144da0ee4", "value": "T187A48C27A5DCEAC7C4AC48796D29F32E7116AC2584318C12BD8AF94DC4F175265F3A3C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686316006, "uuid": "6b1538c3-f1c8-4ccb-9300-9a651a85f93d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686316006, "uuid": "9976e071-beb1-42fc-b75e-89e5a65b704a", "value": "6144:OYa6PiwSbngMs02WzVXMTeGerAeaHYV8pSec4uoVfh:OYcwqgKrRXRGq5ol/lh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686316006, "uuid": "69abd081-bbb1-4b30-81b2-dacfee5de310", "value": 478297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686316006, "uuid": "08329bed-da78-4c26-9564-72f302d18585", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686316006, "uuid": "31890319-35ad-4c69-aad8-7497b3ddcea3", "value": "Agrubu 06092023.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09741277-06c0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686313235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686313235, "uuid": "8abef9ba-12a2-44a7-9648-ec7c2313d1fc", "comment": "Malware payload", "value": "a9c9562c4a7b984a5b28df684c97c1d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686313235, "uuid": "cb40894d-19ba-45de-b6f8-01564b39e3d7", "comment": "Malware payload", "value": "4269dd50d95fd554ac2d49feffbdc780aaba6488782c967e8f53626009bdde12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686313235, "uuid": "b6b52d69-7fcc-4aeb-b6c7-e32fedcdf13e", "comment": "Malware payload", "value": "39d1be5bd5fb3ec9f05039622f0394526f108715", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686313235, "uuid": "611a3e56-bb4d-4858-bc54-f79b61226cae", "comment": "Malware payload", "value": "40fdd995a73e7690107caa94e75a1ee41c52438fd583e258658c1e1cb1ce60aadc8043510eceb5f5fdcc9d6bb55e5414", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686313235, "uuid": "e7b60754-ad38-43ec-8050-26c1c4d97f2d", "value": "T1766218516B5CD530D4F68A35FC0357F40730EEA8CA45EB6F5898BF0AB3B13534A622A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686313235, "uuid": "9f1014e0-e096-45d0-b585-6d7f12dc5416", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686313235, "uuid": "45e9516b-5c10-43dc-adaf-86a695871536", "value": "384:aNR/tYdm8i2LSK6P89Qpf1qGSxFv5JQzKNX9euJj3EM:kkhbED8TJQzKh9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686313235, "uuid": "98f1597f-ff66-489f-be5f-4fa4b6992d71", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686313235, "uuid": "57cfcb8a-a5c7-4b0f-b5d5-9b93e6c4d18f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686313235, "uuid": "86d464cb-bf05-4a04-ae8f-cffd1b4d9430", "value": "Product_List & Samples_# 061300022550.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1811213-06c4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686315316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686315316, "uuid": "8b2378b9-78a7-4642-b61d-a6ba1017ddf9", "comment": "Malware payload (AgentTesla)", "value": "4ad19f3b83382bd4874693be46fae7c3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686315316, "uuid": "0a8d15aa-f717-4ac7-a06b-a45ba77a3042", "comment": "Malware payload (AgentTesla)", "value": "42c9d1c730159fea42ed1ae38835ffc8427baf94e5e5fa59e9b140b505cd273c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686315316, "uuid": "d148f601-6bab-4e92-a803-17163cdb40b0", "comment": "Malware payload (AgentTesla)", "value": "fd4db67eebeab60048a85e2cf9c10510d815af58", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686315316, "uuid": "5e6e5af5-b4c3-4fee-a347-6a381fd51910", "comment": "Malware payload (AgentTesla)", "value": "163bce4b639d713331bf0a2089af19c6fb6e0c4660e717b4a4c5595fd5e8464601a7899d1ea5916ce16e2cb6ce50dc68", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686315316, "uuid": "689c27c3-5735-4826-ad6d-8ac3657f1b41", "value": "T1F2A423D1DCBC92A9CE24445024E9F556A013A35C1B7EB7E127984A1C22E215B3BCFF77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686315316, "uuid": "beb506e4-db35-44c2-b77a-dad89337f86e", "value": "12288:wwc3aeUzJhOFbM4W1lBzoEfPWMquVdnAyL4bry:IKemfOFbDWfC6KCtke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686315316, "uuid": "27915dd1-f7c3-43d5-9891-3a1afea7c286", "value": 473851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686315316, "uuid": "c410270c-ead0-494b-ab62-dcf3e16642c8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686315316, "uuid": "4e7fee0b-0a27-4e3e-9242-c2e8da52bed0", "value": "Revised Proforma Invoice WSI116850PF.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e81f18-0692-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Rokku)", "timestamp": 1686293575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293575, "uuid": "17a28b23-52ac-4c1e-916e-9a92b9f135f6", "comment": "Malware payload (Rokku)", "value": "97512f4617019c907cd0f88193039e7c", "object_relation": "md5", "Tag": [ { "name": "Rokku", "colour": "#AE1F1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293575, "uuid": "f9acb84c-32a7-4622-8578-43a3349269ae", "comment": "Malware payload (Rokku)", "value": "438888ef36bad1079af79daf152db443b4472c5715a7b3da0ba24cc757c53499", "object_relation": "sha256", "Tag": [ { "name": "Rokku", "colour": "#AE1F1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293575, "uuid": "932c0f30-2a56-47e0-8edf-5b2e50d13364", "comment": "Malware payload (Rokku)", "value": "24cfa261ee30f697e7d1e2215eee1c21eebf4579", "object_relation": "sha1", "Tag": [ { "name": "Rokku", "colour": "#AE1F1E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293575, "uuid": "b358ca6b-0b23-4377-af5a-967a7bcfaef2", "comment": "Malware payload (Rokku)", "value": "dff49cf5cc9f2d9d3423eee44cd737c645a746ad8e7f94d0523654aa6cefe87484c571aa8976f164417dc96cab167e36", "object_relation": "sha3-384", "Tag": [ { "name": "Rokku", "colour": "#AE1F1E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293575, "uuid": "cccad847-4a5c-442d-ba26-4bf2b4e24fae", "value": "T1D6E4232F4D4C2BEBEB4A58B0B4CB7BD94FE8153A52D85AD18718DB95F5760284340C2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293575, "uuid": "4529322c-5f22-4f3d-a85b-4859e7253ed5", "value": "c8a1acbf5dc2caeba7f7ef2e0065c948", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293575, "uuid": "9f182878-05ea-447a-ad4a-565482d008f7", "value": "12288:bB/72HFAQBMiZB7fJJ2qDHKK/K5FJL+xQhrwjeI:bBKqFiT7fJJ2qbKK6F5+xQhrEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293575, "uuid": "3e2ad038-bb02-4698-8fa7-4f216a264c10", "value": 681984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293575, "uuid": "c82d8dc7-85af-49bd-b6b0-72685e9c2725", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293575, "uuid": "93420ba0-180f-41af-895a-7fba3eaaf25c", "value": "06176099.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "243b00a8-06b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686309844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686309844, "uuid": "5a544e49-409e-4963-8ad3-536b0f7c14ee", "comment": "Malware payload", "value": "712ad40e87896d6471e9cb66e0b143d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686309844, "uuid": "d5a41a0d-dce8-4a3f-929b-ef70ebf1161d", "comment": "Malware payload", "value": "439cac529d487cb5e85ee8809b9c9566c3febd4b9feba321016304f2e6cbfad6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686309844, "uuid": "389ebcf9-1110-4387-8050-10e5d925f984", "comment": "Malware payload", "value": "7c17ffd024b3a76a1d056bf417bbd3c23f9ed04b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686309844, "uuid": "aae9dd3e-a9d7-4687-95d1-979d6c5a875d", "comment": "Malware payload", "value": "30156298fc89faacd4e54659ef53826d9633f362d46cfad9d6e6ccffd8660febf98e332682a722d150c55dcce3ce57c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686309844, "uuid": "f8fb3638-90f8-4134-8df2-d90ef86ada69", "value": "T1B312F81137288277CD290B33A81353811772D35A9566DB6FD8C816BE8EA33918FA27F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686309844, "uuid": "63ecc3b2-6dfc-4a11-9e21-714081a28a19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686309844, "uuid": "b57e6392-43bb-46ac-9048-3c01e38ca43b", "value": "192:pnprdkfffffdL2L3LiLBLyElL3NZFf5kxcG6WT/QYALo:pnprdkfffffdL2L3LiLBLyElLdZFf5m4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686309844, "uuid": "5af4cf7c-80ac-4663-a60c-bc9024e65dad", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686309844, "uuid": "aa3eed22-7953-40c8-aa82-33b7eaaf8907", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686309844, "uuid": "80da446b-9c9b-449e-8f3d-a8b170140f85", "value": "439cac529d487cb5e85ee8809b9c9566c3febd4b9feba321016304f2e6cbfad6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "401abe69-06bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686311179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311179, "uuid": "c88eb573-7bbf-4cbb-bdb4-58ee6ad843cd", "comment": "Malware payload (GuLoader)", "value": "d319fee1a295e5b7d901a69de2fef70c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311179, "uuid": "5305eb39-c6f3-4377-9377-fa43d60d2075", "comment": "Malware payload (GuLoader)", "value": "44ccaf612dddde11842167c8d5b7c336272ceb8c332f1325abf3e690382f02c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311179, "uuid": "e911652d-8f67-447b-8f15-b23a23cb08e2", "comment": "Malware payload (GuLoader)", "value": "ae2397688f56c3b8b56448a11027a3aae652084b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311179, "uuid": "5ec04cec-2804-419e-a851-eaa9d3a9c0b0", "comment": "Malware payload (GuLoader)", "value": "4d052cca49c9e2c7f154f32f504208fed55b59361d4ca7877a04a57dc29cc5b7be3b53112a182c567a6f9286fffbbb51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311179, "uuid": "f0f4f603-728e-4ee7-b2b4-118f008973d8", "value": "T13EA4E02A6F57CD33E3496074D670EF3D9ABBDC550D1B861387F9E82BB124B12999E200", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311179, "uuid": "bb7291d6-b109-4f00-8ad2-dce0151b9075", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311179, "uuid": "b2df80ac-98fd-409d-b316-097e038fee8d", "value": "6144:imOPQGwvUsu5KcHlmI+PQM345zPU7Ldb2IXvckRgqqYg+ln:TRu5KjZPQ2KM7LkIfrRhq/+ln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686311179, "uuid": "36258d29-e5a0-4c5d-b271-d7c211cb137a", "value": 479003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686311179, "uuid": "ff375829-f3cf-42a6-aa58-bb2f08d8a10a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311179, "uuid": "4ea7c3a8-a337-43b5-90ce-29332f169844", "value": "44ccaf612dddde11842167c8d5b7c336272ceb8c332f1325abf3e690382f02c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad01e8f0-069c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686298048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298048, "uuid": "773bf59b-eba9-4335-a862-672a9d427eeb", "comment": "Malware payload", "value": "f45a4138f5d99fe34bdb5600fc5e4cf1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298048, "uuid": "fa2015e1-b42c-451f-b469-e36ce23ad6ae", "comment": "Malware payload", "value": "451bc6843f48ae0f96744ec979475fe540f095411f1f336280d6a458535e8d38", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298048, "uuid": "551620ed-0336-4c17-92a1-5a247bb079bd", "comment": "Malware payload", "value": "e6e5573db48290ac67fefbd1f781ce31e10c6b4c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298048, "uuid": "30e72840-fa50-41d2-87e2-0c5102c604eb", "comment": "Malware payload", "value": "9c8ec7dbdcdff3dcf45004cf5ced162fc61ea5662f2de5b6f26c42b72d434cde329f37f66857fd3216aec44263dc87f5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686298048, "uuid": "66725e3d-ba59-401a-8797-f441943f4a95", "value": "T191F433DBA052500F491B0F0BEDADE189DDD473AE2363669E4E487F0A16B39C7D2DC44A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686298048, "uuid": "157f6c63-a4b2-4dcd-bbe8-eae587559310", "value": "12288:su253LGOOYCFzD5eZR5kpTxw9fAFf1XzvLaorcRSk35CNJoD1KIFDKP:sz5bGOOYCFv5Z9rtrh1NJoD1ZD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686298048, "uuid": "1b23a91d-acd0-4327-8a88-c3b4441436f3", "value": 754757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686298048, "uuid": "aecf652e-e59f-432b-91e7-c65ef000b164", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686298048, "uuid": "f82fbca3-b11f-4c0e-ad04-a477da1be5fe", "value": "draft packing list.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dafa50f-06a7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686302720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302720, "uuid": "bbfb5347-44a7-4e41-85b4-5513e399548b", "comment": "Malware payload (AgentTesla)", "value": "93de70fc1a7dc99eaf69201f65a1a096", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302720, "uuid": "9e181f69-df80-4e99-a322-e28700d55d4f", "comment": "Malware payload (AgentTesla)", "value": "454ea978a72358c84a2964e48e27d2b5c0286c4a2036dc0e15ff8c9723fd6d40", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302720, "uuid": "e96eca3b-a048-4b4d-8a6d-81a395661a7b", "comment": "Malware payload (AgentTesla)", "value": "8d7c607e6522d2ba4019eccbaf5374f16f858f3a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302720, "uuid": "bc3d617f-74f4-43c8-bebf-ae4319dc374a", "comment": "Malware payload (AgentTesla)", "value": "1d19864d3e4c46d151cdf4699f014e26857fccf68b28bb71456cbb164f61f8fd63cc7f8e9e6d6b6f5a86d5b0abd94a29", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302720, "uuid": "ef9fe219-51f8-46df-8bf3-4e726b4f12d4", "value": "T1DDF1E710A7A98632EA764F37D86353C107BCA70B6853DBAFC845A10E5C123954BA3BF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302720, "uuid": "831ab70f-c5e4-4918-814d-45a2688f4efe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302720, "uuid": "5b3416bc-3772-4551-99ed-989ce01de320", "value": "192:UmXCEWQfs0lSkGQvhfSaeWC83T/+ULEGMf6Z:UmmQfnpfSaeWCwT/+ULEGW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686302720, "uuid": "be6c758f-0b7f-489e-a7df-b4ef254e5fae", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686302720, "uuid": "8200faf0-d852-43eb-934f-0d07c02aa14e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302720, "uuid": "ac62bb53-b902-426f-8894-5156d0a8672d", "value": "QUOTATION_QAMF_19590.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c56daded-0693-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686294223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294223, "uuid": "a842d400-3a41-4320-9b9c-8217033bf175", "comment": "Malware payload (Loki)", "value": "990d6ef09e01817eff7a7c6b8ad43763", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294223, "uuid": "0cd3ab49-9846-4dad-909e-dabce59e6964", "comment": "Malware payload (Loki)", "value": "45cdd8267e4776f9c1889adbe0da8cdd42b8cdc9cad1ad788464bee2b11c4bf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294223, "uuid": "62ca679c-ce02-4134-b72e-884b684350ad", "comment": "Malware payload (Loki)", "value": "7061b050414411cd3c3da3c38b47cee7a87d4b32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294223, "uuid": "dab2ca53-0cde-4200-a5bc-d93ad1eb8426", "comment": "Malware payload (Loki)", "value": "a638419a0618c94487729ae53e66da25723a78433afef426417b740fa1cba4d1187d8b6037968f47de13d68a7e972852", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294223, "uuid": "3ee1c5de-5979-4d26-9983-4d609d0a0068", "value": "T1F745F0330243FEE9E7740D78DC861585ADC46877631CB19CB8A81BBE51F5118AB9BEB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294223, "uuid": "156737bd-467d-42c7-9b9f-e508447ffd32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294223, "uuid": "9fb4ff4c-26fc-47fe-ba26-7836843e3c99", "value": "24576:fv5/Hxc2+FRtusraKOZRWdgcTTeqwgTk:XlGesUWlwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686294223, "uuid": "dd213109-f552-4aee-8d98-578f7d62f1dd", "value": 1238528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686294223, "uuid": "24cf4bd4-be52-4af1-82a3-e98f6127cc54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294223, "uuid": "d44b5039-b8fa-4605-a167-580efcaab41e", "value": "__DOC.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "036c6804-06a5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686301629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301629, "uuid": "674c5ce8-7423-493a-9945-2ff419356d46", "comment": "Malware payload (RedLineStealer)", "value": "98e4b1b5b793b2ece39ac08b5b175968", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301629, "uuid": "27f0cad7-1a3e-4a07-9a97-3e54f5803550", "comment": "Malware payload (RedLineStealer)", "value": "45d0efaba2caf518e649d387606d1ebe479cb8f9fe3baf7259f2905a6c9a6b96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301629, "uuid": "3ce96c5a-51fb-4ff0-9e54-f2c0f78b7e86", "comment": "Malware payload (RedLineStealer)", "value": "cb95d3e37bf7890dbaa0d59a0ac1afdff3814e33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301629, "uuid": "f6f713ba-e44d-4571-9b97-7f1a4b7c9e7e", "comment": "Malware payload (RedLineStealer)", "value": "3aecc60ff5e1e06ea9f64e8da7beaa75a014f3fe9e54b24203b8751395bfea05038674b1fff8d80abaac7fa9ef18c703", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301629, "uuid": "7c759c04-d0b8-432f-9126-3185d80e00ae", "value": "T12F04E1121B4835E0C6980C7C3CBB0A7141BA9FA7788BFB178EC5B8362B7B7D19976154", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301629, "uuid": "56f6b8e1-9e88-45d5-8fb3-b1109c4a6f34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301629, "uuid": "7352dd22-adbd-4369-b6d4-f9edbea3e227", "value": "3072:1b1Memvvf8fdrBOFZ9hTLfN1g0CnHYPlk3UBjuU3/MCANWFHn36CS/:3Memvvf8iFZHHfNCHYP885ANWFQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686301629, "uuid": "0319a968-4974-461c-918b-217f8c61eea5", "value": 177664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686301629, "uuid": "9dce25b1-a916-4a53-a573-bd62263957da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301629, "uuid": "8f70c71d-9f2f-4984-bf9e-7280ffb852a5", "value": "98e4b1b5b793b2ece39ac08b5b175968", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f62e3a-06c3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686314842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686314842, "uuid": "41ab1b0c-0b5e-4147-9b38-9e0682719945", "comment": "Malware payload (AgentTesla)", "value": "a3263b3ce5ae165469ab3bdc82ddd3e8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686314842, "uuid": "e8ef3607-760e-4ada-9e29-0292a72dcb1b", "comment": "Malware payload (AgentTesla)", "value": "466152ce57063783bc73fe86736ecebcd168335df5212c71f6a15cab3cc2b5ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686314842, "uuid": "6287158b-3d5e-4373-ae68-4a8d2b3c4f11", "comment": "Malware payload (AgentTesla)", "value": "523a81fcf3c13a7030cb35311c885e24d0b0128a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686314842, "uuid": "f49e9377-201a-4d3f-a3e4-6fd0f437c516", "comment": "Malware payload (AgentTesla)", "value": "4d015be9227eb7783ceaa8cc971f1ebdd283ec8f2f6fc8de82fb1d3b5308914097ef9cc4a815178c3d8492193fec1623", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686314842, "uuid": "12832f9f-9f94-4a39-96d9-2b9afff05850", "value": "T1CFF4011823BB471DC8BB6FF94830027497F92A5A7973D30B5ED638CAAD19B414F406A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686314842, "uuid": "0e9cb3b3-b841-4974-846e-6ff588e581d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686314842, "uuid": "d3d2a487-c478-4197-a743-78e354bdb495", "value": "12288:a74haDnLMzIL2q+RTdOL8hcRDQiX4n6eX8F0QdxZi0eOKrQHFOX4JXFwsvTvf:POyqGUL8hkQ8ec0oxZ+OKrQHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686314842, "uuid": "a1915f9b-382e-4bd7-a78f-3effd4937eff", "value": 774656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686314842, "uuid": "0535fd95-fb4f-4d67-be6b-9d80a546ec2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686314842, "uuid": "83f93492-d772-437e-8b15-be9ab07b97a2", "value": "qKxcZFrYtv47nF5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2887ed00-06a2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686300402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686300402, "uuid": "d5f9765c-2288-4875-8c48-d314f143b0aa", "comment": "Malware payload (SnakeKeylogger)", "value": "f644e9281a159e03c6355a790785d1cd", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686300402, "uuid": "c4e61fb8-6ac0-488c-a70a-f2eeff86fd13", "comment": "Malware payload (SnakeKeylogger)", "value": "46a620e6e52c23a945b3e3f235e1182d546324373b8a82172ecfb0ff42c576b5", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686300402, "uuid": "7f84390b-b82e-491b-b62e-f048779edaba", "comment": "Malware payload (SnakeKeylogger)", "value": "1ded17f8258040d4568c48fe9fe6308b4ae1cac5", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686300402, "uuid": "7420f8a7-46fa-4124-a3c5-f89854c0d45d", "comment": "Malware payload (SnakeKeylogger)", "value": "1237ce08f9f002264f27ee2bc97de143b45a935225b5bf1f0654bc0dc5405e4b3e0562748af24f3bc4791eab6e217d00", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686300402, "uuid": "29f6238d-c9be-45c2-9fa7-0714a485c42f", "value": "T153E4339502D15C4F6A8EEC25C0E1BE254948FB284624E8DC7656E5BFF92FD84E60FEC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686300402, "uuid": "6d5c5bbb-205e-48b0-a8be-5bbfd64aa578", "value": "12288:1T6XrO3tjWMjaSiQXsz1EjTjktl9uIstSqFTN/+dcBmFYPwHQMgO4NDUmVzBnD0g:0Xi3tyMjaWBjTjkn9uLvr/kc+YPwJbif", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686300402, "uuid": "62b96052-2d02-4860-8738-d71d9104d154", "value": 712450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686300402, "uuid": "b8e0d74d-8113-4493-9c0f-d6b79da0f4b9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686300402, "uuid": "30067915-67e8-4827-a4ad-27ff9cc0e6a3", "value": "proforma invoice.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd81d81-06bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686311256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311256, "uuid": "080d4dac-22d7-48b1-9c4d-e3d09bbc725d", "comment": "Malware payload", "value": "964a755ae41747d5bc8510c8da62d728", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311256, "uuid": "03c25b28-6207-4f55-a323-7a595096a767", "comment": "Malware payload", "value": "46b8e124c320b78d36dff0f84c12d129ae5d2eb10ee8211d64a50077d90d0b17", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311256, "uuid": "83b39157-1019-4452-858d-d58a4ee64a11", "comment": "Malware payload", "value": "eadac7395e13b30f1e3fe4181e00fbff6093cf83", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311256, "uuid": "470b6541-4fa4-4773-bfc8-4ad1731da20f", "comment": "Malware payload", "value": "4ceddf39d36b0f71a1a3d0b8d275cf08916ec16815a070301223bdce2000c8043972423e71c8af18e49b213f7b3376e3", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311256, "uuid": "747ff470-49b3-4fdb-a674-b4a3be362673", "value": "T12365AFF875047DE6266F576BCA96ADDC13B51B638ACBA4CC80A47BC305A3375FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311256, "uuid": "75edbc19-78c6-4d52-bb43-86dbca89aea6", "value": "24576:p8DJKDoDl5MTCfoYng/EmzVMSc9GnEhd/ZmTJj5LiadFzgmHmj3AQx2QpRY0e6Yf:f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686311256, "uuid": "e4d70dd6-b17f-468d-b821-fe672bc0f7ce", "value": 1516178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686311256, "uuid": "edcd0efc-6628-4a72-a7c8-547b1a0176b9", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311256, "uuid": "bd9dace8-52bb-422a-8a59-a7b438129b55", "value": "RFQ-SMU58312 FDCO.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b8f304-0697-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686295974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686295974, "uuid": "91cd6508-fe5a-4f72-8f59-2ef86e7af51e", "comment": "Malware payload (AgentTesla)", "value": "9e936b8d6f5788a9973d48100ddaf51a", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686295974, "uuid": "d7a6e460-2b23-444e-a109-af885c4c4254", "comment": "Malware payload (AgentTesla)", "value": "46c7b5f4d83c829fb2a1e075a2beeee277467f4635b166d088933d70118911ee", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686295974, "uuid": "29fcf56e-1589-4f43-ba10-f1bc57db1f1f", "comment": "Malware payload (AgentTesla)", "value": "c2c8a7a9c5f4f67c66b75a4aba232ece613ee4ab", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686295974, "uuid": "5a00504a-3c91-4148-8626-4809de8a62a0", "comment": "Malware payload (AgentTesla)", "value": "90bbc6bd6554b57b4c8fcb51c42997d7af9cda4ca3a98867345669d0d1205aa7627f12593a18743c8d2956f3e35ddfe9", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686295974, "uuid": "120011db-da18-4bb6-a7d6-8274d2cf0244", "value": "T1DBD4233E3859DDAD7E321C387F86E2B37EC6BA531BD47841B932010BFE98C065659624", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686295974, "uuid": "1bf2e720-038a-4f14-95b3-e7b03a4449c1", "value": "12288:TlcmMPT4wtHq9VRNdomzJ6Yd2+MqLimWA0gABknJkF:GmgT4w6V+CEtAaBskF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686295974, "uuid": "e7a00cf4-ee1a-4d0d-9647-3c1a4bda5936", "value": 600321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686295974, "uuid": "fc06723f-4f34-4d55-b8bd-574a953b9179", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686295974, "uuid": "67152277-0f3a-461c-81e8-7438701c46eb", "value": "IMG_2560_07588pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c67255c-069c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686297859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297859, "uuid": "e7d5e40a-2ce1-4fc1-9083-33800457d164", "comment": "Malware payload (SnakeKeylogger)", "value": "f633d80491b61e6f529a9d23fd91ac54", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297859, "uuid": "8a9c2b66-92f2-400c-81e6-e66fc559a922", "comment": "Malware payload (SnakeKeylogger)", "value": "4858b0fb27c48a899981c0bc5bc5bc0f380afec9936acbe740ea2e32d31f0cd7", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297859, "uuid": "d83682ff-2d6c-47e1-856a-d868fc838b1b", "comment": "Malware payload (SnakeKeylogger)", "value": "815a022b0f91adfa7c1ecdf5d9571dc51ba35e36", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297859, "uuid": "a51527c0-13e1-46cc-abfc-0b14592cc700", "comment": "Malware payload (SnakeKeylogger)", "value": "690ec93d43ed976d13bff6b4ca37e17c15b528b023700d791f15098054288f579bcbed94616bf58c942de426d1dfb40b", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297859, "uuid": "1251b154-4e52-4301-aa9f-e185f07da7b7", "value": "T1BD253371B120635E40738BF10D476D636EEF4739B01FF49AAFE99A41DA5930B84BA123", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297859, "uuid": "bb837243-4682-4bf5-83d7-8668345799bd", "value": "24576:lXQ+p0n/WEK3muL+ODf1eWbfcF34wTjZ/w8dJJ2mIk4AOcT:9QxnuEKmSD1nbex4Ystov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686297859, "uuid": "ec3b6f8e-d305-454c-b364-9eb2a28726ce", "value": 967222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686297859, "uuid": "ab19e886-3c29-45c3-aadb-51c199336c69", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297859, "uuid": "3c272bfd-3fcd-4a74-9653-4fcf825bb419", "value": "bank swift.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e3c7af-06a0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (PryntStealer)", "timestamp": 1686299668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299668, "uuid": "10891cfb-5aa2-4a5d-bdc0-99dd3ff3fcdb", "comment": "Malware payload (PryntStealer)", "value": "e34ad9a826aa56c04ce0f10c800b789f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PryntStealer", "colour": "#A8B306", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299668, "uuid": "e28df1f0-6f95-48b5-a490-ed453bbe234b", "comment": "Malware payload (PryntStealer)", "value": "4aa12984de37ac1fb650f1196e88fb5a64707e571382d641e1c70ce82e89cf0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PryntStealer", "colour": "#A8B306", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299668, "uuid": "639f25e9-b8e8-4924-8ca5-3ddddb2bcc3d", "comment": "Malware payload (PryntStealer)", "value": "2f54efb23d78e570a7b29195520ccf346d181ad2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PryntStealer", "colour": "#A8B306", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299668, "uuid": "04ef9156-3fea-4866-89d4-a364ce4b9193", "comment": "Malware payload (PryntStealer)", "value": "0a9d9aa40e640bddeb3576e47e9f3d35a4de64c4402903f72aa039cf5fbf4d754d2e2e99496912ee2ff88428fb5a3666", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PryntStealer", "colour": "#A8B306", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299668, "uuid": "e7c4eb69-45b1-4095-b04e-6142fd096e49", "value": "T1C2954C12E6509039F4A300F68BFE06795A6CAF70230514D7D3C46DADAB6A9E17931F2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299668, "uuid": "d60fde48-7cb2-4b84-9c58-ab272945c4a5", "value": "292aade11672b3abdd24722742cf6115", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299668, "uuid": "a62c0d8f-ef18-41b5-add3-460c4275b44d", "value": "49152:4m764jXzDNyW+Raj6uegFMSmigqz/V3I0b0jZo1/IrDanQOgHpYbftTJ0TCoGvRi:4m764jXzDNyW+Raj6uegFMSfz/Fb0lo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686299668, "uuid": "4c6f0309-b7f2-4479-8c7e-5d23a7ee6e95", "value": 1899008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686299668, "uuid": "ade287ca-b029-4091-98f8-5af5cf12a861", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299668, "uuid": "3bc37514-2b2b-4991-b3a9-d3057533aa25", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60459495-069d-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686298348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298348, "uuid": "c56e3640-b2cd-4dc2-a5db-0f073b50f469", "comment": "Malware payload", "value": "d99b23472da2e00ffaf7091802b21d94", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298348, "uuid": "066dcd6e-6b50-45dd-8731-b66542f81591", "comment": "Malware payload", "value": "4ab5a7d43c6713fdcc8b25c024e96234b3987646379df532c70d4bbda5b026f2", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298348, "uuid": "963d3080-0bb3-480b-bab1-472139769dd3", "comment": "Malware payload", "value": "fc980f75b0b33cbc4c0807d232e2610346b91069", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298348, "uuid": "35c1153a-9dd6-4409-b4d8-b44d92e232de", "comment": "Malware payload", "value": "9cfc46d11d54381918837b815d96e8237f08fe5de3adcfc2f0699e19541838901b786c82780df35dfd6cad871d928f60", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686298348, "uuid": "890755dd-dcce-4b21-9cf0-f660d98f592a", "value": "T1C9E423CEF7CF6C64702F8B78BD52416240F6EBC9537458F0F6664258C9C6EA9A9A2034", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686298348, "uuid": "82a12ad7-8b39-4666-8c41-13e313fa3a0a", "value": "12288:g8QMQuBAUr/gOCkvp+tIvUTtvSTeA5amBoxHDVxLd4cVAjdNMcadZgZUr:g8QM1BPYkB+STP53q9KcGrMcaFr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686298348, "uuid": "0c097ecd-099f-4e1d-96d3-f0e7445e39d0", "value": 721900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686298348, "uuid": "8399c2bb-acbe-434b-8fe9-26085951e0f0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686298348, "uuid": "43bcd516-e553-49ac-be13-b3f5cec6b0dc", "value": "proforma Invoice.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d1a9f31-0691-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686293055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293055, "uuid": "0de392da-19ff-4b7a-976c-2d439855fd8a", "comment": "Malware payload (AgentTesla)", "value": "8ebe52c2b7e26c5d73b38e9aaf2e1f91", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293055, "uuid": "d41c95f7-d13f-4de5-bb69-7e5aeceaf387", "comment": "Malware payload (AgentTesla)", "value": "4b0d72fd6c23df11b0a836e7cdf73dcee7a18c6825a342fa239797080a3b4cc0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293055, "uuid": "e62ea867-9b21-420a-b989-fe68cef07c37", "comment": "Malware payload (AgentTesla)", "value": "17d8b5d3bfbc13758968e4ee45e4670d612f7338", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293055, "uuid": "1adff83b-98d5-4584-99ba-2cd5c4ff0942", "comment": "Malware payload (AgentTesla)", "value": "6c90b9f1cd5a0812afcfe12ff7e63792b6929337f44f5a658f30f8813c12bd071efc7e3241358f454fdd8def117fee04", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293055, "uuid": "892069c3-ea61-4006-b630-35a212f55341", "value": "T1520570BC9D07E5EBCE39E26A95F02307B3650517B65EB88C2ADA3B450D93DC132D064E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293055, "uuid": "eb0bddae-547e-4e7e-96fb-3b3437c78dba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293055, "uuid": "1f4696bf-680f-4d2c-b80b-3cd29ae2d13d", "value": "12288:KDf8fwr+78TOWEG59hu64NDkJV9eFWBVg2:KLTDEShu6O6Ey7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293055, "uuid": "a2c8852c-1cfb-4164-9824-a1ab77c03b58", "value": 857088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293055, "uuid": "413ddcb4-8958-484e-a707-e92755ec7039", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293055, "uuid": "dc0d7804-a7c9-4259-8d5e-1396e0f47409", "value": "BANKSLIP Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cd93f08-06a9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (IRATA)", "timestamp": 1686303604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303604, "uuid": "88826a7d-172d-46c9-88e0-012208efbcc7", "comment": "Malware payload (IRATA)", "value": "6cfeee3ec52dc569ca7f5ccaba4110c9", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303604, "uuid": "bdc63b34-c226-4ab0-86a7-6018dde40f42", "comment": "Malware payload (IRATA)", "value": "4ca30f92aadf9409173eef9491281e7e389a9d9f913edf018d554339b7c12594", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303604, "uuid": "d8b7c984-9d7e-4d09-b851-75e262386863", "comment": "Malware payload (IRATA)", "value": "96f2cbfaf41c79665fde6daa02ffb3d08a067643", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303604, "uuid": "fc0dc4a4-214d-4616-81ca-7a925df6f7f1", "comment": "Malware payload (IRATA)", "value": "1a1a279560aa74dab0701659302452c90d8aa8be129a7e4d2fe027924cf76b8e258a2e39359cd2e8571b24d34e21216b", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303604, "uuid": "fa95f673-1829-4594-8346-52dba09078c3", "value": "T14BA51257F365A92BCDF2D23220A0173610778D29DB47BB8A3A4877BD24BBED80B451D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303604, "uuid": "4e123b06-1d9b-4d7e-a43c-23f167f30237", "value": "49152:r/0MokTjvWLBos1T7/1W4yYRHd8vt/OVxfMgSSp+t:z0xGTW1vRyYR98cfOSgt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686303604, "uuid": "e5978d52-f337-435c-8582-c1f1a67f70dc", "value": 2183978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686303604, "uuid": "afb3d548-71df-4ac6-a4a8-c69748647bf5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303604, "uuid": "fe6c189d-22ae-4375-a3ed-efda9d9d5faa", "value": "eblagh.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff4ff48d-0691-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686293461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293461, "uuid": "26ce684f-b094-4336-a3cc-92caf402cde9", "comment": "Malware payload", "value": "eb760c0aec74de269c8f72b2a3d49063", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293461, "uuid": "802b476a-2ef4-4e2a-b62b-70895eb82768", "comment": "Malware payload", "value": "4d44d96cbfb3917e00aa7f17a3bc3e50057903645b620c959fd23da0d7e195c6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293461, "uuid": "3a80d06f-4b6e-4f7a-8051-fe156dcd8546", "comment": "Malware payload", "value": "09ba01db6d761f097b25ae2df0c8f55bfd199c6a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293461, "uuid": "2bf6be4f-e0fe-4592-a069-ca5c4b9dfad5", "comment": "Malware payload", "value": "c3f52e758f722ed9a3a382b7faecc9631128cf80a6ad61dee9a7da95ccb28bcced589b4f22607c6bdc84a5d2ffb581ef", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293461, "uuid": "ac96c280-8d6a-482e-a124-d4a5d21a226e", "value": "T1E7758D2DB780C2F9C873727635EC8295582DA01C03F091D3B98D661BEF70AA6ED7754A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293461, "uuid": "4d241ae6-ae57-498a-aebc-c1653da74ad2", "value": "c1f9fe382b2936f64b656867eee5f474", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293461, "uuid": "98b4c0ee-cad5-432d-8604-44d802fe779b", "value": "24576:rMAVKPeVptMtZz+1ysAUljkOJC/QyNFNxdn+6Hzgh+KuU4MdqbkHUsS/np+:dBgc7Fk2/yDfd+mzgtuU4Mdq2u/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293461, "uuid": "cd54a56c-fcfa-44bd-a8d4-f523a71b8761", "value": 1661952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293461, "uuid": "a4cd4380-bea8-460e-8af1-5a5f01669cb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293461, "uuid": "9ba72e41-c987-42d6-9ee9-24c093f08b74", "value": "03226599.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "052d5cb2-0693-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686293901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293901, "uuid": "0d8cc9ae-51bd-4e28-9606-696729a70711", "comment": "Malware payload", "value": "1a05562fe6dff22069e27733d6046a6b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293901, "uuid": "8a00952f-14ff-4c92-a820-14883700121b", "comment": "Malware payload", "value": "4d6ffdb9c2284b339103a293a94b37be7d7dc114e022fbcb101527b1bd7e7b8a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293901, "uuid": "c774a6cc-b5b4-4618-8593-77312d5b146a", "comment": "Malware payload", "value": "e9dafd8bc1c18a05a70877c1571f83fb726da23f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293901, "uuid": "9b041e85-3e57-4fd7-9e66-d21deceeb1e0", "comment": "Malware payload", "value": "f514c5141364a746912dab2a179d5db2611dd037dab42b7cea31d530a328f72a9d6fde2ea2c5da625b580794525233a8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293901, "uuid": "40fa1209-3610-4996-a542-a371a2ac4f04", "value": "T1B7027EDBB735C1E2C5A3C2F411B6FAABA6DC79F222FC1993099A416251C129584891CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293901, "uuid": "9984a3a8-844d-41fc-a0a4-73395e8df54c", "value": "0c3803208d2e42d5a9cb2491fd520ab6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293901, "uuid": "b9bff3a0-71ef-49aa-bc2e-a75e0e11eb67", "value": "192:nBIx8diYKE9tUCKJ0eiMulXzhgjsl/nQVZNy+:BAEnKJ7itlXVH/QLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293901, "uuid": "86e3b691-d46f-4e49-9118-6e58e05242cb", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293901, "uuid": "1dc75e41-5f27-4506-ac4f-cb2d697131ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293901, "uuid": "8890a1a0-b193-4745-acb6-08b9a9e9b095", "value": "08400899.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30237222-0698-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686296120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296120, "uuid": "fad1b44e-1ddc-4a06-8797-a065d3cae08d", "comment": "Malware payload (AgentTesla)", "value": "a5e588a58a3edb07a2024cb05787822e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296120, "uuid": "400403dc-37b1-41b6-9d9c-384477b0cb78", "comment": "Malware payload (AgentTesla)", "value": "4e623067ce51115111c5876d2fb13292b4627003dc7dea1cabec56024a621a13", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296120, "uuid": "9185a632-008e-40fd-823a-6b059199f57a", "comment": "Malware payload (AgentTesla)", "value": "da6aa958b99ba13055cd4022a63ecde96b0f48f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296120, "uuid": "821dfea2-3734-434f-8f65-0fd1e213b989", "comment": "Malware payload (AgentTesla)", "value": "a14375f325ec89392e61b0a65068861bdd019274972b0bb17e229b42b038c1e630934c014e1e4612d878dee4999e9f7e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296120, "uuid": "5a649cb4-0c2c-4df8-af2b-e59b0034e6d9", "value": "T10BE423E00EE86C0C6A079151F533095B479FFF102AE504CDA73FA866AF2E1D7E82B591", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296120, "uuid": "62ef8ed6-f865-43c8-b810-b0cb5afc4c12", "value": "12288:1KYvfDBWFPutyu2CpA97e758QDA55tkTpR7b/iMIGJu3hEaEtPE0s0WsE+hu2:15vfDBsGtp2D97eV8QDkGEmM0s0dESu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686296120, "uuid": "cdaa8fdd-ed07-48b6-a3aa-839ec5129a2a", "value": 674181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686296120, "uuid": "6beec57f-aa0d-49d3-8149-8914cf677e7b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296120, "uuid": "b5497266-a9f7-40f0-81b1-fe333b19776e", "value": "Wire Transfer Form.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93495b4b-06a9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686303588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303588, "uuid": "65e9ebda-7ecc-4519-b740-ca0ba02ffce2", "comment": "Malware payload (AgentTesla)", "value": "20ac8589a694e3303973b26645862d1d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "raj", "colour": "#8F309A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303588, "uuid": "ac109e88-ef60-44ec-afe5-2038728ac857", "comment": "Malware payload (AgentTesla)", "value": "50873039c6263eec6d2010a1d889102e0e8dc8a915bbd7c890dabfb4afad7765", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "raj", "colour": "#8F309A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303588, "uuid": "7e47bab1-2663-4ca2-b8b8-20c86835685c", "comment": "Malware payload (AgentTesla)", "value": "24da96b0fd2adc19dc130a0c1a60aa1a70c8a159", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "raj", "colour": "#8F309A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303588, "uuid": "a8c55e94-de39-4d77-a42f-61843c7b3c1a", "comment": "Malware payload (AgentTesla)", "value": "adad6a9d4f024859d4c7a3c7f55b819877e663263d75f088a2675446b68458b5055f12feb9a3a257b04f5d7ccb1298d9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "raj", "colour": "#8F309A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303588, "uuid": "cb5da170-d2fe-40bc-997a-661fc3388f26", "value": "T148E4233F5433FFCC60565B69DA90A8A9740092D5054B5A85CBE91013E6EC8CDEFEB3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303588, "uuid": "52b0ecb2-5fc6-4dee-a022-c95998be33d8", "value": "12288:Jva4VZ/tI4OpV3j1odH/mXH81QM1EGdCvqumYUl/vHVRXbBSXm7Af0ow17vB2NKa:JS4VrI4OpB1odHuM1nEDvqnYUFv1JyxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686303588, "uuid": "a3cf9fc8-8283-437d-aa8b-008eee0edefb", "value": 683116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686303588, "uuid": "58c866fa-edd6-4223-bba3-a88c53441a3a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303588, "uuid": "e5211cb8-7b59-4756-83d6-bcb5a29f1ce6", "value": "PAYMENT COPY.raJ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9300390e-0698-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686296286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296286, "uuid": "c99e8817-1ecd-4f12-a451-3a897515a1c7", "comment": "Malware payload (AgentTesla)", "value": "4376b188058ea90fceaa3d49caa7dd8a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296286, "uuid": "d0dfa97e-0d26-45b2-83a5-c2c87bf52967", "comment": "Malware payload (AgentTesla)", "value": "50ac458169dd382176f04c26b8538ce829c903bf60cc2fa5ca7681feba1a7a98", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296286, "uuid": "e02dfc4a-fa99-463b-b490-8209dd557e4d", "comment": "Malware payload (AgentTesla)", "value": "339d21a0d00f4662f8bd8a83c009a9bf6af92870", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296286, "uuid": "9ce47c0c-8a60-40e0-99ed-fbc43963d8d9", "comment": "Malware payload (AgentTesla)", "value": "257f1d667746c797d98cf2f19ae37f26b4a7f9b3e10bfda704d1fb69ccdad9a4743586bb84ef17a8e3c4f5b1aa1fb7a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296286, "uuid": "8b2a52b8-7607-4d33-a8f4-dbb22914342a", "value": "T190F4F119E2BB5B2ED4BA6BFD050011358BF5545F7267D303AE9A78CFDD64B000E81AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296286, "uuid": "9920f7e0-cf33-4565-af5b-b0838ffb95c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296286, "uuid": "eab78c23-583e-47e6-9dea-2116766dea76", "value": "12288:jBTmC0lWxMzIHREJVk/bq4izoW/m7s2vVRjUEJ94kcWZh5SS/JXEnrvzmVictF+E:BmflWxMiQW/O4ue7fVRjUEHYSLUnr7Ar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686296286, "uuid": "2a9af856-3ff5-485f-a10d-330c30fc6539", "value": 770560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686296286, "uuid": "5bf7cf1f-614e-49fe-8d52-6665b97903a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296286, "uuid": "e983008f-aff9-414f-85ba-c5c2862b2cb1", "value": "kfHQchqedfEOz99.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad0f3375-069b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1686297618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297618, "uuid": "f501ff84-8a09-47f9-bec9-7281b60d6ce8", "comment": "Malware payload (AsyncRAT)", "value": "251523fa1b013d8ca82ab08f177d3ab2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297618, "uuid": "3f98c8bb-fecf-4b8e-bc76-6e31d3fb5276", "comment": "Malware payload (AsyncRAT)", "value": "515e5105f1bda9207f1342220ecaddc6dc04b8aa54149e7cc7ccb38225845d03", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297618, "uuid": "46899ddd-c141-4b5c-b9ae-960c381046db", "comment": "Malware payload (AsyncRAT)", "value": "ff641e25cb287db90de6f59786a9a940aa2c5bee", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297618, "uuid": "6f3032a6-6217-45e8-8a29-5585f9533358", "comment": "Malware payload (AsyncRAT)", "value": "3c1b5105f30320e60add810138d4c1fee37bf1af98b85ffa3e3bd9cc4e509dc162fec0e5097a6f3ad8b511dfd1f25307", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297618, "uuid": "bfe71fab-3b5b-4157-8fe7-197b4ba49aa9", "value": "T176333B0037F8816BF2BE4F74ACF261458A76F6736603D64E1C84519B1613FCA8A536FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297618, "uuid": "52136dd3-096b-464c-b906-01fc66bb96ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297618, "uuid": "154f182a-2045-4286-92df-e86008746c17", "value": "1536:luqY9T9xy2eD3bmXSTLNI98P0wx8vV9XdD4C:luqUT9xy2eD3bmsxI9S8vVhR4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686297618, "uuid": "ba5ef6fa-d663-47b5-9e8f-d90474e17ea0", "value": 50688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686297618, "uuid": "c3c2e7e7-bf17-49cd-a22a-8ac1b075eae1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297618, "uuid": "cf11b444-f332-46d5-9c92-50b8bbc4c11f", "value": "251523fa1b013d8ca82ab08f177d3ab2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "245e80ee-06d8-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686323588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686323588, "uuid": "b1b30d54-d6ba-4093-aa78-895413411d43", "comment": "Malware payload", "value": "fda21c4fa7433532d77e8b554efbb664", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686323588, "uuid": "02d4633d-7ce9-415f-a306-aaf5dea3563e", "comment": "Malware payload", "value": "517c28639a180fd2e1acdb0142f126ad90ce46333096e07f5064adc1a0b48292", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686323588, "uuid": "0e204ff6-dcfe-4ef0-b2b1-cc590353c0c4", "comment": "Malware payload", "value": "f75766101d5cedf2cbe1024acc08ab45789a0040", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686323588, "uuid": "e962ada7-caf5-410a-8c35-c96d86a8ae78", "comment": "Malware payload", "value": "4f79b31dc6634653d6a4cac9da4e4e01cc394ce4850c2bbf661ee7fff6e6f4db971e348f4677477060f7bd693372f78f", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686323588, "uuid": "1eb09c08-a92d-44ea-bf03-75899109188c", "value": "T12302C574CD2CAE92451CBA847B21BD4410E9293B4E7CA4FCFEA20850B654E4EFF37856", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686323588, "uuid": "cef11a12-cf8d-4b7a-97e9-aef884cce2e6", "value": "192:7SNMQir5qvXhjyhwPyxl3+XA5GF5hjG1r8Qf:7bbcXhjyhW0luX75hjGiQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686323588, "uuid": "6c80fd03-707d-4046-a481-19215cd93e89", "value": 8482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686323588, "uuid": "c40d7f6f-58b7-49a4-8e2f-d46c2b5b7a9a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686323588, "uuid": "287f956d-bb7a-4e34-b105-eeb0d4dd383f", "value": "Launcher.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed686e26-069f-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686299444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299444, "uuid": "b1d4f677-5647-415f-8489-9f664c8cb66b", "comment": "Malware payload", "value": "b1a08fc2810cca050d2d33ccf81b2b3a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299444, "uuid": "c64aad45-dc87-43b0-bced-5735eaef599a", "comment": "Malware payload", "value": "522e4a5ed3f0216da03451b21726247e26c0ac76f0e0432626ccdb98488ec7aa", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299444, "uuid": "2f3bd20b-fbf5-49d3-b9c0-d2e396d2c6e2", "comment": "Malware payload", "value": "6f7e15d5f71810e3081b4e9f929b423da2d67331", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299444, "uuid": "5d243e99-5cad-4e94-8acf-b1a9a603db04", "comment": "Malware payload", "value": "c5a33a190ff91fca8a2ea478ff2f722bc82dc3c990dab115454026db09abc5cccd690d1a2f1b6c158348bcc807130840", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299444, "uuid": "21f10d4c-41c7-406b-93f9-8253102f425e", "value": "T1F9A3022DC1650A11D9DF8DFF930582E71C002D66A7D2616F70B17AC8DA206EE1CABDED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299444, "uuid": "5eb98e44-e31d-4e1c-948b-1c1bbeaa27a8", "value": "1536:vxzixJH4P6nk5jVHW8AuNIz0zHrWvBiekO1N7l+uBFupeH+Cw0d95dWmu20fTzs7:sW6k5jRtXYmHrq/NxdEr45dWmYf47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686299444, "uuid": "977bd15d-8aee-4136-bb52-44247524a83d", "value": 103411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686299444, "uuid": "94954b8a-e5c1-4e01-ac03-e7661768212b", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299444, "uuid": "cf9ed5a0-6f9b-4273-b5a8-b443158c5fea", "value": "MESSAGE.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ef0fb3b-0693-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686294132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294132, "uuid": "2a9f7834-66b2-4fe8-9c80-9d885936a18e", "comment": "Malware payload (AgentTesla)", "value": "ad105aa5763489def9d84d93c586ae73", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294132, "uuid": "940fb4d3-c6df-464b-94f2-d1e87a52ac45", "comment": "Malware payload (AgentTesla)", "value": "5230d8d456e539de85e89dee474a7d410ae29aa2f715a2409deb48c4e2a73196", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294132, "uuid": "94ee23c0-6dd0-4ba4-a24d-3f02843cbff9", "comment": "Malware payload (AgentTesla)", "value": "4c19c399600fec31fb95e790849bb887734b68b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294132, "uuid": "db53722d-bf1e-4594-90cd-3b21ef6fb31e", "comment": "Malware payload (AgentTesla)", "value": "31cb5fe340d172180d728f85ac5ec72b772290762e573dbb0cae84a99fd660b7cb024b2f5c686d63f4f387ab0dd70368", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294132, "uuid": "62caf0ef-ab34-4b33-8506-204f58b780c4", "value": "T10A05E08863FA9F5BC4BA5FFD0450107083F5596B313BE6974CD2A4DEAE64F450A80E93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294132, "uuid": "0118ef99-6cc1-41ad-a012-c2d946d6963f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294132, "uuid": "60708ce0-335f-4992-a47e-536d38511210", "value": "24576:AUlRulOyqGUL8Baz5uvcwgMNUlfoWRGLyqr:AUlRulNqGo88Yh1CRO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686294132, "uuid": "e1023233-7842-4077-b8d8-7d5a9161bc5e", "value": 814592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686294132, "uuid": "9229f99d-be0e-41bc-9fae-89744eeaade8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294132, "uuid": "aa958422-1448-4975-a9cd-c75d7938c7b3", "value": "purchase order No. 450271795.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7426158a-06a4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686301388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301388, "uuid": "d39dbf05-8159-4d41-b339-40528c3d755a", "comment": "Malware payload (AgentTesla)", "value": "4bfcfe311e238e2b88c77312e784bf36", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301388, "uuid": "bd7fdeb5-7516-423d-9799-efb567df11c8", "comment": "Malware payload (AgentTesla)", "value": "52d10d39c3d9bc2664245025bb30c1e2f6157fb1679da9806463f2875eb5842f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301388, "uuid": "6f55fc8b-4004-42a0-bc51-8ec6650aa144", "comment": "Malware payload (AgentTesla)", "value": "7d952d7cffe69b677b1be447b311c91292b290b3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301388, "uuid": "b8fc7726-c304-46fd-8bc0-a79094a92b4a", "comment": "Malware payload (AgentTesla)", "value": "c9f66c9ea81e41a0aa7af804f14fb4e4054a21fc035fd90e9e251193aac60501f03c150124ef1202ab13292e900fb3d6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301388, "uuid": "d1155169-bc8b-4f5c-a1f6-d414566f0347", "value": "T1FB452B16A3F4C392E1AA0B3558B262805776F7777512CB0F39CC11A90F57B908A61BD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301388, "uuid": "3be55b7e-6e8a-4e7e-b08c-18405ceb8765", "value": "384:j7AqZSCDIqFDNOgLlPBB1kjNCa21wwhGo5x4f39esH+r5k41MOM:jzFDNBLlPF4FGxutSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686301388, "uuid": "b1a91160-1bad-4e12-85e9-b58a1afa96af", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686301388, "uuid": "992117cb-f3d8-41d9-8154-a1df182712f8", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301388, "uuid": "a9cdaafc-3063-4e52-9b15-d39f54863e70", "value": "New PO#3500202470.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f81c21c1-06a4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686301610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301610, "uuid": "3ec909de-dd1e-45d9-a626-c278d67aae78", "comment": "Malware payload (RedLineStealer)", "value": "25623138f6ab8c72ef15615a76b4adbc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301610, "uuid": "6babba16-6f84-4bd5-a5ba-8e0df854fa7a", "comment": "Malware payload (RedLineStealer)", "value": "5392a4d9dcec99da44ff8338a131c56a874720c3093ffdd81af955bac12cbac4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301610, "uuid": "986a022d-0526-4ee9-b5dd-50be6d574269", "comment": "Malware payload (RedLineStealer)", "value": "c531e563a6bfcc45c29530190a3e7efb0b51ad41", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301610, "uuid": "1f6f2e39-4e64-4d45-a06d-67258975412b", "comment": "Malware payload (RedLineStealer)", "value": "d28cdb0bfa8fa3fc1b25a2643d73fa6027b04457d747c629ccb2e1ced353bfc4d10da496ea72bc7ba245ba85e1e732b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301610, "uuid": "a6e151ad-00ea-4d6a-be16-b1b27f02fb1e", "value": "T159763345E0C4D9A9D822383CEAE35109C0B1FD109A6CE2076D5D757CE6BABDCE95B383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301610, "uuid": "46390417-f506-451b-9a34-27893ae833ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301610, "uuid": "fbe21d5c-03b6-45bf-8868-cc1d6edacc0c", "value": "98304:unPKEAkIRwKJV3NpyLV1vo8el6beU706rS96aTL0NHrZo3H4jz8w/9I7UWtzucI:I/QRwKrqXvTQ6O9pTgNtuuz8A5WCc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686301610, "uuid": "58c5c28b-ce0c-4c11-9d7f-af34b38b787b", "value": 7155200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686301610, "uuid": "4e1c79ae-e992-46a3-87a8-57f898dcd128", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301610, "uuid": "450dd330-9bb1-44a8-b304-c736351c043f", "value": "25623138f6ab8c72ef15615a76b4adbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aed97bf-06a5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GurcuStealer)", "timestamp": 1686301641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301641, "uuid": "80168719-5444-457f-b1d6-e5c90440e900", "comment": "Malware payload (GurcuStealer)", "value": "3bcc1eb867ab61418fe7a99dcffa3734", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301641, "uuid": "84fab6ca-2384-403c-b4c4-d02c0cde996c", "comment": "Malware payload (GurcuStealer)", "value": "5392bfbbc84541d99563511dfa736ec514642b68292089154e0126f0e9eddf37", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301641, "uuid": "6dc58440-fe4e-4177-aa3c-070a37437e7c", "comment": "Malware payload (GurcuStealer)", "value": "cea3fa7f0358089e0ce7786606346d893c7be4a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301641, "uuid": "d3517ede-4494-45cc-8cb6-7470fe5f92b8", "comment": "Malware payload (GurcuStealer)", "value": "bf6172478d89a4c14bfc741adf0f1d8ac34c9812bcfe4ef414a330c129ec969ddc3aa5cd034f397dfb19b1b9f14fbcd9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GurcuStealer", "colour": "#148E89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301641, "uuid": "0a591bdb-5be1-4a9a-8e8f-ea485c3afc57", "value": "T1F0F4B02162E9CFD0C59F2475EC96B1F84617EE10CC109FDB3D88BE1A39B22A5A97114F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301641, "uuid": "2ea6292d-ab36-4b0e-bf19-36c0c5c58d67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301641, "uuid": "8710d6c0-655f-430b-b5c9-ed8d19451d5e", "value": "3072:Zxyod3gsuVf/LxMmKvcAznwucfxBmN9Cm55l6bNU:xiflLK0CU7hyl6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686301641, "uuid": "50c73b86-2c47-4909-a601-351a36679d65", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686301641, "uuid": "4090b636-c668-4ffb-b6cd-c089bf41b00c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301641, "uuid": "4b762980-cf16-480b-8cf2-173a2345469e", "value": "3bcc1eb867ab61418fe7a99dcffa3734", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "303b3027-06cf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686319743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686319743, "uuid": "2763bcfa-b0e8-433e-ac50-0e4fb72946d4", "comment": "Malware payload (AgentTesla)", "value": "3b335d8d0f44db714208ccd03c78dc03", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686319743, "uuid": "813c553e-f390-46be-979a-6b26f62fff51", "comment": "Malware payload (AgentTesla)", "value": "540db87dda0e0f89bdd7d58b0ca66d56dad8bd69a95f6c3818eedeb087d00d9b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686319743, "uuid": "d2096216-b3a3-445f-87d4-af9c6171dc04", "comment": "Malware payload (AgentTesla)", "value": "2899a3840c6a5f61fe9814cf12b2c4ae41c18502", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686319743, "uuid": "fc0360cc-bcc7-4b98-b719-6b8743cffa54", "comment": "Malware payload (AgentTesla)", "value": "796e784fb1993be09911202b0d367b5edb01749a1aeabb7fb0f3b2c0aef44159ce0a031385b2f50c1ea95ba90fbe43a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686319743, "uuid": "9e14cd7d-8233-4d53-b81f-7068c5dc2e41", "value": "T1D354222088D8C4BBD6F387721932235FB792FA15A6B81A5F0F00ABB535A01569D1DF73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686319743, "uuid": "ee12c603-f7ae-4946-aedb-e51e70a33cb5", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686319743, "uuid": "4ca8a376-d8d3-4102-b3ca-1e6cd5adda50", "value": "6144:PYa6NNfcDW98wAeecgMYIts697GdbwF6OdF9358V+1GKD:PY36SkSgMYa9PJdj58VMpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686319743, "uuid": "341680fb-4b6a-4d54-8d12-23ab795841f3", "value": 288899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686319743, "uuid": "99a3af6e-543c-4d85-9b63-6f946fba03b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686319743, "uuid": "c4b0a4f1-e541-4b15-8b5d-304243707ea0", "value": "rShipmentsImportCustomDutydocuments.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c44efa23-067c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (PripyatMiner)", "timestamp": 1686284343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686284343, "uuid": "5ae33e2b-a310-43e6-bc7a-c402acc7573f", "comment": "Malware payload (PripyatMiner)", "value": "828dda50caa47e37c427142e216c373f", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PripyatMiner", "colour": "#2B62D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686284343, "uuid": "66729a7b-e251-4b48-9a1e-d316d9189de9", "comment": "Malware payload (PripyatMiner)", "value": "54c7a21de074152b11a9aefb278508706176189c322c08fc2e56fec1a7f9169b", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PripyatMiner", "colour": "#2B62D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686284343, "uuid": "8b6c3ce9-90e5-44e3-b813-007abcc90967", "comment": "Malware payload (PripyatMiner)", "value": "5826e56d1e4133473f69b987f3977658598b3ff6", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PripyatMiner", "colour": "#2B62D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686284343, "uuid": "9ec2e4a9-58bf-42c1-8611-5815ae37c089", "comment": "Malware payload (PripyatMiner)", "value": "94ed47e532afe4fc68595a5a25d0af50d9f7ec22697a7c9cba54f96e57b82b604c35c70b4a38f738f3220d15fdb73e65", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PripyatMiner", "colour": "#2B62D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686284343, "uuid": "cb4ea815-6148-46ef-bb3f-0a1b883d8155", "value": "T160A6CF97033422E0F9BA903BD413753B02D4BBB20E617FE98F65DAA6967144CBE742D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686284343, "uuid": "e7cf24f8-ade0-4ebf-a121-126ae7f6e303", "value": "f7505c167603909b7180406402fef19e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686284343, "uuid": "40fbadb1-b863-4b5d-9a70-ca2152c30754", "value": "98304:O+uYZVNKpE1d5eqjDiI5pmOl3AR6hfn47tYjr6uh+PTJtSUBzYXk4fTbZthsZbfH:OId5eqPthrr6uh+PTJtS3t0aZAFtiQMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686284343, "uuid": "ddcc5fe9-32bd-43de-8519-bc3fdd43f713", "value": 10314672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686284343, "uuid": "ee3dec8e-1ba8-4fea-bd37-db54d066b715", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686284343, "uuid": "d43d0a93-4e2e-4dc8-bf61-6e4c037c2b33", "value": "828dda50caa47e37c427142e216c373f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea973060-06a7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686302876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302876, "uuid": "09fb4064-0c23-4e4e-a084-cd9a18d581e3", "comment": "Malware payload (AgentTesla)", "value": "c40ebf14a692f61d8b375150225e82c4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302876, "uuid": "37ba3d09-21e4-428d-a79d-3f394026121f", "comment": "Malware payload (AgentTesla)", "value": "56470eb20a962eca0266b317cdead9283da67e6b89a09b0dac477ad174f0aa89", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302876, "uuid": "5d942a26-b6a8-4fdd-9e71-596e162a801a", "comment": "Malware payload (AgentTesla)", "value": "2a65be7f0f064f82b5b7ba3173847f6318c0925f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302876, "uuid": "cc5ffa5a-a6bf-489e-8107-5b7548a4daa5", "comment": "Malware payload (AgentTesla)", "value": "8abe71700a33c937a04281dc5d9329627da0bf15c35ddc41281d9acfcb519d97c879d2121c790c090f58bd231036dc7f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302876, "uuid": "dd67ada2-c74e-4392-a7dc-f6de7c70d5a6", "value": "T1A0E43336C8599D03FD18AF7452CB5D035AA8E79AF85CAA64D31CB978B383D7F21109E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302876, "uuid": "646cb2c8-568b-428b-ab9d-11714e29f077", "value": "12288:+uj7goNjnvXVo2lkbNPr2XZL4flKb+HcvTugG1A6X3O4wu2kS9A:fjvF58NTmZ4flZ8voz3LwufEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686302876, "uuid": "4bcaf729-e271-4b4a-a03b-b7b99e6fc234", "value": 687276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686302876, "uuid": "d388ea44-5211-45de-bdde-01fe41eacff1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302876, "uuid": "abb59cec-8ef3-4cc3-8819-7aa2dd9ac243", "value": "quotation list.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97e32b98-06a9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686303596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303596, "uuid": "50ef1279-693a-4c2c-a8ac-19bf2a4f65d1", "comment": "Malware payload (AgentTesla)", "value": "69360cf73d370fa9313513b2c7905746", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303596, "uuid": "9089d3ce-4fb0-4e26-a1b7-cab7f61cb14f", "comment": "Malware payload (AgentTesla)", "value": "56760fe2413f4092fb7e3b1d3651674e1ec297930e8207ab7fd4d8d62684f121", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303596, "uuid": "d49fe9c6-c2ff-498b-a457-b690d4807f15", "comment": "Malware payload (AgentTesla)", "value": "79dde3964cb739f2e39f4a2be848e7e91587719a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303596, "uuid": "747004a8-6529-4b4f-8664-d198d88851d6", "comment": "Malware payload (AgentTesla)", "value": "9484930a5fa674a731a52d28be3c056a33b1db85d71fb044f5d8add78b35aadf1fc389600a6ce3e57ddc5aafc9a02747", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303596, "uuid": "6c0d4396-4a3e-4c85-99ea-a345261b4dd9", "value": "T152F401BC0396686BC58DAE3C0D8556B8EBF84A837A13E3438797781DDD0FB864A454D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303596, "uuid": "ad00dc94-bc80-4fa1-ba0e-5de22b36f057", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303596, "uuid": "36123b9b-c1e6-45a3-af84-35d4f8dff7b2", "value": "12288:frnbhaDnLMzIL2q+RTdOL8f72Z/rbkaC0K2wzlFYwQ1kCYsjLVJqA5wzNNcX6fv1:j1OyqGUL8fyZDbkazT1kC7FJqywvcXMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686303596, "uuid": "a705cd1b-9ac0-4d4c-a04d-98d92695f990", "value": 778240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686303596, "uuid": "ad93bc27-b49d-4d31-ba5e-b6b4a2df1d5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303596, "uuid": "c4a46ce6-4f74-4e99-882c-714f1f25b848", "value": "PAYMENT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c5cbc23-06ad-11ee-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1686305133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686305133, "uuid": "d855ea63-0c89-4722-ab5c-585aec1a6461", "comment": "Malware payload (NanoCore)", "value": "a9f6b8b9e0c7aa5440ab4dbd007c0752", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686305133, "uuid": "be48b9bf-47fe-4e37-8898-c84842d14103", "comment": "Malware payload (NanoCore)", "value": "5998e7c2db3d6aeb7b7680e45958c368dddedadf064aada00118b6452c72408d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686305133, "uuid": "bd628ab7-9cd7-4938-b860-502a087456c5", "comment": "Malware payload (NanoCore)", "value": "a2e51fa02c9bf1e24cc4a15e573cb324dd34952e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686305133, "uuid": "071ab361-6368-4adc-9ea3-118a66749b33", "comment": "Malware payload (NanoCore)", "value": "386bce5a8c55e75d7060d830b84ae5d4f1931190f715ca5f599835fecdfa06cb8cf8ec45bc95bcffff27d447f4b30621", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686305133, "uuid": "16c7356b-f009-4f87-a813-9ce73e91fbe4", "value": "T17A14CF6637E84A2FE2CE8579611251139379C2E3D8C3F3DE68D464B78B667E10A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686305133, "uuid": "518de5de-7f6c-451f-8822-227b70f8909e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686305133, "uuid": "a5d5a458-e266-4c63-9764-da9f43f7c2e0", "value": "3072:gzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIeK5fUisD1NHmB5n7lnQidogwZ:gLV6Bta6dtJmakIM5YjsDM5nZQi+nA2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686305133, "uuid": "b6f70f4a-9e5e-4f24-a4d5-83d884b883c7", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686305133, "uuid": "473f28ed-2781-48ba-8a01-d1ab9310a1bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686305133, "uuid": "8b789a42-38cd-4400-bf67-8099f5eaf79d", "value": "5998e7c2db3d6aeb7b7680e45958c368dddedadf064aada00118b6452c72408d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc3aaf8-06a9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (LaplasClipper)", "timestamp": 1686303738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303738, "uuid": "ba5189f9-4e7c-40cd-be44-2b2a58dc6355", "comment": "Malware payload (LaplasClipper)", "value": "ccf4763882256111f713d881ad7d9aa9", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303738, "uuid": "dab1a151-18b2-467e-a4a7-e194ee949975", "comment": "Malware payload (LaplasClipper)", "value": "59d9b80d021e8dc40f387d759ce6f77c56330a07352c0238f1768116cf80ebf7", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303738, "uuid": "8e7b9090-e28e-464d-87cf-e6ed4be5ee4f", "comment": "Malware payload (LaplasClipper)", "value": "507297f20fd3fbda9a8cd426bbcffdeb8e4e8ab1", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303738, "uuid": "ecdc591c-cc1e-4d64-a167-6323f3c682ae", "comment": "Malware payload (LaplasClipper)", "value": "53503952058315219abd2527e9d5ab530198526f65a302dd18cb99556ea036c101e4ab8db943b977a023ed1365be5364", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303738, "uuid": "5c89dac8-0f11-4aeb-81f1-1aa1062c1538", "value": "T1C406333575C3C6B8D2895630512AD2749135BF9C7A432F7AB1BF35A2FA30386FE06486", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303738, "uuid": "20df9a67-101b-4470-a360-193f6213ad9b", "value": "79b3362178937bf9559741c46bb9e035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303738, "uuid": "9c06267e-47a6-4dc9-9841-023c11d18198", "value": "98304:o+bU8AtKpng3RiQT0Q9zc7J7MRNCwZMGzcf+UctPK0:o+bUVtKxg3RiQ7z0J7MuwDzcGUck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686303738, "uuid": "ed68395d-bcb5-4c41-9519-32cc911d0b7b", "value": 3837440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686303738, "uuid": "4597b6a7-b24a-4417-ae50-7f31c0672b4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303738, "uuid": "e9a64601-dda2-4a9e-88e3-5013ba288d2b", "value": "ccf4763882256111f713d881ad7d9aa9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd7b84f8-06f9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CobaltStrike)", "timestamp": 1686338126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686338126, "uuid": "801ab8f1-4ba0-40ae-8f23-6790605d644e", "comment": "Malware payload (CobaltStrike)", "value": "1747af9f1b9db5785c6913ac2ead8ef3", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686338126, "uuid": "58339219-275d-4fe7-a2d5-e7d0e3b0524e", "comment": "Malware payload (CobaltStrike)", "value": "5a268b88ea8b1cad2a07b43e855af3ad4f5e9fb0e1aef21ab4d2a66306c3dca4", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686338126, "uuid": "22874f32-f6b8-42fd-aa5d-1cd0936bd7f8", "comment": "Malware payload (CobaltStrike)", "value": "0854b060ba3fb5acc96ee30c44d6c17799c92d7f", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686338126, "uuid": "95ae3eae-80fc-4c43-bbbf-661112f6e2fa", "comment": "Malware payload (CobaltStrike)", "value": "55fa1865bd21afab43484b6a0318eca990396babd175158c9f08fcaf4d95c3bb3c2de6515ac10020c1ebbca12cf695db", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686338126, "uuid": "db52b4ac-4967-401c-8f8b-9599d0fe7764", "value": "T17FA3F81AF3A320F9C05AC17556EB92B3EA72BC301121AFAE8394DE752F64D516F2D710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686338126, "uuid": "380fdac2-908a-4404-8e66-798a4f6365d2", "value": "851b3b915be34ffd02bc31b65dd9a2a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686338126, "uuid": "abf3c239-9649-48ad-b76c-3d0b6a237351", "value": "3072:utNFuBMb+6qKQrKtoNFdUlaPPOirDv23byVT:Mr+lKQrQC0GT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686338126, "uuid": "1413311d-a7c4-4b91-8b46-272b9187e1c0", "value": 105472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686338126, "uuid": "a4ebb245-d4e6-482d-9e02-7fa446b4692b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686338126, "uuid": "41fe0489-d73d-4ff6-b109-7752ee1d14d9", "value": "1747af9f1b9db5785c6913ac2ead8ef3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f224fac9-069c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1686298164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298164, "uuid": "c916eca0-035f-428b-99e3-819da03ac72e", "comment": "Malware payload (ModiLoader)", "value": "64c9c069d7548330d16f880b8ebc7ab2", "object_relation": "md5", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298164, "uuid": "e1f5cc6c-7a2c-458c-bdca-72202147e546", "comment": "Malware payload (ModiLoader)", "value": "5a96f10901f5e9397ab423e189c002cd75901bb716c0ed1dab371f52f071cf3e", "object_relation": "sha256", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298164, "uuid": "ec26d10b-5211-4198-b652-b06cdda28269", "comment": "Malware payload (ModiLoader)", "value": "12d81c7c5cda079cb3137601964279a77fc4fb2f", "object_relation": "sha1", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298164, "uuid": "96572dd6-fb8c-4187-9174-8af5c5779d32", "comment": "Malware payload (ModiLoader)", "value": "c555a67a68420997cf572009db1856e005b0797dc23281a927dd3c64a2dece6c20a0ab8e5e18a40ad39af3e54ade91c4", "object_relation": "sha3-384", "Tag": [ { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686298164, "uuid": "764bc4a0-d5fd-419d-95d2-f363f9df506d", "value": "T15294236612A99CCFFC357691A8C1DED434C4E450C3653DEBBD8C0C869D99F8EA0A42DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686298164, "uuid": "3fed8048-caf3-4dfd-ac08-487b70fd51c1", "value": "12288:6ivCRR7aQnJ3BLi3XFobUtr296IxGSayh7/jCo9rMWKXzE:LCb7rJBW3LN296kfa6PCoJMWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686298164, "uuid": "27624ae8-79bc-4d67-86ec-38a3795ddb5d", "value": 436186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686298164, "uuid": "c0c52da9-b6d1-44f9-9e50-915d7e75d751", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686298164, "uuid": "8ffbac8a-8549-43be-8acf-bba3b9dbe8ce", "value": "Potvrda narudzbe u prilogu.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41919673-06eb-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686331798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686331798, "uuid": "56e62387-4243-4e5c-a6c9-cf32b60b2f8a", "comment": "Malware payload", "value": "b774340174ff0e9ba16bb7c95b80a4df", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686331798, "uuid": "fd13ee68-26c8-4143-ad1f-f977ca97a187", "comment": "Malware payload", "value": "5ac69c8e54fb08fdc85586c8abf0ba19ebd2fecfab9007c6a6434ae47c513ff8", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686331798, "uuid": "e8836ed6-230c-4eff-af4b-79d96dd7cfc0", "comment": "Malware payload", "value": "84774450e17cf9c1ac5ca5b9d0ec0e15bc89a114", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686331798, "uuid": "ecfa6754-7541-4834-9f86-af4bf732b017", "comment": "Malware payload", "value": "3fa724a2c726e2ed59bd5964675cf2d112c2a530af2ab513d16725db3dd154247ca90b925bde91352557b51ca9e6fc43", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686331798, "uuid": "3f7a5855-7348-4e26-958b-e8745d0817a2", "value": "T19DD5334C52D44785FF8AC6F556B82B3AE15864BB2B123EC436DCE01EC21F791A71AE70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686331798, "uuid": "674991ed-cd7b-444b-97df-09fbdc3cd86b", "value": "49152:Z993i3/eIuQEjXwxUV2g8KPW5GqarBe1oTmqoaP7Mw:v1qe9QKXwX5GBrg1wmsP7Mw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686331798, "uuid": "e9842499-f728-47a3-ab7b-8e4ebaaffcf7", "value": 2836553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686331798, "uuid": "498a7a8d-2858-4c32-b3e2-3eb22fa671a6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686331798, "uuid": "4fb690bd-9d61-4f2b-955c-14dbf196735e", "value": "vhvncN PRV.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d7c679f-065e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686271366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271366, "uuid": "9dde0be5-fcf5-437b-bc21-f896820e8387", "comment": "Malware payload", "value": "8b850ae135d2bbfd17a1189771c7055d", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271366, "uuid": "7bfab60f-1bfa-48a7-a552-0c5eaf475679", "comment": "Malware payload", "value": "5c07ab4627bab377c2668e64e5e130123d4474db1a8eee04f6ed3bd2327ca78d", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271366, "uuid": "85d13918-046f-4906-923d-1643c6fe7708", "comment": "Malware payload", "value": "c447c447095c231e4e591efadc241ee00c22bb74", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271366, "uuid": "4ba3e9ed-b8f6-4a36-a5d9-3e53c528e3fd", "comment": "Malware payload", "value": "8961ef9d8c3b8d5f95cfdfbe668e4f7d7a01ca4e91969466ae031647d54f4f9a1495829751ea3cd31b7f5df393d563f1", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271366, "uuid": "ef5235f6-2d81-4e7c-bb3e-7804a680cb7c", "value": "T12944E129E703E0C4F5E2DD34265A7AA8DF42305B52E0B6763AFCF651636F58A304B18D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271366, "uuid": "e9f831d4-bf64-4080-974b-edd3fc03bc84", "value": "6144:Ltscv2dBrSytU4SbwJPk5uYOTXItvtwrt6Hu:Scv+rSyFSbwqm4t+cHu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686271366, "uuid": "8b36099c-3787-4990-a370-8a66f441a8ab", "value": 271084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686271366, "uuid": "0e8710b4-c348-415f-9128-2929ee7e83f3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271366, "uuid": "f1155d8f-d0ac-4d94-9e7e-7bfadde99a9f", "value": "BangKe Xac Nhan SDDV (27APR)_dieu anh KTTH.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3caf5eb-06bd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686312313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686312313, "uuid": "d235364e-e615-4d84-ae63-7f4aa232679d", "comment": "Malware payload (AgentTesla)", "value": "90cb7405aba0347dbf9ebb2336484c70", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686312313, "uuid": "76a107d8-12f3-48c5-9d21-9b8b3d87638d", "comment": "Malware payload (AgentTesla)", "value": "5cd33fe6beec5a2dc508d3d644e4a377d147cdce40a36dc508137d0ba4c181e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686312313, "uuid": "dd91947c-f6b1-444d-932e-3d2e14670e8a", "comment": "Malware payload (AgentTesla)", "value": "620171a8880f04b63e828a5bf2a15543e68859cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686312313, "uuid": "e61a82ff-cd24-4cd5-be10-56a0b7743dbd", "comment": "Malware payload (AgentTesla)", "value": "a95e013d7b2e92db59e0adf13c5a3579de148b258bb7c5c073eda1a99230f866c42f0545c62e1e68452cb64c4d4a9f01", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686312313, "uuid": "95c36071-a706-4ffb-906e-ed6e906765b5", "value": "T199E423A485DFBC09019EAF913A4EEC0574C848FADF9925A850FAFB50444788B71E7EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686312313, "uuid": "fdd8f788-01c2-4c17-9d41-e14f7298977c", "value": "12288:wfX9KA0xFlgStb7LcZVBgAurf4vdBkCQ12ZfcHjX7I:wfXYA0xvwLBeMcCucEHjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686312313, "uuid": "511dc958-fdb9-4251-b887-1515934eb51a", "value": 664782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686312313, "uuid": "ced7d488-88cf-4018-a512-4bdca58b3db7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686312313, "uuid": "290a2d7a-ab1f-409e-81a9-fd92dcfdb0ac", "value": "quotation list ,DR and material date sheet.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1316027d-06a5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686301655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301655, "uuid": "80cfefe4-cdcb-41ed-a66a-10a161909fec", "comment": "Malware payload (RedLineStealer)", "value": "2b187309cd04ab31128fed43a33758e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301655, "uuid": "5f2faadd-c4d8-42a4-b9c2-686f4f207def", "comment": "Malware payload (RedLineStealer)", "value": "5cdfbfa0ad50f1375aa8d4ec2cdb22f4765e5056e7d100a63d2007e423f55013", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301655, "uuid": "66765584-8b6a-4224-9643-9eaa5497f7eb", "comment": "Malware payload (RedLineStealer)", "value": "ba938bde4b2ccf7fce86a89628b0e0c5c96a5aad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301655, "uuid": "b0799a09-061e-44c9-b22d-e857dd3ddeb3", "comment": "Malware payload (RedLineStealer)", "value": "feae15bc14676364280d501c13dbfb24d2713a7d51267014f5207145e69002460c373256a5efb672b95ed96a4cdc7618", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301655, "uuid": "31393856-7b14-4692-b6a2-c04e1a66cd5e", "value": "T19B747C0AF2308891D4DC45308897D9B909B0FD5BC85676BB62D0FE3F2E327A1DE1969D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301655, "uuid": "71c36acd-46a1-42c9-a98f-4aa6cf887f46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301655, "uuid": "031dfdbe-cfd9-4818-9f4e-2569db123e4f", "value": "3072:tvEIQhu8JFb5qDGBIqOZqHPNAHCtgrr3EGz5faQlk7uMsShRjxAqcZejssfSEjJZ:tmU8bb5qDG3P6HOQfaSU/CZ1sKGJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686301655, "uuid": "23cb14bc-c333-4487-80f5-9e1b46ad7eb7", "value": 349696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686301655, "uuid": "5a22ca30-63b2-42c0-87b4-0e45236ac7a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301655, "uuid": "e3534166-01f4-4d0c-81e1-e0c3ee063f0b", "value": "2b187309cd04ab31128fed43a33758e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb965f6-0690-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686292840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292840, "uuid": "c000c9b7-8f68-4eba-9e17-a93706387255", "comment": "Malware payload (SnakeKeylogger)", "value": "c4c50064e6c9db4242872221e4f834c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292840, "uuid": "b745253b-42ea-4cc6-b200-d0987bf0cff5", "comment": "Malware payload (SnakeKeylogger)", "value": "5d6c03383955c4784c08bcc14b863537f7fb451fd94a1fe7706b84576fb3819b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292840, "uuid": "2caca767-8e55-4775-b9e0-f003bf938863", "comment": "Malware payload (SnakeKeylogger)", "value": "f29aaedb5478c10a7440e0a47707316610143b94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292840, "uuid": "d5b727e9-e1d2-46dd-98d8-7a28f44df03f", "comment": "Malware payload (SnakeKeylogger)", "value": "4fbfabc7b81d830160e22905ba962fcdacfab780d748952497fc945fe215e98d585bc2441861d55a425972f51106a4dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292840, "uuid": "59b44f2f-c598-4b1a-b125-3be8cd521815", "value": "T1ED34F11A72E49F65E5BE83F8A92029018BF0B91B95B2C76DEDC125CD1D11F81DF50C93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292840, "uuid": "d977ab6a-8076-4d5b-b472-afae051e6948", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292840, "uuid": "4850a118-a74c-4593-9245-a505704706e0", "value": "6144:y9EfCSSk9AQOW2b7a/Zpwevo3rBe+bUDGmisJv0dpESnMjJd6:y9EfCSSk9AQOW2b7knwQwe6UKOugSMji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686292840, "uuid": "f5ddbb61-8c99-4264-9dc1-4937899bc50a", "value": 249344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686292840, "uuid": "1b7ebf61-461d-4c14-bf00-93ad6698fb50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292840, "uuid": "39d73b67-8fbd-4a05-985d-5dfb8cb9186d", "value": "OF_2023060_1073.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72476741-0693-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686294084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294084, "uuid": "ef167fdb-0250-48a5-af30-8fb921c409e8", "comment": "Malware payload", "value": "1e527b9018e98351782da198e9b030dc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294084, "uuid": "a56b5612-20a9-4111-ba32-2fd88d1ef481", "comment": "Malware payload", "value": "5f7471c215b433f1b28dd4b328b99362099b6df7cb9e5c1d86a756388e0c7aeb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294084, "uuid": "d40474e3-b860-491f-9213-a0b26d87eb74", "comment": "Malware payload", "value": "647122775c704548a460d6d4a2e2ff0f2390a506", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294084, "uuid": "e075a26e-273c-4598-852a-c6453fe5d700", "comment": "Malware payload", "value": "26bc082b687f49ec631c8c0dca6b999820c119c5bcb18d8f2ad1a9d20c88678b5620640ad65c66ff50b7a2a95b194b05", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294084, "uuid": "64e044d7-9b64-44ff-b82c-bdad19991cbd", "value": "T1EEA26D078B500627EFE28AB0197FD018F73661A3437483E717B6D9A8E884B65FD9550F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294084, "uuid": "49b3bf0b-3e74-44af-bc19-5ac6b5738b50", "value": "f16f2f4b135561f684f02752de19ea33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294084, "uuid": "2ca4900e-7b8c-48a7-9991-bc949e532415", "value": "384:qosO55gUoO4D+DFBCd6GyhETw62O0OnYPL3p+:XsOkUoO4Dsbc22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686294084, "uuid": "d3a9c953-dedb-44be-8899-d881317343bc", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686294084, "uuid": "0c105579-1ba1-4aa6-a5ea-6d59bc0a85d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294084, "uuid": "6e93cc30-784e-4ab2-b443-a3bfb1b516ea", "value": "05288599.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc409e75-06c7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686316569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686316569, "uuid": "ca479359-8894-4e97-b66e-9bd1dd037d7f", "comment": "Malware payload (Formbook)", "value": "14797c70f8e6515d5412b6d19f04851b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686316569, "uuid": "1933f5d0-9b5d-4eb5-a9ad-629ae15ccb86", "comment": "Malware payload (Formbook)", "value": "607dcd836bd33a6d2afe6ef3c632468ef126eb49923409e246ba7ec86311c5a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686316569, "uuid": "79922a86-432c-4d0e-a0c4-9f188203fbc3", "comment": "Malware payload (Formbook)", "value": "9cfb01a7f1fa2439f50ae28865741d10859042e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686316569, "uuid": "e2f270d1-06fe-4a90-a07a-679007d128cd", "comment": "Malware payload (Formbook)", "value": "c491ec63e943fc07a3095bc1f4d964e0cc000687d391bfe6093f64fa2b0b74c06baf25cd6bbed8ad443de43061e16f10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686316569, "uuid": "67af8dd3-4fcb-4158-b97a-a02eb38b0f38", "value": "T1D4E4013FBAECFD6BC66C4DF800A09826DBF57A561492E3C85CC6B5CB42D9BE05600197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686316569, "uuid": "3c050bae-c5fe-4aa8-b020-345290c63b47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686316569, "uuid": "755f008f-2e56-42dd-9e9a-deaeb8a75fff", "value": "12288:PrGnmUAhgkCBU8kqiKpwPluNJJxT957M2VrRw61QwdF5CnKIBeVViEvKhX1F2FWj:o3vbC8QXKdiEvKhFFaW9x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686316569, "uuid": "d63af733-8e4d-4816-9486-fde873ddc03c", "value": 671744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686316569, "uuid": "e8f7e272-1f64-4e72-88f4-1b03eaff3b0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686316569, "uuid": "f57bd193-0f07-4707-8370-6d504d3ce4b9", "value": "OUR REF RFQ 600066536 - PR 10023150.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df07d97d-0693-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686294266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294266, "uuid": "17e36658-4aac-44ad-a71f-28c8cd5216ad", "comment": "Malware payload (AgentTesla)", "value": "9be3fa22dac05f9f4849783b95fb2ad1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294266, "uuid": "ea3657dc-6bec-489a-9747-473c1ba1a6c3", "comment": "Malware payload (AgentTesla)", "value": "6084618816056a1e0afb21c42e0dd0d7e6846296e7bbc2a6f905b832bfe94aa6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294266, "uuid": "5e8735ea-f1ef-4f92-a584-dedc44d69490", "comment": "Malware payload (AgentTesla)", "value": "4907ef28bd43a4398ae9eba0637044d3ad255593", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294266, "uuid": "458cf1d8-6cb5-4e46-b5c4-19ae8e03e90f", "comment": "Malware payload (AgentTesla)", "value": "08a8682e9843d57d67554d9e0c48f076311dd3ca4026927e679ab4e1149a5d5dc2376c724aa11c7394db884d19a9c338", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294266, "uuid": "89406515-a011-474e-a6a7-9bc94d4efc40", "value": "T156030A5EE79B02648F551376631B4E89AABDB23DB35151B138AC833433E9C3D02766BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294266, "uuid": "255541df-5602-4587-bf57-cc64da391973", "value": "768:lFx0XaIsnPRIa4fwJMvPM98LbV1B7GMCrQEun16Bx0qbpcRUDdsmKjkRA3:lf0Xvx3EMXM2bV11dCron16jVb2xmRA3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686294266, "uuid": "9d5b77ee-4228-4c75-8ae0-7b58aaaa7230", "value": 39941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686294266, "uuid": "f14b44a1-e5c0-45c9-9dac-b1c92ccabd67", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294266, "uuid": "8022330f-8c09-4239-82a3-636f966c4041", "value": "SwiftXcopyXX28000.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0811ddf3-06e4-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686328695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686328695, "uuid": "cc8f8af3-4c92-4565-8477-f27fa01d8354", "comment": "Malware payload", "value": "9279aec14e5b8d0e456476b4a3fe2f69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686328695, "uuid": "7cb09172-6e0f-4b14-9553-2a14c2bd763e", "comment": "Malware payload", "value": "612f1a7e7ced6e8e9a9d9eff56da53c08c27c911068fc34d323fb4f05b895f91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686328695, "uuid": "48684f99-3d19-47de-9dfb-ad885c1ce5b7", "comment": "Malware payload", "value": "8042e1524a4a0cd790f48328aa7f52d24e766a73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686328695, "uuid": "7c34d6b2-a54e-465f-8a42-f2651480963a", "comment": "Malware payload", "value": "da4fad350f0984a400f08b4431b3f8af388d4c0c5185d5d97612076fa6b5923dd424c360a9af8c7424b8267218abda72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686328695, "uuid": "32cdd6d9-4de6-4d9e-98df-3ac172ef6dde", "value": "T178E4127D5BB7896EC5467FFC8C202BB1C0E8568A317BDA574F73FD989C81A084C812A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686328695, "uuid": "34685b60-71c7-44f3-a922-c121bfe013e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686328695, "uuid": "eab6e834-79f9-48b0-bc0b-44b729a9e5cf", "value": "12288:FcPPWR28Le0cY+Yg9fb9Ku8Qz9bCRSKpH119GLRJtejQlP8B8d5LO:FcX+xL9Rk9iQz9bGSIHBGtJ0QlP8O5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686328695, "uuid": "a41feb7a-cc08-4471-89a7-3713eb104f91", "value": 710144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686328695, "uuid": "7a860d16-9087-4d2e-a0fa-415d636cd637", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686328695, "uuid": "b748b4bd-6a8e-433b-a639-fec3469d6747", "value": "roforma_Invoice_0009300_74885959969_9876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4d18e57-068f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686292585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292585, "uuid": "b44ace22-b6ea-4f4d-861e-51336a500a3d", "comment": "Malware payload (AgentTesla)", "value": "57a1d34260785cd884e9a71de7a95dc1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292585, "uuid": "48f2a9cc-9c74-4f53-93f5-1b43a3e48a7c", "comment": "Malware payload (AgentTesla)", "value": "629efc4828d29c8c553f785b2996ba3527d3265295118d8765087a030cd9bb9d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292585, "uuid": "00f07012-9d84-4989-82ba-809d77ed4d99", "comment": "Malware payload (AgentTesla)", "value": "53523119dfad9f196bf480aab10d25e69d5ae08c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292585, "uuid": "ea74917b-b6cf-489d-8679-756e8353fcd6", "comment": "Malware payload (AgentTesla)", "value": "336e00be2083d88a256d05badfcbeac4b65f23b0ba61410304b1a638385bcf4c3e38fee476f3fa175dba8a1b79018400", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292585, "uuid": "08930c7d-c0ae-4e77-a0d2-a65aecbd2a3b", "value": "T110E4237CE3305AD18601D3E8B27EB6050D4746E928DEEA411E248F21BF44AFDEC7E465", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292585, "uuid": "49696d25-bd0f-4bea-b9a1-f04a60abfc92", "value": "12288:WKRrHPs+dSNAUtzauh8FYkf+JFBfRDV7dgKxr1OHO62E1QHa/iGO/JnBxEiQry0p:Wqv/dJUAuh8FJf+JFddgKxrou6h1QHaz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686292585, "uuid": "15930e1f-5705-4fd1-b8f2-d01452e22406", "value": 669576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686292585, "uuid": "da09f79e-402b-43e5-a5be-34bd6959750a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292585, "uuid": "c383b0a6-3efa-4e89-9e8e-6f490b873d74", "value": "TNT SHIPMENT NOTIFICATION.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a294dfb-06a7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686302606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302606, "uuid": "2296e662-04e5-4c26-b525-6c84722721ae", "comment": "Malware payload (AgentTesla)", "value": "bf74081742bca7bf677f727c4a617fd3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302606, "uuid": "5c2a5e27-bdcb-4273-b1c6-012433043e8e", "comment": "Malware payload (AgentTesla)", "value": "62b11256e4071e440ff9bedad7e991919253096316869efeef3713dca779a576", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302606, "uuid": "958bd9bc-4899-4232-8f19-e7bc72314a56", "comment": "Malware payload (AgentTesla)", "value": "c246abca84f4b38441bbccb3deabb9b6f573597c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302606, "uuid": "081101b9-e20c-4ae6-b835-c134c9df19a1", "comment": "Malware payload (AgentTesla)", "value": "9ae63805426ea203883b840c19851729c7e415d8bc11ae011b1be1edde57417a2688347a3a4ffa9df2c18cb4b5c61b73", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302606, "uuid": "d32f0182-900c-4812-bcde-e9dc731369e9", "value": "T111E43336C8599D03FD18AF7452CB5D034AA8E79AF85CAA64D31CB978B383D7F21109E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302606, "uuid": "e216ae39-9c28-43b1-ab67-d6b25f2c4add", "value": "12288:Auj7goNjnvXVo2lkbNPr2XZL4flKb+HcvTugG1A6X3O4wu2kS9e:RjvF58NTmZ4flZ8voz3LwufEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686302606, "uuid": "f0674dfc-2f9d-4387-83d0-bb117b675b08", "value": 687284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686302606, "uuid": "1afd11da-53b1-4f56-abc0-8e8ab90082c2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302606, "uuid": "c7b2ebad-f7a7-4a5a-8d4d-c80d839c387b", "value": "draft packing list.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21d1b81a-0691-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686293090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293090, "uuid": "cd880570-cbda-472e-91a0-61d4f309bc9a", "comment": "Malware payload (GuLoader)", "value": "fd4ea629d606346a6bce6b46ef0578f8", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293090, "uuid": "b41baf28-2491-46f8-b7c7-80c03460783e", "comment": "Malware payload (GuLoader)", "value": "62cbed8b8215059d60eb35d6b35ebc55bb0d5960fc71c3ac368bab71ddaa85a6", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293090, "uuid": "94705f22-ebb3-4ba7-8537-f0f2955994f0", "comment": "Malware payload (GuLoader)", "value": "703f80d2bfbf6e2c4803e43a1a9fc994798a4dc1", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293090, "uuid": "8134ee7b-ca84-4cd8-9d98-eae4040f815d", "comment": "Malware payload (GuLoader)", "value": "45a269cc628c324518f0e02b87c57f196c6878efbd48e3581d8a85e6321028c6142f1aeb29cc839b81ab60dc0eb3e17f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293090, "uuid": "efd7ba5c-6887-4638-a314-615cf9b639b9", "value": "T11C851223D065BC2ED991CBB59EE37485855E7D8A3ECE189A1654332B76732E2F31320C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293090, "uuid": "4ada5f02-fb84-486a-8f85-7e1e37caca0c", "value": "49152:4LK5g6ghO0EO0ida6Hg6ghO0EO0mda6V6Ds:oQgZmid/dgZmmd/QD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293090, "uuid": "8f834de1-ffcf-4057-b0dc-09b84faff62e", "value": 1860096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293090, "uuid": "44fe18c7-5412-4853-b08b-7cd43deb72ff", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293090, "uuid": "ea9f5242-4bef-401c-80a0-1ac0a3ab1a10", "value": "PURCHASE ORDER.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "720a788f-06b4-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686308257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686308257, "uuid": "d3796e25-d601-43ec-8ca9-fc7b654a6940", "comment": "Malware payload", "value": "4ecfa25ede3572b78e5c9efccd75d6f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686308257, "uuid": "0c08e8d2-21eb-4dc3-a083-238b878f07fc", "comment": "Malware payload", "value": "63014fe882e7a1e57d495475ece4ed32ef8459929567cd3235d95fd5773f7255", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686308257, "uuid": "952c7331-9f29-4d69-b46f-490c25735bf1", "comment": "Malware payload", "value": "d5c3c3129e7c5fe0e10110637d6591cdddc534fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686308257, "uuid": "5fdf32c4-270c-44c7-9a5b-e7b3c7e1f9eb", "comment": "Malware payload", "value": "1036bbbe26085bcce87c8bdbf07e91b15198745f280ea94d7b78ec7ca67b5be19e85048a96c0b532b66906819445c216", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686308257, "uuid": "43239362-5506-49f8-96c2-f54e22aee7dc", "value": "T19F149E107648C136F4AB247088F9DA7AAABDB431175F61DBFBC44A5D4F227E26A30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686308257, "uuid": "93cb2554-3ccf-415e-82a6-615efb2ba9fd", "value": "ccf3d145fef27c23a1356d2673054011", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686308257, "uuid": "7f72a75b-b33f-4c28-9a31-c7a4cb815cdb", "value": "3072:lPaO2i8oJNMQxr9vvNdxKu1coG+WTzkyt96+ZYLVEA:lSVijJNMIVvNDKu1cwG79TYxh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686308257, "uuid": "a51ffeb5-79bc-4650-af18-6c2420c73282", "value": 197883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686308257, "uuid": "bcb1c731-57bf-4b42-bb97-0db914b787a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686308257, "uuid": "6a0e9fc5-2ec0-4255-90b9-0a91686db71c", "value": "63014fe882e7a1e57d495475ece4ed32ef8459929567cd3235d95fd5773f7255", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d14fc0ab-06ba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (BlackNET)", "timestamp": 1686310994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310994, "uuid": "17e0c627-4bfa-4a83-9601-c50002b720fb", "comment": "Malware payload (BlackNET)", "value": "23f50c4bff4b1018a5b24dca1e9a525d", "object_relation": "md5", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310994, "uuid": "617ce886-6fb9-4c2c-bfbb-87a716717138", "comment": "Malware payload (BlackNET)", "value": "636586494bbb8266d974ac3dd259d1290c94c96a98d00165c502aafbbca5447a", "object_relation": "sha256", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310994, "uuid": "a96014a4-97d7-482e-8d8d-fa1775241ce8", "comment": "Malware payload (BlackNET)", "value": "366ae616becd1beaa884ab87659468921a32b8ab", "object_relation": "sha1", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310994, "uuid": "5eb745cf-8f35-4bdc-ad96-9ae2dd43451c", "comment": "Malware payload (BlackNET)", "value": "7ac5b25c5c197b535145138cd3d005694e4965b18f87bf5feb1e2b41ca3d957f1f77665d11de166db76befb4d42de40f", "object_relation": "sha3-384", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310994, "uuid": "f37c2894-a506-475c-8882-08f65ccb74e6", "value": "T16B94DF6BF6734A15C1EAC83FEAF24190DF20B47D580ACF93D4411B9E1A9E38644B5A73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310994, "uuid": "957ed386-ee73-49fb-b8f0-0f31d78e4da2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310994, "uuid": "59390c2d-b3ce-4dae-93ca-64005b6cd653", "value": "12288:uFwqoSpOurJqsoXlkY70Oti5RmgNmz5sCB:ubowfon0Wijmww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686310994, "uuid": "d393d6ac-72ef-4d72-9850-e8019c0b225b", "value": 439296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686310994, "uuid": "6b5aad9e-b056-4761-84f9-d3ba9589dfe6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310994, "uuid": "485a6312-4794-4fb2-a154-3c51aa106b4d", "value": "636586494bbb8266d974ac3dd259d1290c94c96a98d00165c502aafbbca5447a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e4766e1-0698-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1686296305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296305, "uuid": "f353c4dc-78f5-4c28-9529-99a5a58cab38", "comment": "Malware payload (AsyncRAT)", "value": "c7b595da0280818998af6a5eaabeb6ed", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296305, "uuid": "05c1273f-4363-4aba-bc82-b042ddb0698d", "comment": "Malware payload (AsyncRAT)", "value": "63b2add18bbd481c278a85e74c496918a12ea951301951134956e0b4449ebf39", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296305, "uuid": "ea13b020-6d12-4cd8-9515-fbf7168e3c20", "comment": "Malware payload (AsyncRAT)", "value": "97e0e2c7be4b44d058c4e40e75ff59582917a8e7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296305, "uuid": "d7b17c3c-e7c1-4367-953d-41b5dfcd4e1e", "comment": "Malware payload (AsyncRAT)", "value": "db0e71a1242b3da8f4071fd9304c13c70a1d8574821619604690ac5676aa21cc349dbd5aeb6a899c1cbc9dcb2f617477", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296305, "uuid": "dada2573-0585-4897-babe-a82deebf9784", "value": "T135D4E009A2BB5B6FC4BA6BFE090016348BF9545F7167E3025EDA78DADD14F000E85B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296305, "uuid": "f293ec22-5a71-43c3-9fec-ee0fcc12f6b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296305, "uuid": "cb37b3fe-991e-4a8c-8d73-200ebe6a804f", "value": "12288:8Gmp0lWxMzIHREJVk/bq4izoW/m7/ePmr9eRf5ORReTed59dTqGiyxA+kqIt:dmilWxMiQW/O4ue7/ePNRROiyd+mO+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686296305, "uuid": "aa67ad7c-fbfa-494b-bbca-36aaeb995381", "value": 642560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686296305, "uuid": "a6d1570a-1665-4c85-8488-9ddad8e1de66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296305, "uuid": "9d6f7756-272b-4c56-8833-4fce4e7ffd9e", "value": "IgXNkefSCwhtVCR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53984808-067d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686284583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686284583, "uuid": "dcc4a228-2a43-4068-9498-fe6ec760f160", "comment": "Malware payload (Amadey)", "value": "a587d721f8a9ae88a523b1d67f6a463b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686284583, "uuid": "04111591-9488-40cf-a178-b4136190c8b2", "comment": "Malware payload (Amadey)", "value": "63ff770c95394609a64e6a91f40b3a410d5fcce32d519b60195077f8ad948475", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686284583, "uuid": "4a435a7b-e572-49e6-99f7-856dc6afa973", "comment": "Malware payload (Amadey)", "value": "410362a093366d280fc438f9c580f9f6ee787ac8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686284583, "uuid": "f77a0a45-1cf6-4ad4-8c5b-03fa896947e2", "comment": "Malware payload (Amadey)", "value": "fde5d39a805f9a74ec1e92a67f1853e3018e6fda1f7d3c4e9a4009ff92656377351026987c8a54f41fbda1ec75dd4917", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686284583, "uuid": "e065897f-d481-4ea3-bd74-4ab2f7659001", "value": "T15FD41213EBDD5067E9B427B068FA03C71B357D815938635E2782286A4DF32D4A630BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686284583, "uuid": "287d8acc-50ba-433a-b35f-413426a4393a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686284583, "uuid": "fd530f30-f29d-4f74-89ab-2bae308be8e1", "value": "12288:6MrPy90UZApZjOx6+3n73WdyahmdvyJVRlcIm0poY8ZKmeyS3NRo:1yAjB+373j+mRcR+//R8mvS3/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686284583, "uuid": "bd4c10d9-de76-433a-a27f-9243a4e4258d", "value": 613376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686284583, "uuid": "a252e599-6e4f-4310-99ba-12339e083b96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686284583, "uuid": "9774066b-88ca-4f08-8713-32525901e4b7", "value": "a587d721f8a9ae88a523b1d67f6a463b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db897ed-0692-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mamba)", "timestamp": 1686293566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293566, "uuid": "a6e25c41-317b-4f46-b1d4-9ac508136153", "comment": "Malware payload (Mamba)", "value": "38529ecca6f8857442331c40e1bd5f9d", "object_relation": "md5", "Tag": [ { "name": "Mamba", "colour": "#765A46", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293566, "uuid": "7776588a-579b-40ee-bd48-629ee8b78f58", "comment": "Malware payload (Mamba)", "value": "645b8dfe73255d9e5be6e778292f3dde84ff8c5918a044ae42bcace0fe9ca279", "object_relation": "sha256", "Tag": [ { "name": "Mamba", "colour": "#765A46", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293566, "uuid": "3ddc8e89-2950-4ad0-8522-de6e3fc15f8b", "comment": "Malware payload (Mamba)", "value": "37fe11751277dd8cc889e0c05d7fde88b98aa67c", "object_relation": "sha1", "Tag": [ { "name": "Mamba", "colour": "#765A46", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293566, "uuid": "7a430e49-1722-4517-9d2a-1b603061a2af", "comment": "Malware payload (Mamba)", "value": "17bd632f75a3e2a63a9663c5444e9c8046b2c55eb9ddb98e55525622b83e01df6c3da677553c469e864e52d6efbbb569", "object_relation": "sha3-384", "Tag": [ { "name": "Mamba", "colour": "#765A46", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293566, "uuid": "891a6122-9bdc-4bc5-8348-538dba8c3d1c", "value": "T172C57B073C6C90B5C50992BECBC76E6174E695FD2B204BDB13E9CB388145BC0BA3B665", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293566, "uuid": "7b49afb3-120c-4c3b-97d7-0fe7911cefa0", "value": "aee678a5f1a4387df8b73d6176b314a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293566, "uuid": "75d9aa3d-461a-41bd-ae11-c9dc3b75a0a1", "value": "49152:hxFNFf4ZjhxNdNGa5YLuOARYNdNXc0xI5mmswos1:hxF7Q3xDAa5qARYDS0xIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293566, "uuid": "9a736b50-41c6-4aeb-a1ce-95520aa945ef", "value": 2565120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293566, "uuid": "52b3fde2-69e4-4bdc-8fee-8a57028ff6db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293566, "uuid": "98f7e833-f1fc-432d-8386-8887c03140ee", "value": "05980499.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5f1001d-069a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686297231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297231, "uuid": "06a35e38-cc0d-403c-9728-140d9443bc29", "comment": "Malware payload", "value": "4a80725b788c79d51a0bed95f441d038", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297231, "uuid": "6975b2c7-e7c6-4b50-85d2-a0b98d100ee7", "comment": "Malware payload", "value": "6502b8ea9e90791c916c72a994cc9e056f76dafbd1ef255ce8ba6532464c5ecd", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297231, "uuid": "c8316d17-c048-4e36-8e64-40114c1256cb", "comment": "Malware payload", "value": "28b6f21021dd3c7c765411b3bfd6725097a24f57", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297231, "uuid": "66a9dc42-ccc3-4d6b-ae75-63dad67ac299", "comment": "Malware payload", "value": "e06a84e29acf9776436b75aac5c13e630a4d218c9f4d7f4751345c84cb03aec64f0d41608512c443a0aa7ea93ed83ee2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297231, "uuid": "3b869f6c-650d-4e25-9dfd-8fc969b23d4c", "value": "T14BF42315B5B10427CAB73DC7987BE3F39474EBD28F17373268AA6AA05798BD13748840", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297231, "uuid": "2d0b5392-e132-48b0-b755-2ed6b1e72619", "value": "12288:wSmRhiLGHW816DvCcMbztYo2cTKfpwQg25OQ4YvMeVmR2UgkOd6ZnR:wSmPmGd16jLMbzt53T/QlvtrkOduR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686297231, "uuid": "6a0e1894-0301-4318-9b28-d5a5be6c85b3", "value": 753712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686297231, "uuid": "ee36b275-4785-4a50-a0ce-bde924b12527", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297231, "uuid": "cacf086e-7bf1-4654-b7f5-b0481039f0b7", "value": "SKM_C3350191107102.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ed8a3a5-069d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686298266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298266, "uuid": "e3f2f9ef-3a59-4c49-94c0-49235a0c5b82", "comment": "Malware payload (Mirai)", "value": "85fb5e4ee15ed49645dd99e9c52c718e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298266, "uuid": "bc9c696f-ee44-40c3-a2ce-825fd592b294", "comment": "Malware payload (Mirai)", "value": "650c28bc9cfb9e78e995b296d3927fa7dfe9a6c9316a5eb6bed59b21f3d4b024", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298266, "uuid": "730cdab8-02f7-4c88-9189-3e31b067fa8e", "comment": "Malware payload (Mirai)", "value": "410fe6117c17dec66b41cdaceb780c1a39783f31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298266, "uuid": "e3efef57-fd6e-47c6-af1a-0450be29b5d4", "comment": "Malware payload (Mirai)", "value": "27afc64450245dbe188b1d3b30a0dee3eba47563581c62e8c960457ad7e3fa11fed009c898804caeba85539b849bf736", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686298266, "uuid": "29184b19-f6ff-4e87-8b8e-9f291bf73391", "value": "T1F8D2E164E702E21ED494647A06965B8511B3EC0BFC5F6BA32ADC424F5E510CF2F7EE42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686298266, "uuid": "24a17534-f602-4262-ba95-805c3a9d4d3a", "value": "768:5Je6gtrsmJzxeSh6rsWd28IRQcgkeXIn+R8PZN:5Je6wYmza88sg3I+SN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686298266, "uuid": "01e1468f-11f8-48d4-b6c3-b8e2770b33a1", "value": 28896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686298266, "uuid": "bdc2806e-d357-4e50-83ad-dcb0c516c66e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686298266, "uuid": "7a223402-77d3-470d-b968-5ec880cc26d9", "value": "85fb5e4ee15ed49645dd99e9c52c718e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ed214e-06aa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686303811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303811, "uuid": "8db5cf4b-e55e-4635-b27d-a35748b609a3", "comment": "Malware payload (AgentTesla)", "value": "440cd930743d1b0c91c6d7396eaf23e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303811, "uuid": "8b32474d-43d4-4457-8641-cfc7b34106f0", "comment": "Malware payload (AgentTesla)", "value": "65370cfa1e08f458d53cb661cf02054d9324f155a7bbf6505b4da5c2f9492385", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303811, "uuid": "5e0bc4dc-cc8d-458b-9cad-8a7ead1ec122", "comment": "Malware payload (AgentTesla)", "value": "f2cbcde2047dbba83c4ba61543c1a10e4286cafc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303811, "uuid": "87aef915-93e4-4daf-95f9-51369d3c3abb", "comment": "Malware payload (AgentTesla)", "value": "044e00aa4bb2acc35abaf38a005c421b5ee9b5ec4384ce0629fd7db1cb06faff71419c1c07352ad438a29c2364446bfe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303811, "uuid": "dd65723d-ea03-4812-9121-a5bcb75bc2ef", "value": "T1EA05020E0AEB511DD85B7FBD0D5402B2E3EE8A95B123D5474F8B7C99EF53B294880683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303811, "uuid": "24c8a7dc-aec7-48bd-ad10-802f1b6b3644", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303811, "uuid": "a267206b-d8e4-43ab-8a34-40bdc502b0b5", "value": "24576:50biRoSErVxIE5+wqAWxE3YSKeE6xna9I6vfY:5y4oRrjIw3qjnReP+vfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686303811, "uuid": "8c06232d-b4ce-4771-9ddd-3b4cef8465fb", "value": 803840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686303811, "uuid": "7379fe8b-d770-4a60-8c46-c118b58c9a89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303811, "uuid": "b6d599a8-5cb5-4be2-99fe-ea04a58a5b50", "value": "NEW PO - 4610926543.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d12888de-0692-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686293813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293813, "uuid": "3f077bcf-b4dd-4cf3-a4bf-cbab3b69d7a3", "comment": "Malware payload (AgentTesla)", "value": "8ad018c0fa3180a28e548f5059ef6978", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293813, "uuid": "f2d7a57a-5008-4ab7-bf9d-ac4e3e755a38", "comment": "Malware payload (AgentTesla)", "value": "655c94b74f16bf776896ac17508822cd393c54b302d5b530589ff089e83643e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293813, "uuid": "adf771d6-d3d1-4d1b-ba88-e6a9fb21676b", "comment": "Malware payload (AgentTesla)", "value": "43bf52623729258f2350f794fce23ec289fcb693", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293813, "uuid": "539df026-274c-4587-bed4-5d4df80e0155", "comment": "Malware payload (AgentTesla)", "value": "3e717d2fbf275b4c7d095c0bacdc2755690e5819642d8bb57bd172d08a9f33a40f4fd3a9b689e10ce6ef4c09a3e7b431", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293813, "uuid": "035f5a37-6665-4ab6-a957-a45bd8d08875", "value": "T163E423D7C6EB44B7C47D863D1604A910B9897D1972ACE8B1B182E7E6C2D3BF70825A0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293813, "uuid": "0236fe7b-5c6c-4359-8751-cc138ef13d65", "value": "12288:4+BNReJN0B5qLExHN8qP9jJHavgNe/v7P4KeoQt+WhCyoDZ1kXN19KFm/bkv:rSi5qLExHWC76INe/vcKzC+WhCyuYX9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293813, "uuid": "b68517f2-36c0-4b30-b8a7-5a9e8bf8b446", "value": 705040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293813, "uuid": "cb259a73-47e5-45be-813b-9868b743a907", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293813, "uuid": "f950ec29-62e5-4ec8-9804-1234a0ca0d4c", "value": "updated schedul.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45c83edb-06ca-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686317631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686317631, "uuid": "c4bbf981-2307-4628-ad8f-482dee354aba", "comment": "Malware payload", "value": "d5d6862f9676a7f66a5da204d7851766", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686317631, "uuid": "fb772234-6026-4970-967c-5d833eb70d4c", "comment": "Malware payload", "value": "661772339ec1d211b18bb16accf3fd23ff70c1c9d41b75797885c72cb6cc4385", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686317631, "uuid": "f4f72188-aa96-4c09-9aba-1accd9e00e47", "comment": "Malware payload", "value": "3e0ed589b7e0b14f78be392c117d863f1f704d5f", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686317631, "uuid": "4c264e71-aaec-4f7f-bc95-e84ed1e4b460", "comment": "Malware payload", "value": "894db8b5fad2b82497b76a4242af9835c7a60901984eec1c8980910d0bd3a157d19a2cf9f85b2ac1dfac6811fb3b8c2f", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686317631, "uuid": "a9f82e86-d2ed-4deb-825d-ed0d32ecec15", "value": "T17373CF2BED418D83EA68C3FABF030FCD5709735D25557AFD11B24E8A7B811860DAE05A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686317631, "uuid": "f9ad0f83-7611-4e78-bfa6-d59e369949eb", "value": "1536:FLx+SvQbgQywBGmkla+bsaCaWyVvXmkXwhHdW:FLolgQxFklapall", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686317631, "uuid": "ff3b0146-9822-4bbb-a76f-20f511776d89", "value": 75912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686317631, "uuid": "5c8ff445-6b31-4d8e-972e-7c0595be5ad5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686317631, "uuid": "c70c7f4d-bc9b-4628-9755-d985cef6a6e3", "value": "Ach Remittance advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1620c3c-06a0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686299854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299854, "uuid": "ec04ad42-45d5-4442-a1c6-5ad3d1525dfb", "comment": "Malware payload", "value": "f358138c662dc9f5a092475848e22589", "object_relation": "md5", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299854, "uuid": "2c759751-ea86-42a8-a835-d2eeccd6915c", "comment": "Malware payload", "value": "6787afe740801c8b1fe1300e826bda10e6ae39dad3d2a9c44fa15b27448a74e4", "object_relation": "sha256", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299854, "uuid": "0b07cd0a-d422-4a1f-93b2-30fbabd8e720", "comment": "Malware payload", "value": "21958ff9efca96186eac1d40754e7b46120d65cd", "object_relation": "sha1", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299854, "uuid": "1ee8c4ed-d355-4fe9-96bd-ab8b15fc7634", "comment": "Malware payload", "value": "f104ef03bcad19913d0d449d7b4eb36af1d3403941de9ea0ae2b547acb45c7b2922fcb0bfb70f7544c0dd30571f39f2a", "object_relation": "sha3-384", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299854, "uuid": "0d843c45-8405-47cc-86a9-69e9440d9261", "value": "T1CEE4230CCA43BFE4CBB5CA0AADECD422D7EA199D572CD71F3AD0CB77055886890B505A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299854, "uuid": "880d8d82-ab03-40d9-9774-b0e4e167852e", "value": "12288:rJSNNpXPdysloHnpv2g9wMQgUgedEzagY0vq+dBuxQKNVipNGYAZon3aUxZAK:rgzJPCHh59wMtUgedEzaH0vqiAOpNGYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686299854, "uuid": "3166599b-3cd8-459e-a0da-1d6f298bf67b", "value": 702537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686299854, "uuid": "e6f9c50e-181f-4029-b0b5-10e219479a82", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299854, "uuid": "b76c7a53-3f80-468a-931f-811ec9b3c605", "value": "shipping docs No S14-213008.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0b980d-0692-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Satana)", "timestamp": 1686293642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293642, "uuid": "95594aad-4aa6-4db4-8e10-1083e046be15", "comment": "Malware payload (Satana)", "value": "46bfd4f1d581d7c0121d2b19a005d3df", "object_relation": "md5", "Tag": [ { "name": "Satana", "colour": "#CCEA10", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293642, "uuid": "c8c2d1d1-832d-4e8c-9d6a-ebec546c3116", "comment": "Malware payload (Satana)", "value": "683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96", "object_relation": "sha256", "Tag": [ { "name": "Satana", "colour": "#CCEA10", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293642, "uuid": "b09a4a4e-2b7b-49d6-9bf8-085d162ce566", "comment": "Malware payload (Satana)", "value": "5b063298bbd1670b4d39e1baef67f854b8dcba9d", "object_relation": "sha1", "Tag": [ { "name": "Satana", "colour": "#CCEA10", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293642, "uuid": "1611d484-9e89-47b8-bd81-820ca7e624be", "comment": "Malware payload (Satana)", "value": "00b6225def4d0e9c727e083bf055725971237f5d94dce4b6d50e0ddd814397646ce8fd5986ba669496766ac2f9ac8af3", "object_relation": "sha3-384", "Tag": [ { "name": "Satana", "colour": "#CCEA10", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293642, "uuid": "8594aeb2-cd4d-4575-89bf-3294c09001d0", "value": "T1AC33BF0ADA486E63C971B674EFB7EAFB403C544A5B7D38FB9B84004D053E2F5A163462", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293642, "uuid": "5634783c-caea-46bb-a7c1-d5467e70a404", "value": "a3bc0305643e7601d6deca72652f4ab5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293642, "uuid": "638539fd-f178-4685-8db0-af152bf475b9", "value": "768:AbFw10RFnAwJM7MiqwecUaX5h4IuCdYa+XLXTGY1idL2WYiwtDj:Apw10vnAOIUaJh4IXdWXLXTWLfuFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293642, "uuid": "ac5cb198-29f8-46ed-b3cb-58bc7704563b", "value": 50861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293642, "uuid": "6c9ee5ee-ae52-4098-9603-a5d37e4f5947", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293642, "uuid": "b7522f3b-14c5-4197-8fa5-78aff7c8e193", "value": "08333299.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b905d25-0690-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686292865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292865, "uuid": "5920812c-0148-4636-a47b-07deec54f82b", "comment": "Malware payload (Loki)", "value": "5cbdef2df4eb6cc0622a4a2c399a6b0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292865, "uuid": "88f85f35-b2ea-4c68-9bd2-850f9a378947", "comment": "Malware payload (Loki)", "value": "690bf56c513b3b1e8ef7eb1cabd0e7ae3caf33e6d4442264ec5b17c74b9c5d92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292865, "uuid": "aefb9bd6-ef60-46c8-a953-e19f791c05b4", "comment": "Malware payload (Loki)", "value": "88a5012d2d83c2aef883f20ebde6a6335f5f120f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292865, "uuid": "5d189186-eddf-4ac4-844f-6ad7aa346807", "comment": "Malware payload (Loki)", "value": "d5aed7875cfe0b4189699ecbcd6028796bec6d910a481d1d696c5c437c945f1132d93da55f76e9fc22099b436c09dcc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292865, "uuid": "5945ad95-5045-44cc-b98a-77bd710cdfe1", "value": "T161E411BD0BB7496EC8873FBD5D212BF6D1E84A893027D60B8E77FD98CC15A184C911A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292865, "uuid": "a73d1991-a027-4353-94c0-5e0e635cc56e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292865, "uuid": "9037bb35-0d54-4dfb-9a7b-727596eb60c4", "value": "12288:nUPWR28Le0cY+Yg9fb9eB1KHHsePK5CQK30XAMhfuDYPDJOydWqesc:nY+xL9Rk9CsHzKPK0J2DYbsysqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686292865, "uuid": "83cf743c-5dac-4140-a82e-17ec740bc2bf", "value": 677888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686292865, "uuid": "288b5ffe-14a6-489a-a96f-1b4af0a0d9ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292865, "uuid": "1f5a5920-b38b-4e0d-9024-ccac83601b02", "value": "DHL Receipt_6005195460.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf5bb42-0692-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686293860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293860, "uuid": "ead797af-3725-4ef8-a667-5cc10d9bf416", "comment": "Malware payload (AgentTesla)", "value": "b2298cdeea4a8f1b4d0a95822caf0ac4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293860, "uuid": "fca270d0-79de-404d-b417-0b3266861593", "comment": "Malware payload (AgentTesla)", "value": "6a0e8225d29c6fddb83229f2a1c586f9dcf6bf3ee1edb58f915a9f5a5973f0e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293860, "uuid": "63d4b8d0-cd90-4f3e-ada8-d914e2afaeb1", "comment": "Malware payload (AgentTesla)", "value": "6855c1d4d791a578330b62dcbd2c61adf2a132ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293860, "uuid": "e9859e13-823d-47ed-9bf4-b1e5b2ea5515", "comment": "Malware payload (AgentTesla)", "value": "e2415c9759a2a6bbaf0f90b2a4238d5dbcdfd77d43d9d0d4ba867878fbf0cf3e669c4f6f33e7c758fc9ad241d9683e53", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293860, "uuid": "1d505fc3-b3b4-44d8-a441-83372b7fa8fe", "value": "T14B25F00673F64B5AC87B1FB80E70427093F56D5A7923DB0A1E8674C8BD36B504F41AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293860, "uuid": "c1163e61-539e-43ee-93dd-d8e3aea36a19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293860, "uuid": "115e9775-1b5e-4eb2-a4a9-58cb1dcc2d89", "value": "12288:zq4haDnLMzIL2q+RTdOL8AuNqh3V2kp6XewzijzcMesuEsD2OrhdcU2D:7OyqGUL8AuEMk0X3OcMQRD2OrhdS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293860, "uuid": "5dc0fde6-7bd2-43c4-886d-126a0cdd75d0", "value": 966656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293860, "uuid": "64f3b617-0bc0-45ea-b40e-4f350a554b03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293860, "uuid": "903e5c97-8c15-4752-ba12-bd3caddeaf92", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa711d5f-06a7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686302768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302768, "uuid": "540a38d1-6ae0-4b94-a1a4-ede635679091", "comment": "Malware payload (SnakeKeylogger)", "value": "040f6714d161232a8e169e21514bdab7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302768, "uuid": "3dee0a00-f417-4d74-8a19-93a8d50da844", "comment": "Malware payload (SnakeKeylogger)", "value": "6aaf928cd1e39ead726656fe570e4a269ca507acddcc2b5f7a90e15863321b0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302768, "uuid": "6fd0b413-1ba7-4de3-8308-acc445cd8ac9", "comment": "Malware payload (SnakeKeylogger)", "value": "fba09b32c02fcf8003be48d240a21fe7f2431f5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302768, "uuid": "09ffd70f-3724-4862-9aec-dda8f6324ec3", "comment": "Malware payload (SnakeKeylogger)", "value": "f2525a98dbc044b15a556f27c20553526193ee76242510b85b62aab147b961c56f566478fb769b4c4ee5e0b6e3266e3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302768, "uuid": "8398f0f7-1168-4363-8057-3e4c8d783986", "value": "T10CF4E08862F99F17C4BA6BFD0420247183F546AB313BE6474DD374DEAEA4F490A44E87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302768, "uuid": "01129478-04dc-4717-9590-cb6fa87f0773", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302768, "uuid": "0de8084d-167d-481d-bcce-112e6c1c7229", "value": "12288:5UlRuUEZOVhaDnLMzIL2q+RTdOL8+ZCfE0FjD4tOpmhXadvK16Mvb/lgm5H:5UlRuUEZqOyqGUL8+I80FP0OpyaNKND5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686302768, "uuid": "28664939-710c-4dbc-8d29-8369f92bfa7e", "value": 776704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686302768, "uuid": "eb19621b-b703-4de2-b1ea-1b47d9edca3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302768, "uuid": "197d9656-844f-4c3d-9741-47b60cd34853", "value": "PO-22-3194.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c22a4003-06a5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1686301949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301949, "uuid": "6406c783-0ec5-4149-987a-2929099e412d", "comment": "Malware payload (ArkeiStealer)", "value": "339fbfa154755393b2baec483e5f1257", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301949, "uuid": "c84ae4bc-f562-4b9b-a2f5-0488a201af8d", "comment": "Malware payload (ArkeiStealer)", "value": "6b79d25b436f4059d791f8fcb22d912a899ac27792527f03dfe3bcd17a5b2b7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301949, "uuid": "6c6d1343-3f2b-4233-a062-739b4c1e3437", "comment": "Malware payload (ArkeiStealer)", "value": "209a36c4a3e156a391849f9934e36c862175ac32", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301949, "uuid": "a2b8e8d0-3844-4ab5-a1ba-5d6142140464", "comment": "Malware payload (ArkeiStealer)", "value": "3e94cafdb82e0e6021a5eeb6fe01ab97cb18bf0035236c893467b18cb5cb2c052b5408be39657c76b3e60ef8ff3a3308", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301949, "uuid": "4f51a938-882f-44fb-84c4-c5ad7ee302c8", "value": "T1C07633847762F748D21A91B3C81306CEF82A71BBE591DBC72E11634C7E169A4F70ACD9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301949, "uuid": "09aa92e3-1416-489f-b60f-0bddcb1d0eb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301949, "uuid": "6f2ad3c1-e396-4727-8d0d-252b754bc746", "value": "196608:/4Lbt1AcaU/2bwFJ54cJ+0e+Oq2e1JZFE:/4zF2bwFHY0HO2JZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686301949, "uuid": "2a01c8db-200f-4488-afee-70c38d5d4788", "value": 7271424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686301949, "uuid": "d26e6680-ecca-42f2-90c4-4ff2d17d3099", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301949, "uuid": "61379b2f-f339-42be-a1c6-458d32f58e44", "value": "339fbfa154755393b2baec483e5f1257", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a72c9562-06a3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1686301044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301044, "uuid": "098de6bf-a427-48d3-a3cb-d5c9275c219e", "comment": "Malware payload (Stealc)", "value": "2e4f9e426907d9c3e2fca85df1b19b09", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301044, "uuid": "07a70aa6-815a-4710-b5f2-19708b2f81eb", "comment": "Malware payload (Stealc)", "value": "6e0db6c01d51ba9b33ca59e169183cd3ae971707ca7cdfe56708af3bf85242d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301044, "uuid": "830ac082-751a-40ec-b275-2af27982b821", "comment": "Malware payload (Stealc)", "value": "4df7bad8fd5d11d7c82764326f0ebd345c2d5eca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301044, "uuid": "9b839cdd-c405-4818-91f8-dc6b2373ed2f", "comment": "Malware payload (Stealc)", "value": "2e45eae79702370150f9feedffc54b310ab7f084c7d8d12a6249db4842553342df507c942b9b19c3f3251412e678dbc4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301044, "uuid": "c9a7c911-a6e5-4273-85d6-2a984ab7e3c9", "value": "T1E266332CEC848105FF21D3B54BAEFB39797397C909979C6196F542B90086CE885B8F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301044, "uuid": "100fc478-e29f-49f7-b0df-653e6380177b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301044, "uuid": "4a19d45f-dac1-4022-9638-96113f8c4320", "value": "196608:jfmhWtaRWj6aAQnSazJUBw7ANxxgac2GloWyZ:7mGruLQnVzANxxBc2G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686301044, "uuid": "c003f6a1-cb63-4b43-be5b-1cabf1adf561", "value": 7026688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686301044, "uuid": "a088e776-5f7b-452e-9f98-d38baf93d3b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301044, "uuid": "5dba6d28-fa86-4ae8-bbea-6e8cd1f5a681", "value": "2e4f9e426907d9c3e2fca85df1b19b09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11b71f1d-06df-11ee-b3cf-42010a9c0076", "comment": "Malware payload (StrelaStealer)", "timestamp": 1686326563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686326563, "uuid": "d08b62c1-802e-4d32-827b-d084104eb538", "comment": "Malware payload (StrelaStealer)", "value": "085562b4abca90945066770cb04c313d", "object_relation": "md5", "Tag": [ { "name": "12980215 Canada Inc.", "colour": "#2C28D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686326563, "uuid": "7560f856-eb6d-4801-9d45-64878bcef5f2", "comment": "Malware payload (StrelaStealer)", "value": "6e791b3e5d21b6c79939b0ff55795983bb01e991c8de639dc1c208930eb84e2a", "object_relation": "sha256", "Tag": [ { "name": "12980215 Canada Inc.", "colour": "#2C28D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686326563, "uuid": "4b4ad405-0603-438a-bd00-0664525bcd8f", "comment": "Malware payload (StrelaStealer)", "value": "d11525dd580fcb0161775265fa2befc33c12a548", "object_relation": "sha1", "Tag": [ { "name": "12980215 Canada Inc.", "colour": "#2C28D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686326563, "uuid": "b115377e-a7f7-4570-9dbb-8bd59de4a7b9", "comment": "Malware payload (StrelaStealer)", "value": "277f73b8a4cff94ffc415729e9240f4930b1b20ea7fcb8680c0f3edb624b2559c4d878ecce2d604d8bc86df30b6fb285", "object_relation": "sha3-384", "Tag": [ { "name": "12980215 Canada Inc.", "colour": "#2C28D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686326563, "uuid": "5d73f99e-b2d5-42c2-96a9-913005377473", "value": "T1FE726D523B642627CE8647FFA8D397243B305B071AA4DD9F9CF12AAC5B41391760227B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686326563, "uuid": "7993e6f7-1991-4da6-84e1-9ed347d092e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686326563, "uuid": "d479b2f2-521d-4f8a-90b1-1a9fed274acc", "value": "384:cZ8ocMqD0PF/1tZvDJMx+O4/BpwKNsy368TIX87:zaZrv9Mx+//ebku87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686326563, "uuid": "d6360566-88c6-4bf8-b087-1f7968d557ee", "value": 16840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686326563, "uuid": "cd4ba016-4e4d-4621-96df-0bb6909e3424", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686326563, "uuid": "ba01de0c-fe49-469a-b76a-52a6828fce48", "value": "Fattura (4).bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8878d9fc-069b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686297557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297557, "uuid": "705007c4-5e1b-4ceb-aede-d4fb5ee7906c", "comment": "Malware payload", "value": "9aae1c04b3aad6ab9bdab2c5a108cd4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297557, "uuid": "a01f33ae-0f43-491b-9c9c-676d6378be70", "comment": "Malware payload", "value": "6e8db51c1837d6b170ec89cded61e43a3424f345ee1a4777ed6627fd41cef652", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297557, "uuid": "a89d875d-aabf-490d-8d36-5366b4be8b8c", "comment": "Malware payload", "value": "fc7e80322dfc0fb03b20cc7beac816e95a84626c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297557, "uuid": "76514184-de8a-414e-bb2e-ca9e2399bf2a", "comment": "Malware payload", "value": "e571ce126e705aeceb06dbb305bb561d35da0d41937f8301e25abef0db49ea0af36f0c7493b750373e299cd8759a3adb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297557, "uuid": "a8d2e577-aa11-4e4f-ac94-ac7da05cd9dd", "value": "T15105127DA3FB461EC4AA3FBD1D215674C3ED0889B467C1134FA3AD9CCD667124A848A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297557, "uuid": "f6b13838-41de-41be-a904-f6e286fd6e1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297557, "uuid": "e21655de-d2c1-40b5-a680-3a37b94b01c9", "value": "24576:j1iewlqB6pf3SVolYCz/ZC2akLl/yrnZSCfdu:jQe2q8pfCyvLZCC/gZSCfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686297557, "uuid": "465cbc7c-5c98-459e-ad6c-764594911215", "value": 825344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686297557, "uuid": "801d12f2-7eea-4bee-85f4-d81eb9531faf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297557, "uuid": "01be190f-170b-4934-bb20-e0a7eaa9bedc", "value": "Quote JQ102474.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eec721da-06a8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686303312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303312, "uuid": "cae8393f-fa7b-4952-b9b8-6490789019fc", "comment": "Malware payload (Loki)", "value": "b3b532bbaaf02391aef0557a6f3069e0", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303312, "uuid": "f470bf5b-92d7-48e9-bbd2-320f501b5a57", "comment": "Malware payload (Loki)", "value": "6fa0012ccf30060c1fd04701bbc4a064d161625518bbc79c8a072857540c690b", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303312, "uuid": "bae726da-38ae-4fba-92f0-07d8947948f3", "comment": "Malware payload (Loki)", "value": "518e34ef659854c7f862777666582a6776b6c5c6", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303312, "uuid": "fae570e0-16e7-4e84-8c7c-c57e585db9bb", "comment": "Malware payload (Loki)", "value": "4550ed5b4fb12cb3e37ebc47ae5e3fec57c6c2d93d87fe898fc3b2375697addc276bcd0e406799101b8bda7bb3a7f655", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303312, "uuid": "99e7bcdc-90b5-4f75-ae16-f7647d61393b", "value": "T16205331BD93F30058DAE3893FE94EA032753A56E0D65F18F7F8E5069E051B1A236742B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303312, "uuid": "360e5729-e4a9-4c37-9041-3f3650bdb771", "value": "24576:ePYhibsEBz3wMspoEWAnJOx8BLTy755r/YYX7UhSdx:eg4ZRspofz8Bny7jrgMdx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686303312, "uuid": "a2c36324-919f-438a-8944-281ba20e9e5d", "value": 862653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686303312, "uuid": "c60c85e5-8f62-47fb-bbd2-2c2a0e7f1137", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303312, "uuid": "dc5bf2bc-218b-429f-9e13-7ca1ca202a91", "value": "Invoice.PDF.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d292a67-065a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1686269433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686269433, "uuid": "b188ad09-e10e-4822-b99d-9ad60bfbc83f", "comment": "Malware payload (CoinMiner)", "value": "e1c179ec1ec91421568d8ac2b58545a0", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686269433, "uuid": "25f36449-f46f-4cf2-99d9-3dbc90f4af55", "comment": "Malware payload (CoinMiner)", "value": "6fb8ac0046086bc85ff8557162847cd203bf854801f3dc97f4715a5f5b4d1300", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686269433, "uuid": "bc8006c6-cbc2-4296-b956-47fbb0b865b8", "comment": "Malware payload (CoinMiner)", "value": "844dffe387d9aa47ca58e4b43ed6ee22a6dc3519", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686269433, "uuid": "78702ae3-aa6e-4713-ba22-206a248b23f9", "comment": "Malware payload (CoinMiner)", "value": "3fa75c9bc9e4744c434e009256a89fa512b20f3777ef79695023e8b67debfc2dfdc0269b74497540c4774eb6e32293c8", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686269433, "uuid": "07218cac-d03f-4f92-b9dc-a00682555aaf", "value": "T1BB53649C765472DFC86BC972CEA41C64EA60B87B531BD243E45312ED9A0DA8BCF051F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686269433, "uuid": "26431fe8-4299-484e-8cc7-92c3f7580f77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686269433, "uuid": "5e1aa78e-f2fe-42ca-920b-39605ad89dca", "value": "768:TNT9lcP7/L+u9JsNFcC14Fq2H0mSnMbEJ5ENba5JKUkg9oRvmj7ROW:TV70/L5zsNF4/EMbEkiKLg9Z3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686269433, "uuid": "e39b5b29-04e6-422d-995a-f4e05757ca7f", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686269433, "uuid": "22ddda88-a883-479a-baf6-131de061b632", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686269433, "uuid": "3609e27b-154d-436f-9875-4f88cfcaa6ad", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e39ca3c-0682-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686286668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686286668, "uuid": "5df66c50-aa71-45a3-994f-0aea442e8783", "comment": "Malware payload (RedLineStealer)", "value": "f09338b939f5ad5b237159481b47560a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686286668, "uuid": "2d465d70-b21f-4af2-b894-bd243d308e8b", "comment": "Malware payload (RedLineStealer)", "value": "70322428c96781fd5fcf19bf175011d36969f3aea709aaafc59f2300b273e7c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686286668, "uuid": "baa314db-21c2-453b-b385-e733f180e850", "comment": "Malware payload (RedLineStealer)", "value": "d5eedf97f11019a36cf4fdc4e0854c5fdff42c5e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686286668, "uuid": "b3dd404a-b0b3-47d6-9605-140f4b49a333", "comment": "Malware payload (RedLineStealer)", "value": "9c8ef4168dfdd815357d2102a6ef8e506ed5571f6de16efb61ab542cab34d7bc73d5d9020fb5f3dcec7da0bff4a3546d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686286668, "uuid": "ca0fa32c-3293-4768-aa5a-01207771aed7", "value": "T14FD41253F7D98272DDB957704DF603870B35BCE26938836A3782951E0CB2694A4327BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686286668, "uuid": "abb68a7c-af47-4823-9f3e-ba2434be4641", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686286668, "uuid": "67d24466-9864-41b8-8724-0646ed95545d", "value": "12288:tMrRy90DIrWjmNsFiiGPXM7P3l6EqGPunQjEX/yCvTq:gyYwJm9eXmP3vqG0kQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686286668, "uuid": "b438a54d-5552-4e8b-a30b-442298f25cf1", "value": 613376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686286668, "uuid": "e0dcfc95-f982-47d7-b974-90632cfb3812", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686286668, "uuid": "40b52fb2-b3be-4f05-ac8a-b06ca2819a10", "value": "f09338b939f5ad5b237159481b47560a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff695996-0692-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686293891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293891, "uuid": "b71b65f7-c80c-4067-90a8-600303691565", "comment": "Malware payload", "value": "6a7b7d0a71577ea8f8a19e3e992eb6a1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293891, "uuid": "cf724faa-1e64-4507-833f-e5fbbddc3237", "comment": "Malware payload", "value": "70e7ec084e6084bd852862d80bcccce6cf855a72db24518bd2f768f0e80f9c43", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293891, "uuid": "ac6bc72e-2eb1-450a-a8f2-35a1ad4d7363", "comment": "Malware payload", "value": "8ab3f1e330a3569071fb72900a5ee3dd93a4fc88", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293891, "uuid": "809ef285-e016-4f08-a539-b1c0ffe9be1a", "comment": "Malware payload", "value": "60d9cc041e89d4b9b48cd79a100b5bfd4606542bb65f524f3d6d011948d9a78b1ec51372e1d87500ff8787a5ded52c1d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293891, "uuid": "6e1e372b-1924-4e4b-b16d-1e70eded3510", "value": "T1D772AFF7D2C89575FAC69573065397669BA2907290E2C30B69921CCA2F7B820DE08DC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293891, "uuid": "2cb46348-b64f-4772-a9f6-6ba5bbcfa9e1", "value": "5a498eee87e4d89512a84502f500181f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293891, "uuid": "572366d4-545d-4ce7-9d55-31dcd0352b1c", "value": "384:COLvLEBSlyjaxnKwDpssBRjl9BDjJUnr6+g9PflDnjnQJGrzKcCH:LvLEDjaxnlisbUGb1nQJGrzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293891, "uuid": "d3e79622-245b-41cd-8e9d-35c64d3e0556", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293891, "uuid": "a7c32ad8-503a-4bd9-bebc-c667d1aa329e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293891, "uuid": "a2f1b108-cc2e-4468-8fcb-2c387b34858d", "value": "08125399.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c83aa3e1-0682-11ee-b3cf-42010a9c0076", "comment": "Malware payload (LaplasClipper)", "timestamp": 1686286926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686286926, "uuid": "2aea82f3-c783-409e-b027-bac493b4217a", "comment": "Malware payload (LaplasClipper)", "value": "68be007bd3fa09d26fcee584a9157770", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686286926, "uuid": "317fe002-63c9-445b-9a9d-6efbc7edba3d", "comment": "Malware payload (LaplasClipper)", "value": "71acc9e68e019bd99d89f1bc2efa859bdb16b13cb69abb02dba8b993265aed6e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686286926, "uuid": "c27a55ed-9333-41f0-9da8-9fd20cc3e4d7", "comment": "Malware payload (LaplasClipper)", "value": "6f191c0587c8055f26367f25ce0f7787ca272714", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686286926, "uuid": "f8822399-1cd7-403a-bd1c-667f677a6428", "comment": "Malware payload (LaplasClipper)", "value": "7fd705f967dd088a202229ecfa5a8d902f2b6bc00dbb1c4245d97df0c7ae44d09eb6223bea8b2e60ec4de6d68415ebe6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686286926, "uuid": "399ddbf5-4809-4a1e-95a7-d60cd726f83e", "value": "T10E060791FDDB50F5EA03193045A3A27F27302E095F25CAD7DA507F6AE873AE20A37119", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686286926, "uuid": "efa86511-9623-4e85-bdbc-d1823eb02924", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686286926, "uuid": "15a41505-17b0-418f-85bd-d128743fad70", "value": "49152:VeCseICR7NWm8qpHakXvLQh0/50OicF5pDRXxRv0VF14L:VeCrXv0W/tpDRX5L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686286926, "uuid": "1e99f045-8f98-45a0-8149-6270863529ad", "value": 3993600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686286926, "uuid": "98f5ac38-5d91-4c4e-9981-22b05e880c17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686286926, "uuid": "4e1c1610-5bef-405e-bc77-26f39739091d", "value": "68be007bd3fa09d26fcee584a9157770", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54b78a38-06b4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DCRat)", "timestamp": 1686308208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686308208, "uuid": "9112d615-245a-4c26-9d08-070616879d54", "comment": "Malware payload (DCRat)", "value": "8136421aa9596cb02a6c30a99b376db5", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686308208, "uuid": "1b07f5ed-e42b-4e58-9158-80fa945dc16b", "comment": "Malware payload (DCRat)", "value": "71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686308208, "uuid": "a8a6fba0-c0bc-46e1-92cb-d6750512508e", "comment": "Malware payload (DCRat)", "value": "a4866f30925441944eb06e9540fd8740a7302b84", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686308208, "uuid": "d93d3a8e-3bd2-48ec-8bd8-d9293b1aa305", "comment": "Malware payload (DCRat)", "value": "18a03e3476b6a0cc8d91edfded8f08565cf4b192354cc6ed183404e65e48d79f05a7dc4fda4f182418475d6b409baf4c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686308208, "uuid": "10b01d6e-dd06-4bb5-8fcf-4457a04d3ba1", "value": "T15EF51255B9D28071C87706310EE8DBB45F3EB8604BA29DEF63994B6F0F346C08725A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686308208, "uuid": "9ff8d983-09c6-4290-abbb-f9a0ca9542c7", "value": "cc28d1f8109bfd2554768c59bb4d17e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686308208, "uuid": "69a6f33a-fcbf-424d-be50-af6a0b37acb0", "value": "24576:0BgrBN6i/BEuM75fCJaBSDVdMYHl6I4H8ykD3A:yIWqgBSDAYHl4cykD3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686308208, "uuid": "c4926029-3240-457a-b6d9-2421006c7c4c", "value": 3555072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686308208, "uuid": "b115c139-5ba2-46c8-800a-7f59ef0d119b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686308208, "uuid": "03de4444-7a9c-4153-a59d-3760781ce7f5", "value": "71becff3e0037cf61458f416ee026d4c6db0a25ffb2d42b6a0eecad381825cb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "983a8266-069f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686299301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299301, "uuid": "37bbc947-44a9-49ef-81de-b5901c937df7", "comment": "Malware payload (Formbook)", "value": "8cba6efe195b956b63259435e723d80b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299301, "uuid": "f8dfbaa8-be48-4aeb-a5e3-dc5ed8af5de8", "comment": "Malware payload (Formbook)", "value": "72cf82cbf24e740b354e9d3b86072b0ad4a741a8489870b42f559d93a364ce82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299301, "uuid": "8651cb3e-17c1-49c8-aee4-60e9826dd943", "comment": "Malware payload (Formbook)", "value": "ddb9f289ef188d777d81c6954623e3551f35d231", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299301, "uuid": "853c002a-056a-43f9-9e40-5a3ab18aa92a", "comment": "Malware payload (Formbook)", "value": "ff07e6a9e2b2f4e7572f3f138ad0fd7e777c86d6547228499826a77efadc2e5bd0a5ff013a17a3e52c88aeab686bee38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299301, "uuid": "af970a64-314c-4af6-a122-bbef110c2438", "value": "T128159E3371F3A477E9235634DC26B7B164743F122A1B9905BAE9BC6C8F37182292D253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299301, "uuid": "c79bec32-eaea-4e8f-9e16-a8017dbfa603", "value": "faffee6ddb737e162a2459239510b1e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299301, "uuid": "86fa507c-3a57-478b-ab20-e82cfc653b5c", "value": "12288:H7uk7C8LDMu42r0Dyo6Te5rf1C7nh5YaGND23ax56pw1MJf:HC52r0WorR4DY23i+w1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686299301, "uuid": "b0e5d754-0d72-4335-9999-2e0ff22cafd0", "value": 920576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686299301, "uuid": "72c8245c-a018-4ba2-b2bf-ec93f9b6e3e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299301, "uuid": "9e417512-58ca-47f9-9261-a4746f86dcd3", "value": "Order copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "026d398a-069c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686297762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297762, "uuid": "723e30cb-6e57-44f7-a5d6-a80d1f243362", "comment": "Malware payload (AgentTesla)", "value": "58a31347ee8c7b779beaa4775c887a92", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297762, "uuid": "b2d5d511-2f6e-4b69-8c9c-96ab1b9376c5", "comment": "Malware payload (AgentTesla)", "value": "73548862188e8c725343fd2453085ea5e8ad1b78649ac1d6d0e7df9bf308f8ce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297762, "uuid": "36517e8f-bd81-4ca9-91eb-2a6220632cc2", "comment": "Malware payload (AgentTesla)", "value": "5ae60fc738a757f37df1a3ff52410fc7b7c882ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297762, "uuid": "2420b34a-b39e-4d89-924f-8fd62295b4a6", "comment": "Malware payload (AgentTesla)", "value": "41a56e88885550880c8c4f3ef9f0fa500ffb39bf51f2112eda4767b8d452c8f5b87a0868812ca7b15e24234d1422a93a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297762, "uuid": "069ba0aa-8151-4e93-96ac-c98511557745", "value": "T17E3593790D4266DFE1BF932A90E81D1BFBA1B846FF56E94C78C2038B319264E76D510C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297762, "uuid": "2ec35da9-f706-4167-acc3-6fecadab7665", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297762, "uuid": "f4535e1b-2d76-4478-8284-f9eacbbc2b71", "value": "12288:40H2RTk1u6YR+gF2NOnYY7icpmIR3KKeNNLsxI9mcSNwr+5P:4hREu6gFueYYdZPGvQjRP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686297762, "uuid": "4afabeae-6cfb-4554-8628-e3aa3c011651", "value": 1088000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686297762, "uuid": "cef01614-dc32-4ce2-8ac2-84e725f5bc0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297762, "uuid": "d7f970dd-5f82-4872-b6b1-a62ba8d54893", "value": "payment copy#0067843.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f15b47db-06ca-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686317919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686317919, "uuid": "0ed4885c-1837-439b-913c-e81310d9f506", "comment": "Malware payload (AgentTesla)", "value": "ead5841d0a37b945804dbc9bfd484e03", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686317919, "uuid": "efeb9250-3c9f-49aa-8f7b-996d791d9941", "comment": "Malware payload (AgentTesla)", "value": "73beac1a14069c8a827a9cace2216eeab47b506f952a4e15017f532e12012c18", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686317919, "uuid": "82cefcc4-6000-4a29-afb4-d7b5fb306a4d", "comment": "Malware payload (AgentTesla)", "value": "4744c8475ff1e542c86745dae4e92601edb7512e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686317919, "uuid": "c9f5e81d-3bd3-4c82-a7da-6e043814ee1f", "comment": "Malware payload (AgentTesla)", "value": "60fa005ecff0fc6dddb2e9215ee83e8e4acfbd3d1eaf79515d8b38b3164e9784e7fbb43cd36dc56a8f3c779c4d7b51e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686317919, "uuid": "706d4c75-bfaa-458d-abb3-4547dcc0a521", "value": "T11CD18E10D3E6429FB870C733E5164B152DA899C77452B5D5B39EAF7B28543A2C31424C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686317919, "uuid": "67ae2a68-807d-4f46-926d-142240fe11c9", "value": "192:JWVZwtWskpheOCBWuyx0ODJHbAhbTtZH8Xf:JWVZwtl6heVBEhuTLH2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686317919, "uuid": "f97ea14d-a7c1-4c56-b370-2d06acde967b", "value": 6190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686317919, "uuid": "8b56a979-a577-424d-b10f-597db0b34e91", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686317919, "uuid": "f9d41e14-e1fa-441e-a7d9-94ca36d8a5e0", "value": "Products_Sourcing List-#June Order request.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9417b455-069f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686299294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299294, "uuid": "70fd8568-15b6-4148-8bbc-ea1d56ed1bdc", "comment": "Malware payload (Formbook)", "value": "f4b418fd85e7dcee1499a54e328923bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299294, "uuid": "e60d253f-e66b-4015-97d7-67b4cd72a710", "comment": "Malware payload (Formbook)", "value": "73ce02f6b7c4c5109af4ad501aa9206bbfa5cf32bb8276ad06887c95279c907d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299294, "uuid": "fef361d3-262a-41ce-a8fb-50f306902679", "comment": "Malware payload (Formbook)", "value": "22b87e3b13681fd287cc27c8e6824db055edf86c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299294, "uuid": "a3320dac-e917-439e-b1f8-660f65b393f3", "comment": "Malware payload (Formbook)", "value": "0aefa3f6e52acd013638cdada07020f3d11d4b64cb845ec34a0dc3d90cfd14f2654c913c2d36db70db381d734283ddf6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299294, "uuid": "66270d72-1ef1-49aa-9b16-55f3310cdb93", "value": "T15444124CA6B0D4A3E0A363B23F3E67636595FE1B68A4171E4350274E3D47392F50AB27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299294, "uuid": "27cb9c35-7013-42d2-aece-2b209c21cf76", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299294, "uuid": "8f6108d8-4d95-42cf-a383-15c5bbdb4fff", "value": "6144:/Ya6zksqY8IFWfT89Y25GVBHSZ+gc8fPQdJja:/YhksqYPF6sGfHSAiIy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686299294, "uuid": "82e85640-1607-4088-b488-d737b23cfece", "value": 259087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686299294, "uuid": "dbe51db6-8611-4235-9803-62aae61b1172", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299294, "uuid": "2429ebff-70e2-4235-90ec-d22f3fdc1700", "value": "rocee4908.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75fe1a9d-06a7-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686302680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302680, "uuid": "4ee0f942-25f9-476b-b197-632fa9db755f", "comment": "Malware payload", "value": "644c9fa14abce6b947503846b69e15cf", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302680, "uuid": "3e972970-e01a-4c5d-9117-10d00d435785", "comment": "Malware payload", "value": "73fa2c0d02f6755c5da2df105965961460c71c5e5526ae1e19dbf8a606025ceb", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302680, "uuid": "c87fe020-6e92-4586-af53-d3a5c6eb9b26", "comment": "Malware payload", "value": "e77e3d2ba35935cfef227cb49eb2624380862229", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302680, "uuid": "d4a04662-f803-4316-80f6-e87fb2a68228", "comment": "Malware payload", "value": "85a52ef24487e68832763385931e58f7d1cdda7be99bb5988534af46747d8bc9e7936dce967ce220105ce2ee1e035860", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302680, "uuid": "4c352883-4981-4d6a-91e6-8a583613ab2c", "value": "T1FA5423135CE01585D32C82705BC68851CB7A52A31B29CD6FD832D5932DE4FDF8BAA1BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302680, "uuid": "d0555ebe-d4a3-42a0-a2ab-92b76748ac0f", "value": "6144:qi7n5JRXQnl81RkVsBIPs5eK9U4zOu/lpW+1a5Uvk6pfo4sCy+ltOOCrV:qi75Ya1RkVTsr3OypRaOxJo4sUltOtrV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686302680, "uuid": "cea538a3-a970-4f1d-8f3b-3e1f6be54a89", "value": 299389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686302680, "uuid": "52633e00-be95-45fb-83bf-54c3ee3bbba8", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302680, "uuid": "025b491d-d8af-49a5-a243-748cb51c5e17", "value": "SHIPPING DOCUMENTS.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b958f004-06b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686310094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310094, "uuid": "ecb88e20-e30d-4ac6-9660-db63d27dd62d", "comment": "Malware payload (GuLoader)", "value": "1cab881619580684c145a5347a26b675", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310094, "uuid": "918179d2-3816-42eb-9e02-4d9c8b588e86", "comment": "Malware payload (GuLoader)", "value": "7401712b8abb2ea748bebf808879e8219c1ec21d3bb75a88725945b8098c727e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310094, "uuid": "4c569756-7d9a-4ab4-b5b8-daf670a13995", "comment": "Malware payload (GuLoader)", "value": "137e608ce10c5f75ce76eb330d13f56c0cfdf6df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310094, "uuid": "517febb8-2de7-408a-965e-d1d888d2eda9", "comment": "Malware payload (GuLoader)", "value": "8b9a87b6b8521599b755413c442ccd1b33fd68b5455a2b26af203ab96c65b19a6809f56271d29b22c05007ae4f2466fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310094, "uuid": "0b83e2e0-4824-42f3-8ffc-db2b583f9f74", "value": "T1E82523635CE49F9BF408A27019F79E7AB23B347828279147B3149FF56267112C91A2CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310094, "uuid": "1441c6ca-5787-47db-a0c5-6b4ff8395c18", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310094, "uuid": "4015c7ed-116e-479b-b6c3-8c8ecff1869f", "value": "24576:/ipmKss5GE6G3VibpHIdebodR6jlKFtQVUv+iP8o79bO+i:FKsBG32poHRS2tQuWikK9ji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686310094, "uuid": "7c60d4ab-25cf-4ade-a955-ad0daa56487e", "value": 1042320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686310094, "uuid": "06fb3ce0-4df1-4d21-99f1-46cf95b9f5fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310094, "uuid": "b04f805e-4add-42e5-8d2c-7ae9a8c579f7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00b5f180-06a9-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686303342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303342, "uuid": "871ca2b7-8d0b-47c6-a69a-fb79be1ee857", "comment": "Malware payload", "value": "a5e530847abd03df4ea534350bf3b3c8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303342, "uuid": "682296e9-8df0-473d-b44b-089963b21817", "comment": "Malware payload", "value": "7403899a1f39586314ec53ce29170e8d0a9e219069151252efddec680cd833ce", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303342, "uuid": "38e2b57e-17c3-4fe6-9b2e-fb58c54edda7", "comment": "Malware payload", "value": "7dc06e09dc72d0365cd87c83972670131b9f3fff", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303342, "uuid": "b6f06915-2bf7-44cd-9027-f32a99c975b9", "comment": "Malware payload", "value": "4047948f7a449c85dc5c66295de27bd6204f0cc930900ba65a3b24f60d41708164f20842c406d45ba397489ab561d1ce", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303342, "uuid": "5dae4e7d-4f48-4828-954c-d8c85b14358b", "value": "T1DEE2D098A9E370906613F0BF536FA804A1B518538D48FE077C4C6654DF9E12CDBB4AEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303342, "uuid": "64dbc5f2-c2da-4d12-a3f7-f333fedd83ba", "value": "384:1PlYmpK+0F83zJdqsYmOEb1X2VdSOy8mqCOdoU7NjxT:19Ym8d83lksYmOMX23xz1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686303342, "uuid": "c6c4ffa4-1dc8-498d-bc35-6aaa539bc2e1", "value": 33993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686303342, "uuid": "7ed6d503-82dc-44d4-81bc-b2f4d757192f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303342, "uuid": "a4e0bb1c-63f4-46c9-b0bb-60a8e0d33d4c", "value": "TRX23732373.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72cd41e8-069d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686298380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298380, "uuid": "c9f5308a-5c4c-4cb2-aefe-e80c60d69c9e", "comment": "Malware payload (GCleaner)", "value": "91bf7f47b31e342359cb3a80cc2e2b46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298380, "uuid": "e26cc24f-8735-4f11-a050-b3d226dddd7c", "comment": "Malware payload (GCleaner)", "value": "751bac1e9305d5ee6fa68f8e1c9cc23775062207c92fd5bf595a09ceea1aa2a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298380, "uuid": "8c45f19f-fed3-4372-a976-ed0809e0d73a", "comment": "Malware payload (GCleaner)", "value": "b896e2d774e4e5e53ab376ec4dfddf6b7be2df19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298380, "uuid": "86279301-51f4-4c73-a922-be7160839b50", "comment": "Malware payload (GCleaner)", "value": "8bc311a9440c81acb46a27b9a9c0e6a2adbb01d3f377fa71e944b8e93299e6dd6c9d36674aeacafacf3199029e0c61f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686298380, "uuid": "93acee16-54eb-4279-80c1-dd1d9074728c", "value": "T134853306D6D6D073E4719678BE08C661E9BB3F203C320D98690C5E8E6B77746886E7F4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686298380, "uuid": "3c8e2441-bffa-4316-afec-36e16fd472f2", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686298380, "uuid": "e7089bfc-deb2-430c-b40a-46212d09d9d3", "value": "24576:5I39deUhVGuIOXY4LKK9JCy0fRKPv9vudQ8iPSr5iVDbKUNhzZZaBtuShUtxGX5y:56dPGvc5u0hGIA28idNhFZa3Xsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686298380, "uuid": "49ff4530-a819-4d9e-8747-0ae057e2c595", "value": 1867929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686298380, "uuid": "180fb81e-31e3-4f7d-ab96-f80ab61312ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686298380, "uuid": "ce341d2b-af76-41d1-b694-b536dbd36f5e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5beb8c6-069f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1686299351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299351, "uuid": "7d7ca559-ab7e-4093-8468-c36c807a6428", "comment": "Malware payload (ArkeiStealer)", "value": "3e02364cf2bd73228a622d81debdbe56", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299351, "uuid": "34a5a99a-43a7-44f5-837b-f8e6ba326dac", "comment": "Malware payload (ArkeiStealer)", "value": "77c2a4affa4c579b12a8281b7fc1898146561a9d97c6291a0630b89046ee7412", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299351, "uuid": "645f7fd2-3b7b-4315-a5f3-8b92ebd60a80", "comment": "Malware payload (ArkeiStealer)", "value": "15618a9aa1121b19f69541ea669c5787c53563d7", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299351, "uuid": "124c4d0c-f56c-466c-b4a7-3996613acf3b", "comment": "Malware payload (ArkeiStealer)", "value": "19ff97024efa4f32619783f71835e22f3f835673bb12e18e78689609c0c013ad1146a447373fc496b3426c43704809b9", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299351, "uuid": "af285566-48d1-491d-97e6-64997c1e03ee", "value": "T158E4F161A1CA4F04DE2DA931C1E6BFF443E15D66D7FB428E2FC8391E95316CA7C1881A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299351, "uuid": "781072b3-4dd7-4b10-8720-3bd60f1e3a4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299351, "uuid": "6a20bcde-1324-4925-b0ea-2a2b99457fe3", "value": "12288:MIoSNW0tqD1agwyJBDMmADi9FQ69VWpibmK/ilNfF56l85QYppsqc:CSNFgvbIiLLVWpibmnx535QIsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686299351, "uuid": "bf9d3042-25e1-4446-b769-0f63b4559243", "value": 659608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686299351, "uuid": "6b67014a-e701-43df-8da2-a311d9e0f772", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299351, "uuid": "5c2cd61b-1078-4015-8d4c-2778dd896434", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e70a073-06b6-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686309110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686309110, "uuid": "b92724a9-f184-4e3d-8ce0-383cb9465cf6", "comment": "Malware payload", "value": "4ce410d062b25b0f4f3c418ecfceeee0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686309110, "uuid": "0a7e8249-8149-4db5-8d52-a92c8b3d8617", "comment": "Malware payload", "value": "78bab28a914cb40611873e968a0e7897f565cdfaabb4f3e4fa9d3eb4e153c55c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686309110, "uuid": "b898f6f9-be63-4a43-b47f-f31a0234039a", "comment": "Malware payload", "value": "8f0348993177dead0d847a8f2f61d3e75bb4449f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686309110, "uuid": "405e2698-f434-4275-abd5-8b8c3919fd16", "comment": "Malware payload", "value": "6f7780c66011015b57050d764f743da0d5d87b1c01b61bd5975c88830a17680fcab210f42cae404ed00f60bbbbe04b73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686309110, "uuid": "266e6d4c-8aa8-498a-b132-9e8f7bb88623", "value": "T143C33A93F68406F5E8BE4932943A4E1107B3BE2FC594A60FB49879540DF329116ABE4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686309110, "uuid": "dcfd9875-32a9-443e-b309-14181c082143", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686309110, "uuid": "d47d2755-8bd3-45e1-8f73-365e085b3a94", "value": "3072:GEXrhUUMrr5fbJMyi+uZN0oXRx4VwDXHAxoKf:GTr5FbuZ6ViHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686309110, "uuid": "ffcf5c3b-b6b2-43a7-9567-9da1d0b8942e", "value": 122880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686309110, "uuid": "17352f43-113e-4ffa-bcf4-4032fed636c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686309110, "uuid": "2fada426-eb1b-4de3-ab7b-f1629c0cc22d", "value": "78bab28a914cb40611873e968a0e7897f565cdfaabb4f3e4fa9d3eb4e153c55c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec05fefd-06bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686311468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311468, "uuid": "2c01c935-539a-408c-8461-f5e7cacce391", "comment": "Malware payload", "value": "10c04b73dcf8785c9300b72d4950a589", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311468, "uuid": "73b7b59e-955e-428c-b974-1c5b0a6b440c", "comment": "Malware payload", "value": "7aad2cd707bcdd65269e0a7cde74dbaed32abbce14228c3c4c04baa7bd966f00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311468, "uuid": "16ec2f86-512b-4b65-97a4-9c0ef0a456a3", "comment": "Malware payload", "value": "e36adf0a931600098ff101afeb074381beb4d8a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311468, "uuid": "d3a22876-ceb7-4abd-ad5a-7d7f0f446c68", "comment": "Malware payload", "value": "2a6eb888aa8abfe2810f021396c7872ef54851dbc30c2fb952125404277915d5d4357a27a4014a6294268b4cfba520b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311468, "uuid": "cdac304f-e1ee-43fd-82c1-f2a292908358", "value": "T1F0E4237A90F6EF2ACD4CC8360D04B70B9C2061E061EA13D6B4A561979EC37D352D7EE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311468, "uuid": "e4a9058a-906c-40af-97b5-c4a42202124a", "value": "12288:fmQ7IOy0VWgKHs3233iobZkoanqIDmxuo1OClRuMGTf2JfTharT6LvRPObaJzcrG:fmQg5gKHs3UVCoODmtuvafTQrT6Lrz9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686311468, "uuid": "4c356661-7424-4c7e-a069-e03c37999bdc", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686311468, "uuid": "93509508-7516-413c-bb55-39c919c950ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311468, "uuid": "9878b5c0-d43c-43ed-bc1a-183e29dc75de", "value": "7aad2cd707bcdd65269e0a7cde74dbaed32abbce14228c3c4c04baa7bd966f00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "188e13cc-0692-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686293504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293504, "uuid": "f8738698-7527-483f-a336-6f098e26c0c0", "comment": "Malware payload", "value": "60335edf459643a87168da8ed74c2b60", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293504, "uuid": "55c988fd-b766-4b96-bbc3-a77ac978bf9b", "comment": "Malware payload", "value": "7bf5623f0a10dfa148a35bebd899b7758612f1693d2a9910f716cf15a921a76a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293504, "uuid": "097b4890-b5ec-4f37-a7f6-bcaea6601f51", "comment": "Malware payload", "value": "61f3e01174a6557f9c0bfc89ae682d37a7e91e2e", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293504, "uuid": "b2af8cd7-6558-4568-acab-001f96733070", "comment": "Malware payload", "value": "d21538e1d97c25026319560f54f38da1f6dd369959f6a99608a0efb07e8e5b53a53df2d4ec82ce783fbab3ab7aac8f58", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293504, "uuid": "d34812bb-04be-474f-b9ba-c331839472c6", "value": "T118A3E0417AE1AE3BC67A6EBA197546410BB677386030E7DD0C8250CE29E3F044A91FDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293504, "uuid": "8eeb1e2e-613f-4416-be5c-d0745ee4348b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293504, "uuid": "6c1e5889-2a5a-444f-9b2e-0d4e3dcd7221", "value": "3072:kGXc7vE4k8sWJnmiWpJtCkGwJ1ED7qztG:RXD8sWBmiW0wX6Gx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293504, "uuid": "98239e7a-ed16-4102-8634-aad39c98c4c2", "value": 98816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293504, "uuid": "98ef521b-cb9e-4f66-82a6-08fa29c69ccf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293504, "uuid": "a3751412-6661-4f7c-b6c5-436344941d0a", "value": "04756899.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0730db8f-06a5-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686301635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301635, "uuid": "56386307-6c5d-41cb-8b36-18d59c3e1b74", "comment": "Malware payload", "value": "78e481470c6fd24865ad8d47f83ad31d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301635, "uuid": "60c228b0-ea9e-4fc2-a544-648cd83b8cba", "comment": "Malware payload", "value": "7c1095d23541c4e85c0eed22db92d62c3227f5c483a6931fa0701fe651f4d422", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301635, "uuid": "b8f450e3-5918-4e82-b1c1-6431ec3d31e3", "comment": "Malware payload", "value": "08fa2bf1836d2d8973cb631c022a4bdc589136e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301635, "uuid": "3db08c79-d547-4419-94ec-3b967fd570ec", "comment": "Malware payload", "value": "4665f0fd486c2b020968416c1d3993dd21352768efd5248373d0723be9336abcdabdb49df9c264f4343eaa18574f4d35", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301635, "uuid": "da252a2a-0688-4515-a0d3-5c27b5dc1915", "value": "T1C716CF6D33418607D01A857461907BF4807FDFDAA0D7C95A814AFCB86F38B62F8692F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301635, "uuid": "3ce8ce39-59fc-4236-9db0-0b974e7d9518", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301635, "uuid": "9bfe0e1c-48bf-458a-a2e0-fd82e5d6d386", "value": "98304:GddGCc8fJUD9ggHTYC8zQpk3sQUz+z1RRYuTFPSPa:wcCLQL8Mcsd+3FK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686301635, "uuid": "c58ebb8d-4246-4e8d-99b5-b62de8770785", "value": 4332032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686301635, "uuid": "b74700b6-0ec7-448c-91b2-24b11cdce206", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301635, "uuid": "01176a72-32ef-43bd-b5b0-02d3550787ef", "value": "78e481470c6fd24865ad8d47f83ad31d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cc48c38-066d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1686277593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686277593, "uuid": "ac598be9-4528-43ac-b307-b83497d12b75", "comment": "Malware payload (CoinMiner)", "value": "19197b3174a5f441696e23f7e8b8c33a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686277593, "uuid": "5f0b8dbe-f932-4163-b595-afd8f288eba6", "comment": "Malware payload (CoinMiner)", "value": "7c11ba68d9d7b0136e240ce53a14fdec989e270c95274516e0b7e2f60e66d484", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686277593, "uuid": "3138f33d-e0e6-442a-af32-670597d0c98d", "comment": "Malware payload (CoinMiner)", "value": "522babe9c7bc76ec41f9da6d13dc89c7b9e109d8", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686277593, "uuid": "163c1190-36c1-4d46-91d2-120e7ed35cd0", "comment": "Malware payload (CoinMiner)", "value": "035e13487d3e7ce12d06ca7b82131fdd30a6ecb486b093f8b2909b1fae654eb7376ffc0d4f9b5b371e44ffeff26f97f2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686277593, "uuid": "12e3486e-0bb3-4899-a8e7-77046ce36bcf", "value": "T19575291A79020C6AED8900F2EAE206385F90B54B0B44E5AB36D357CB97EF5D3D9CD18D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686277593, "uuid": "da0387cc-3dc1-4a3b-ae30-d9703e992a9b", "value": "24576:7bcADanwaoDgLRMlM1YKdS0zBfOnjDmNlqO/HUzbPpH:xanwXBdK40zBfOnjDmNlqO/UzbPZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686277593, "uuid": "7c3acf9b-ab93-4185-9e01-1dfd8a10a26d", "value": 1619744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686277593, "uuid": "de9859b8-4170-48cf-8ae8-59a28ee28f05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686277593, "uuid": "8a995eaa-10ee-4279-a3d3-36674a4668c5", "value": "SecuriteInfo.com.Variant.MSILHeracles.83157.8285.28433", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec36c1f2-0690-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686293000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293000, "uuid": "b950b7ed-e8e2-4fdb-a851-55c9c991c9f5", "comment": "Malware payload (AgentTesla)", "value": "d0004760caab7d2d4ab56903dd3c0ff1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293000, "uuid": "20eee434-e576-4e3b-a898-05c6901c2942", "comment": "Malware payload (AgentTesla)", "value": "7c65de85148b948a8376a92b592cde38f7b736a02ab2f5eec5c5b54fe787cbfc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293000, "uuid": "25e3a484-d1c8-4d93-896b-5d53264c62b8", "comment": "Malware payload (AgentTesla)", "value": "2eb0c2009a0e726d2c7f85cb11369d8321c747bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293000, "uuid": "f85e1bb8-33a1-4dba-852d-2e8e3c16558a", "comment": "Malware payload (AgentTesla)", "value": "8cf3a8043068fae9e4ae559538f7f720ece0e0ce98779b3b89e3bbd72b3de14e4d5233bfa9673af135f759347810ca5c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293000, "uuid": "585f4ae8-83f3-4fa0-ab95-48762c395667", "value": "T14505010822FACB19E1BE7FF80894917083F5625A7256E74A4EC378DF5E70B418F42997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293000, "uuid": "b2137c76-bd5e-4ce1-a788-d57daf52aa3b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293000, "uuid": "c5e55065-9ab0-4fd4-9b88-6227b2049d4b", "value": "24576:uMASmHlWxMiQW/O4ue78jNdyGlU8wFQtMyM+hT4nGl4f:41lYMiQWmS7SNg8wFn+hT8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293000, "uuid": "57ac198d-d343-46f5-a2ce-12f7e3e41128", "value": 833024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293000, "uuid": "bab26c06-a6aa-4c0a-bff4-1ec6922c3566", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293000, "uuid": "886e9942-9195-4fe2-88c3-195c35d6cb38", "value": "Invoice20233.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6568f62e-0692-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686293633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293633, "uuid": "f31fa5fd-9d1d-46ac-921b-71a0d6e76d88", "comment": "Malware payload", "value": "48fe0db6759692bf758c75b422287029", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293633, "uuid": "bc8b963a-a666-4ed3-8ca4-8cc529bc4cd6", "comment": "Malware payload", "value": "7ff09715ea3fa12705da00d500b72329217b7d82cae0c59aefa0ebbf3724a36d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293633, "uuid": "3b7d5aa0-c1e3-48b2-973a-59ee43d9a829", "comment": "Malware payload", "value": "96f7d11f34d9bc938cc45114af37a14f89d83fbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293633, "uuid": "ccd468cc-0f0b-4727-938e-4aece8d7da03", "comment": "Malware payload", "value": "91773caa22492d8eeac1635e5f3e6b5d87718b7258553decf672725e837e926e861eb3f72bb357da6ea0587b634238bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293633, "uuid": "42561299-19f3-4afb-90b9-a22ac903f73a", "value": "T1FBF412883BFE491FE1AA7FBD5C201270C6F46C0B7563D35B4E8B785D8CA1B084A915A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293633, "uuid": "921387bd-5432-4bd5-a09e-973ccd397178", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293633, "uuid": "7615db20-b423-4339-a46a-f2c578a8477d", "value": "12288:yu9as/16/YHmM9mARLAV+/3X/LgZWv6UociGpmUR+rARLrjmRU0Nhiz:yhs6cV9mA9ImH/M0CUxLXRf8U0az", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293633, "uuid": "2a5d0f69-156a-4e1d-a82a-27350e5f7af8", "value": 792064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293633, "uuid": "d5fd88da-e577-4ec6-8ed2-acb1378e157a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293633, "uuid": "736ef7a8-d5f3-4871-801c-2c58a556b969", "value": "PO450.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8465495a-0700-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686340929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686340929, "uuid": "de64fed1-ebcb-4ddd-8ff4-2b7c75ea7a3d", "comment": "Malware payload (Mirai)", "value": "15911b449f48b1ffab5da62d67180ab5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686340929, "uuid": "0ecde18b-297d-48ec-b1a3-021cc390d0b8", "comment": "Malware payload (Mirai)", "value": "80d407b9dda291a5e7552b0c13e9c5961c2f0179fea210fc670e8b33cb750ff9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686340929, "uuid": "884422c7-7ec0-4530-bf47-ff31562279ef", "comment": "Malware payload (Mirai)", "value": "5d7ecdfd71089165ee5d009905b11d7dbe014a39", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686340929, "uuid": "4f840e47-a308-4bb6-881f-17609da2d559", "comment": "Malware payload (Mirai)", "value": "16e1307f3b254f35fe02c0ec1c6a5d27bdab93d892123df415c027e1f11f99fcce98d06ccdb954291805f9bfa3dc4aa0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686340929, "uuid": "c5f49f02-b0d8-477f-9c82-7bc6ccc5a175", "value": "T19782DF20519B75E4DBE14430FAAECEC6931A0BB9E1FC36931649AB7C894600661F92CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686340929, "uuid": "5098a978-0e6a-4076-9bf9-6d8c2e8ed810", "value": "384:MnfzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMawM17hymdGUop5h5lY:2dV0P6+kom0tVAoNvm+to15s3UoznlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686340929, "uuid": "409d6cfb-2829-4a73-a0c1-87f8517a5388", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686340929, "uuid": "eff9671e-3619-4dea-a3e7-1e12de611559", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686340929, "uuid": "4ca4cb3f-af77-4e2a-bae2-329c60377295", "value": "15911b449f48b1ffab5da62d67180ab5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0189848f-0699-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686296472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296472, "uuid": "44d97106-df17-45c4-b33e-540dd85cd457", "comment": "Malware payload (Formbook)", "value": "ff238e6d8204a078d28ab3c66aa1f156", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296472, "uuid": "10a13f0e-8f9f-43e4-8a77-126a559fbeb2", "comment": "Malware payload (Formbook)", "value": "80df8150fb414c44f27cc49eb0ed877a5ec6cba977d2492736b60a88857a0f5e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296472, "uuid": "d5b33010-1c58-4f5c-9f32-ac361d160cee", "comment": "Malware payload (Formbook)", "value": "3f3d637835da7f91cb34af4079ff38afdf104c74", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296472, "uuid": "fad385f3-ed73-45e5-a319-ee16dd0c27fb", "comment": "Malware payload (Formbook)", "value": "5283d357e69b9fc96eba17767523a5933148f3908e60f13578d2d57a7f248a172e0751e5b8d998c8b94e5b8e7cb5a126", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296472, "uuid": "ea67e411-ab92-4d81-8db4-c1368f7a5021", "value": "T152E42389C77DB47BFA44726E82E3DBA0389687277A704B538215E23411929BF24C3D7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296472, "uuid": "14721e9e-1957-4536-948e-a74c1d1f0e7c", "value": "12288:zzVU8HGj6aof0OlicePOvkK79SuucG0HJWTDC9oiKDskPyCI5Zy:z+ja8OlicOKZPDG0KDC9oiKk5Zy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686296472, "uuid": "ab917554-7978-473e-8df9-9277fa6cadbd", "value": 680428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686296472, "uuid": "35f5330c-ab76-4e9a-a4f8-2985bb81300e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296472, "uuid": "ceef1820-0c14-49a8-8aa4-5654545856ce", "value": "Documents.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad3b169-0698-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1686296299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296299, "uuid": "4ccf079b-4efa-402b-9c92-12fee5ae0bbe", "comment": "Malware payload (AsyncRAT)", "value": "979382d22e0f50690dd6e114c241f07e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296299, "uuid": "97eb2e61-dfce-4bf7-8f96-d4941e27d7c4", "comment": "Malware payload (AsyncRAT)", "value": "817310b0404cb8213fe6ca4c0d5ab28c0a8a9714a2c6440f55b3b5240a66b41a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296299, "uuid": "bea174c8-38fb-4af7-bbc6-c5059614d87d", "comment": "Malware payload (AsyncRAT)", "value": "c792927da1135aac21b3adc984f2f78473793bec", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296299, "uuid": "59209820-ae16-45a7-90ea-95226ceb6046", "comment": "Malware payload (AsyncRAT)", "value": "a1e8dbfab642425968500ab7d9b88e815d0e436356797852e5215882bfd446637c368bd833ae261be489f791c95fd672", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296299, "uuid": "dbd8c2ce-9155-4baf-a502-3bbc7a4a0952", "value": "T197B4238EE3B1361D83B70ACF943E74B49FA194767B09B95D20E64C16098836DAD78C4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296299, "uuid": "1c433d1e-51b1-41e1-bdf3-f6824de778de", "value": "12288:Wt5XUBymwuMzvlD2vNh2xzjUMzZhGD9FFKtn4BKDuf8GVIc3:WfUBymwuMzNDqrGzjUOKHFYn4wDPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686296299, "uuid": "85717335-cd30-4df5-911f-eb5a126faedb", "value": 520383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686296299, "uuid": "113ebe38-eab1-4009-8bd3-5039cf4fa149", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296299, "uuid": "4c423df8-34c9-4aa9-8476-8a98e6dd41ea", "value": "HBL draft 1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df09a646-06c7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686316600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686316600, "uuid": "cb49e315-a8e1-45b9-8152-ec683506c490", "comment": "Malware payload (AgentTesla)", "value": "5912a654c8ebc060400666bb863f2789", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686316600, "uuid": "eb0724c1-d6a6-48ca-9d90-fdcbd2d78a74", "comment": "Malware payload (AgentTesla)", "value": "81b33d93927df8c229c65f3897ec2d197d9d14cad920dc9e028fe1408a7af3f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686316600, "uuid": "1fc266a0-8822-423a-b9cd-1b4e02e3887f", "comment": "Malware payload (AgentTesla)", "value": "bea33f6e7e7ecbc1e3ba93e9e05b4d9f3e8ff5b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686316600, "uuid": "ef06c615-cff3-4f82-afc1-ce400f6d687e", "comment": "Malware payload (AgentTesla)", "value": "e559e5d0bdca2c2ebf8453115dbaa54dffd8549bfd5a8bc9ae35b4b2034e4bae9c4743b5ab099dcde399624abc9a8b32", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686316600, "uuid": "797da1be-7e07-4cd7-8714-0c2c90a273ef", "value": "T153A423369FDA8AF718D644C353C5107E0DC4EA8D012A1EADCD94A9E6205A14CF2B7CFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686316600, "uuid": "b735093b-187b-4bee-b236-551a7deec04c", "value": "12288:JurBuaKo29okeZnh4fWhJ5LuqNBSVIw9JtxJjas/8cNENGL:JFaKoATeDsU5uq6VNJtxdYQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686316600, "uuid": "241e770a-d077-4952-b435-5f1f5712cb8e", "value": 483759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686316600, "uuid": "792a83ae-96bc-4b76-b58f-382306de9ff3", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686316600, "uuid": "7c24576d-1e85-4326-9b19-daa5bf28ca1b", "value": "PO 19743.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ef7db86-06a4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (N-W0rm)", "timestamp": 1686301299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301299, "uuid": "7cb1c245-8741-4bfb-8cfe-5f333506db79", "comment": "Malware payload (N-W0rm)", "value": "e49ec6789a1b633f16cce8d88833ad2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301299, "uuid": "8e108d95-7e21-4a05-bc56-27d2292bd110", "comment": "Malware payload (N-W0rm)", "value": "820fbbad231042249cdd30f8f32c79baaf2373daec9676a9704ac531d89ff0f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301299, "uuid": "d396701e-31eb-4f14-a736-8a50fa6cb3ff", "comment": "Malware payload (N-W0rm)", "value": "6ab9ebe9bd194bd22ca5603a459f4f07ff8255aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301299, "uuid": "b1b666b6-d202-4dbd-85e5-b6d981c32cc9", "comment": "Malware payload (N-W0rm)", "value": "f4227592a64fa168b55ea17f58cda701becaafcb2387dcb56b87a17706e5473888107d166738b7c39ca47e4b7d484c99", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301299, "uuid": "fc4c8d98-5ccf-4f11-aadc-5cb5901bcce8", "value": "T15CD30201BFC0DAA7DBDA4BB490AAA9048535D54F19CFB78B9804E539F2DD3E30ED4095", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301299, "uuid": "7ea30ac4-fe3e-4902-a7af-b43d2b5c897b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301299, "uuid": "19178018-34d1-4303-b03a-a70049efdc96", "value": "3072:R6UMyaruEjDSOErSPTdWbAjEOo0z7cA0CjvhyMzd1IqQMcSfZ22JPsx9cWT:RLarj1a2Ib4/0CjpyMzdX8r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686301299, "uuid": "32ab7538-451b-4141-8bb3-0785896a07bd", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686301299, "uuid": "aaac691e-7d58-4199-962a-f25090e92513", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301299, "uuid": "209d90fb-1e72-45db-a343-0afc2db6c9d9", "value": "e49ec6789a1b633f16cce8d88833ad2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f8df9bc-0700-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686340921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686340921, "uuid": "d9f265a0-4693-417c-bea2-371d40a63a10", "comment": "Malware payload (Mirai)", "value": "e511f3c1acdb5b5765e928a017014682", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686340921, "uuid": "829837fd-f569-4c03-bf7f-206dd06cafac", "comment": "Malware payload (Mirai)", "value": "83b334ec121c5db67be4ce517760e738b097611184784e3a9ead1fd3366a3e04", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686340921, "uuid": "07054d7b-108e-4a27-a7a6-29452aa44c14", "comment": "Malware payload (Mirai)", "value": "5da86c3d5b4d20a5f0404ddcd3a26b216564a44b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686340921, "uuid": "013dec9a-0f08-4f8c-a1d1-2f7fcc3b0b56", "comment": "Malware payload (Mirai)", "value": "2412fc6e0a1077fe075ed04f8474542c6451a1865278e0183403a27d4e72da95fc80ec5e3efd25af73b44e928fe7acc6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686340921, "uuid": "3b60b235-3035-4d73-a84c-0f71249c5f6b", "value": "T189A2D029D345AEF4DFEF9DA052C2C3C276B547C62386C8E340EEAF012506042BB89D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686340921, "uuid": "c7fca6d7-c386-4ad0-8be9-5c32813ae0fb", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5IM4uVcqgw05VxJh:9RxsSVsMD6xiJJE5zRWNh4uVcqgw09T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686340921, "uuid": "6bf4cdee-485b-4696-92b1-2187aeaf76f4", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686340921, "uuid": "348701ca-47fd-4d00-b85e-5de516061df3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686340921, "uuid": "52541ea0-69fc-4eb1-8389-c0e42f3181a7", "value": "e511f3c1acdb5b5765e928a017014682", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e908c5e-069f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686299231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299231, "uuid": "eb5f2745-0886-4424-90db-524c32baeb83", "comment": "Malware payload (GuLoader)", "value": "b5157423e3f9544dccc36a58f0ab1511", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299231, "uuid": "ec44fb3f-b70c-4426-8b0b-7ca12f65c5ee", "comment": "Malware payload (GuLoader)", "value": "841ce7f81f9a7e7fb55e185c2cd20b3f535011e4bcd510efc3128027b19c77fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299231, "uuid": "8069ebbe-fc4f-423f-a336-bc9e7a5675d5", "comment": "Malware payload (GuLoader)", "value": "0fc888b6884c27577650b50bf52ea0f3a7e2727c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299231, "uuid": "890b9e86-51c0-4bd4-b956-4ead78f12baf", "comment": "Malware payload (GuLoader)", "value": "ebf4591da631dc4cc3d7a4f02a58d56537fbd8d86a2dd0dcdf92caeda4753ba8abae80a9faa15dc2679a1eab8124ec26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299231, "uuid": "bf489162-7d26-47ec-b4a7-3d17f782477c", "value": "T1B15412829AF180D7FE8213714977EF6356777DA5A430D21F972DBC032FB22828E1A245", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299231, "uuid": "ac2d3cb1-be88-4a5b-8640-4901c8a331c5", "value": "3f91aceea750f765ef2ba5d9988e6a00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299231, "uuid": "a03c9b3f-a7af-45cd-8091-35da8a430d85", "value": "6144:5MrudbcDdc1vxEzYXF/Ayy9BanZXwiX514GsHEnrbd6+IMDPJw:5f/vx0iJAyy9snr5unEHdDDBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686299231, "uuid": "1aec1a0c-79b5-400d-be09-8a4f45b9d4b4", "value": 300983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686299231, "uuid": "cb3edf3d-fd7e-4ab3-824d-d1eb69e94327", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299231, "uuid": "99563d70-7f22-43bb-91d5-082fd81c57d4", "value": "QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "183a0763-0690-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686292644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292644, "uuid": "2d3a838e-5464-4330-824f-0c47b42c2bd6", "comment": "Malware payload (Loki)", "value": "2db7d9005f81c7c0ebc3159ddf6d2dcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292644, "uuid": "b699b1cd-90aa-463c-85b4-bc3679e3a761", "comment": "Malware payload (Loki)", "value": "8699f030698874a541a877ae7068bde48d11e74fd9a6c817d45885e1815e0dcd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292644, "uuid": "fcbe0b86-5d3b-4929-b094-5ae9eafdc59b", "comment": "Malware payload (Loki)", "value": "5d2ab2f4e04e9ae9faeba49bc4b2235d5a538c7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292644, "uuid": "71b7841d-e5c8-467e-b470-28110b687c22", "comment": "Malware payload (Loki)", "value": "c97d5e2e792ca304dba1006ca2a4c670e6cb6bd9f4aa8c1570ec7fd6a502d273112fcb547fb660b7d6dea4e5bf99f280", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292644, "uuid": "99e41756-0e9e-4785-8171-61cd63187a3a", "value": "T106E412AD17A7546ECC863FBC8D202BB9D1EC46497667C6570FB3FC9C9C19B040D826A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292644, "uuid": "f30cf7af-9596-4e2e-a8a7-53ad3b2bd221", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292644, "uuid": "8e3a4402-b616-4c96-8f95-bb475fcc4a90", "value": "12288:zGPWR28Le0cY+Yg9fb9LW9IPqJ7qqPWcF4Jq3teJTP6FJv:zm+xL9Rk9w9IiJl4sduTsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686292644, "uuid": "2d3f68a8-bfe6-45f3-b625-bf0db3dbe9a6", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686292644, "uuid": "a216a8ff-5854-4898-a1e5-1695e82f61b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292644, "uuid": "1361d018-1026-45fa-a19b-edda48339fef", "value": "PO2345_46889.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c7023e-06ba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686311026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311026, "uuid": "f011158a-b203-46e1-8c6c-94d69b643da0", "comment": "Malware payload (Loki)", "value": "c05ec89915fe0544b4ae8c4a1e753693", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311026, "uuid": "eea86a60-6d0e-496f-a89b-865d648e76a1", "comment": "Malware payload (Loki)", "value": "87d7051c8e84d0820bae86d6969b551fd1a921084e23bff33494c1e55625e43a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311026, "uuid": "cf5df39e-a4df-46e3-9846-0eeacf8cca92", "comment": "Malware payload (Loki)", "value": "5bc3cf020e2f91c625a2dcca30a917685a1c7d9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311026, "uuid": "633f46b7-41e1-45a0-bcdd-905c50353cb2", "comment": "Malware payload (Loki)", "value": "a46fac59402d919db3e011c12d060ca20868e4a336aaac68524a65c16c00e113eae7c23f8c11941be8a300f2b8597cc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311026, "uuid": "8a24693a-b18e-4497-9957-2b9453a6c4bf", "value": "T167F4D05433BB5F26C43A6BFA4840693487F8AA59383FD68A5ED2B4DA5950F110FC0F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311026, "uuid": "08109adc-07c9-43ca-beda-02d4c8c0c31d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311026, "uuid": "8c711470-617e-4408-8215-e17dd71b252c", "value": "12288:1HrBhaDnLMzIL2q+RTdOL8jh4wO2f0zkUtwfhcR+93ROmy33N4xY3+fVOz:1vOyqGUL8jh4+f0zXwfS+93RtOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686311026, "uuid": "1db49719-89c5-46f2-8e63-d944adbe58ff", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686311026, "uuid": "948f17d3-f8dc-4b53-b3b9-4ae024e2fa3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311026, "uuid": "93bfada7-16c4-44e9-bc2b-583e5aa54e36", "value": "AWB No S14-213008.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3cbc7a-06a8-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686303338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303338, "uuid": "1dab1c92-f315-483d-beb9-2d9925c4b1b8", "comment": "Malware payload", "value": "9663bb6a6d3e5da2a1efe0a3859f1259", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303338, "uuid": "a3f46e14-339d-41ec-bae8-275f51a73683", "comment": "Malware payload", "value": "89c3644242d31c4904211be6acaaf0f6a9903dd1b55d90a4549e1ec300ce7bd5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303338, "uuid": "49fe8825-1347-464e-86b4-8076f6eb0c69", "comment": "Malware payload", "value": "060193d241d3d31a070c14bb43daaaad98032bde", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303338, "uuid": "39dbccea-b0de-4d79-8cab-0b886d2488ab", "comment": "Malware payload", "value": "fccfffaafa62645ae77a15ce6eb4aad5517b833ce555a9ff69f194ffb7106f980117c872a303889b83a4dc613c0439f9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303338, "uuid": "35038c16-b543-4757-8c6e-c354312b1894", "value": "T1D712B07A5B02541CE5001BB498607F1D92606FC504DDEB016AB90453BFF27B5EAAB08E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303338, "uuid": "3a59aa79-733b-4b11-87ea-fdc34f701dda", "value": "192:QikHktOHvSNmN2uQG1tySUA4MiMbEeHDAioh5mhHHRqWz4:36kIH6N624SSybIQ5mDqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686303338, "uuid": "e73fb953-c4a6-4148-b61a-209c4eb1c061", "value": 9453, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686303338, "uuid": "76628417-d924-4140-92ff-d529deac5b8d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303338, "uuid": "67a86181-9f00-4bff-b171-bd0c013b2e4e", "value": "TRX23732373.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0092b60-069b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686297731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297731, "uuid": "943160a1-8896-4103-97dd-f7a1e109e041", "comment": "Malware payload", "value": "d72cdd8caf23967f1bfa70ac1afb5991", "object_relation": "md5", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297731, "uuid": "61294792-b7cf-4a71-9a47-73ebe97f85ca", "comment": "Malware payload", "value": "8aedaedd9cad1cb4327ee1c7533ed8ff760ade7c78f3329edae26f5ee363a930", "object_relation": "sha256", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297731, "uuid": "cbfa9616-3938-45d2-a265-50c689c772e1", "comment": "Malware payload", "value": "25edfb36a9c581f4ee65a4e6366960c74a127967", "object_relation": "sha1", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297731, "uuid": "63d5a54c-5d70-4f0b-b193-80ae550514fd", "comment": "Malware payload", "value": "d23ed152277c3032c02a89d19b24b65c63294b13171e5f0fbc0dd3650b508b723937deb61d18837e53895500fd5b2184", "object_relation": "sha3-384", "Tag": [ { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297731, "uuid": "7d6159c0-2a75-4d1d-bcad-1a15770c254a", "value": "T1E1F433E328BD79D5928D2008DE6CDE1917121B7AA1D3C011E9AF3D47EB91E5C33E82B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297731, "uuid": "b2d30db1-7433-45ba-bc59-45c14762b167", "value": "12288:kxNk4Nxp8kY0czz0hbugv4Bsu6ad7CoHHzLtTuoMq5uy3QhV40IZU0TGn:aXHpdY07WiuZnzDMK3Qn40IZU9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686297731, "uuid": "1a5ede98-1c8e-49c7-8aba-7811db48dc03", "value": 736658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686297731, "uuid": "843c6ea6-32d3-475e-b11e-828035f09fcd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297731, "uuid": "eede9348-113c-458c-93cb-3a0effb7fdb2", "value": "PK01508Q0014968PKKHI.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8819ae57-0693-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686294120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294120, "uuid": "a1be0f0a-b1c1-4e30-9803-ec76df217204", "comment": "Malware payload", "value": "ef7b3c31bc127e64627edd8b89b2ae54", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294120, "uuid": "34b14577-1d9c-4d4e-aa02-b81517465778", "comment": "Malware payload", "value": "8b04fda4bee1806587657da6c6147d3e949aa7d11be1eefb8cd6ef0dba76d387", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294120, "uuid": "98051868-6f0c-419d-b086-629ee6d618ba", "comment": "Malware payload", "value": "310d606ec2f130013cc9d2f38a9cc13a2a34794a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294120, "uuid": "39304d7a-5d41-46e8-917a-407325cde52e", "comment": "Malware payload", "value": "c0ae56928fb056a31150afb80d96cfe343b60dc2c6bce68ae1e752d1fcbee8e998a53946aa310448b6f00e483d74ec60", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294120, "uuid": "335e3e59-0286-4ece-8c81-1fa67606405f", "value": "T19CE533E5A5769077EA8DA3F885D009F80D37F8266FA427451387FB17BC20A12DA0397D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294120, "uuid": "3ee193cb-6f22-4e8c-b446-5c975b992c85", "value": "fc6683d30d9f25244a50fd5357825e79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294120, "uuid": "978c33f2-a5ff-497d-99a3-7f93589b762c", "value": "49152:wshda+bFz6dmTTfO0JBhybeUXzELz/RkxI6Zxkxur4E5IReTD5GKHmDVJPY8:Js/4ibecELz/RkO6LF4hRq5GKHmBBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686294120, "uuid": "90e8d644-bb09-4c79-9f34-0396512849ae", "value": 3178496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686294120, "uuid": "37e080d6-366e-43a3-a83d-71a09ef3c043", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294120, "uuid": "ac3feecb-3756-4cb0-a9a2-ec57adc36b1c", "value": "06496099.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae3f3a73-069f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686299338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299338, "uuid": "2809a4a4-f10a-4a29-8e5e-80be3634146c", "comment": "Malware payload (AgentTesla)", "value": "e890c7303c53f09b91f6dd3860ca6c32", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299338, "uuid": "cd80a6cd-2114-4bc2-a819-c3377e8bb577", "comment": "Malware payload (AgentTesla)", "value": "8b69faa6b135b49e2a138b9e536e5a5146a4ab21c61dca8df7ff97062164732d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299338, "uuid": "bd62beaa-ec0e-4afd-8978-2c6173447d58", "comment": "Malware payload (AgentTesla)", "value": "8c23cbd06e1faccd8486b5248a51d7ed4dff40be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299338, "uuid": "b4c931d2-db96-4d61-9509-ddc45bd917fb", "comment": "Malware payload (AgentTesla)", "value": "51b2f630434b9267eabdd84a362a87a63d003df3c85754c87aa2f2db88c8a6793f83cddfaf68bed71631282ff9c1dc9e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299338, "uuid": "d08c41d0-a44b-4a62-8861-b27636ddb1ed", "value": "T1D1F4F12523BB471EC8BB7FF9083402B097F9A956B533E34B4ED678C99D16B114B406A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299338, "uuid": "5ed5aa5c-f591-4e66-a789-bcd6e6d8ed13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299338, "uuid": "a4edbbc9-b01b-4e3c-91ae-b58cfc888e8b", "value": "12288:PP4haDnLMzIL2q+RTdOL8qZeBnQujIWxr8B0bZKfEfWDKGNjqNbwGPkf:uOyqGUL8qZeFQosBSEEfWDKsjzmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686299338, "uuid": "e69cca46-c9a7-4038-b47c-91169002211f", "value": 775680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686299338, "uuid": "251d1e34-0e05-413d-bdf3-1d7a54091b0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299338, "uuid": "7cb77d14-f597-4999-b870-e59f364aa47b", "value": "JY ATLANTIC and JY BULK PASIFIC Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d25bb6ec-06b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686310136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310136, "uuid": "a00bf691-7f49-4721-8d85-57eb58e67bcd", "comment": "Malware payload", "value": "2fb3ef073ae4264e164dd169c32fc7c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310136, "uuid": "cae7f822-e88c-48c0-b693-4415ba7d5f5e", "comment": "Malware payload", "value": "8b6ae8309efba64783aa15aeb7b5aad7ab4071211139e6e119082840ca06e023", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310136, "uuid": "0163f14b-8945-44ce-92cb-b0f5480b0b8d", "comment": "Malware payload", "value": "fb4ae0750eb1ba5d8ac93f960e1d41d4f3b2f842", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310136, "uuid": "197374dd-beb0-436c-b070-0a1d4180e015", "comment": "Malware payload", "value": "c84a227ca80810c3a48aecd0fbb17335b383b0d67089a75e10be9021d64d0daebf4b242935d02627a1130f4927dfa253", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310136, "uuid": "53dbd0da-8bf4-4b56-a930-a1b360784b2e", "value": "T1C7E37E12B4C0C4B2D5721A3316B497A55A3DF9704E928E9F27980DBD0F752C1EB31EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310136, "uuid": "f9757981-b6cb-455a-9e11-7e62c3d5f266", "value": "e41d459fe48a0f1750c9122e1018ce53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310136, "uuid": "dcf22f65-57da-4c20-b37c-070671b72a8b", "value": "3072:ECzlxS0V/aqDsV0WDgkPU8zWZmdt3Odyfx:Egaa/itDb5F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686310136, "uuid": "637598d6-bf8f-49c8-b833-ac6f32836d5b", "value": 143017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686310136, "uuid": "8654bb4b-8677-4185-b761-f3b648bb2851", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310136, "uuid": "4ceb1157-9b23-4567-b11d-3c025f00dea5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8964de76-06a7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686302712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302712, "uuid": "0275bcc4-dc5c-46ce-a6b9-77d2a6930df7", "comment": "Malware payload (AgentTesla)", "value": "e366b7860d8b98322ee7928f1a23cad3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302712, "uuid": "c64baf0d-ff07-4808-bab4-00f2b36aa7b4", "comment": "Malware payload (AgentTesla)", "value": "8bdd216fc9fb0b6b3ef0e72188c5c41ee6207679ce68cc0b625f8e33a4ae2421", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302712, "uuid": "e3dee344-e288-4b5b-aef2-08c383000de1", "comment": "Malware payload (AgentTesla)", "value": "096688f7d7fcbed69bc2fb02a4753e67505b0c17", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302712, "uuid": "6fcdd463-eb13-4d72-b0b0-974a91b61b60", "comment": "Malware payload (AgentTesla)", "value": "bfa03ad2076a5a5c49d5d1e4f3119316bd55e1ab4b80eaa22c9bc35ccef4e5f635ed338e1992832613ec0d7f83a42e90", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302712, "uuid": "450469e4-081e-4b64-97e3-25212c6d1a63", "value": "T12443B620A7A54632DA754F3294A3539103BFB70A54B39BAEF84DA01E5F133550B93BF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302712, "uuid": "aeab1c4f-e817-4ab0-a32a-5f6435cce107", "value": "192:PmXCEWQfs0lSkGQvhfSaeWC83T/+ULEGMf6Z:PmmQfnpfSaeWCwT/+ULEGW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686302712, "uuid": "ee8ab163-6e45-4c81-86b4-6c0e91010f99", "value": 59392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686302712, "uuid": "c0b579ff-a8ec-4b16-8d71-4ed863bdb365", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302712, "uuid": "5d432b2c-66d2-4a49-8be7-a0e3c23895f0", "value": "Quotation QAMF 19590.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2d5d0b4-0696-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686295561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686295561, "uuid": "ca1b31ff-43aa-435c-90f3-f117663495d8", "comment": "Malware payload (AgentTesla)", "value": "f5ba13e6657da89ed08d896457457e43", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686295561, "uuid": "9a5fbbe6-7524-47a1-a170-cb9231cadc9a", "comment": "Malware payload (AgentTesla)", "value": "8d5c1c2c36fa33336d0173c396671ac747170a070f9d1c7821daa74543972e89", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686295561, "uuid": "bbbd46d8-8a69-45f0-98a9-d9de5beb15cd", "comment": "Malware payload (AgentTesla)", "value": "ac027c3eed3bf7847417afe2dd196e2c5eb20df6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686295561, "uuid": "810b4afd-46e4-4941-b836-6f9c543b3f22", "comment": "Malware payload (AgentTesla)", "value": "bc53d0c74d6326e7ae1febd7077168fc6034461924aca8798f4bf36ea9be1751074646ee0dd7b1bfbec711ba51c04445", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686295561, "uuid": "fdfa574f-0f32-4645-9175-84f2b23db9e5", "value": "T1D4D5F9907EFFAE9BE5B7BB33A2DA21415667F8C5330BD70B0171027A41173816E570AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686295561, "uuid": "0676fc2e-8875-4807-90d0-bfcfbb289790", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686295561, "uuid": "b7ac6afe-a76b-4141-870c-4e77f3199055", "value": "24576:vVl46oj2fgEVM/urm0VeVbpgpCAu4D91gDMmk:vsigpx0eVbOpCp83", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686295561, "uuid": "d8c4ef0b-a5ba-4457-83dd-6397e2144e28", "value": 2789376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686295561, "uuid": "3e572838-ae51-49c0-986d-c80865752c4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686295561, "uuid": "ca57de83-6829-4c7e-9b40-356836cca5ac", "value": "IMG_11560_0753pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24b4b3e7-069f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AZORult)", "timestamp": 1686299108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299108, "uuid": "1227f6b2-19ce-4240-bd91-9b6671510699", "comment": "Malware payload (AZORult)", "value": "5acd030fa8d6773c21b19a4468727d05", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299108, "uuid": "b03067c7-66b2-47e5-ab0f-566b0e2b2c3d", "comment": "Malware payload (AZORult)", "value": "8ef00db9712f487dc2bd4329378cb38ba2d1706284658e5e77602cb180ca82d7", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299108, "uuid": "935158b5-8fd1-45b2-ad57-483ea76e22f1", "comment": "Malware payload (AZORult)", "value": "7d4e4f8e2145d381cf96c291782152737a976f29", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299108, "uuid": "92e4de46-3a75-49cb-948d-9e345fb958d8", "comment": "Malware payload (AZORult)", "value": "04c059e76bba4a0055b8b7cc7c651fdfbe5da7ecc8b9140725e731f6c4bf5b3b7bdef6f17afe283eb4863605f8794187", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299108, "uuid": "5d0621eb-d2df-4940-a60b-83048e5d4cde", "value": "T141F4AEA2F500804FDE24183FF576366C2A656FED988A76E12341B7D71C72A52C78F60B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299108, "uuid": "542fba28-4e85-4d4b-9d79-0beba18bccab", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299108, "uuid": "4b987b92-1646-478c-8c99-3e72fb288ac0", "value": "12288:dgQ44tKnoQYrBCa/00lz/GVQ5pYkEwe+58Ym503sHr:d0CKoQUMa/rl7DVms8YmuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686299108, "uuid": "7ffe5edf-7c96-43f9-83f3-48ff8a7d5502", "value": 788601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686299108, "uuid": "e8bbe95c-f582-4efe-8cd1-975654534335", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299108, "uuid": "90176a7b-524d-44d9-8c31-3c8ba04009a2", "value": "5acd030fa8d6773c21b19a4468727d05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22379ec2-0660-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1686272045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686272045, "uuid": "0e5ffecb-0b05-4fad-9b8b-92075ce0c9cb", "comment": "Malware payload (Stop)", "value": "a5793db5ad98003bfa1a5e0e47c97ff7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686272045, "uuid": "87de7ef2-934f-4d71-b9e3-808c498df5a9", "comment": "Malware payload (Stop)", "value": "90694193de42805e79e29e2dd0de34482f3e2c808bc7798def94ffdffafa71cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686272045, "uuid": "67696eae-bba7-4983-91e1-9fcaabda017e", "comment": "Malware payload (Stop)", "value": "1f57b6f70d27a0e5135abc2f301921d7359225e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686272045, "uuid": "aadc2510-af27-447b-b71b-d90ea7116589", "comment": "Malware payload (Stop)", "value": "8abb8853e52a2b8510731c07d16292d721b39019b663ccfb9fded316232a497db893e4e4b5c1f0ff6c9339a3829013fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686272045, "uuid": "44a523e6-4567-4c0a-b3c1-6c553db5d6a1", "value": "T19005C013A2917C55E9255B32CE2ECEE8364DFA508E0D3B662A18AE1F14B1271D173F1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686272045, "uuid": "629514bd-cd5b-4d20-b685-4879444dcbc5", "value": "078c527316e58c8f8358ebd022c4bbdf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686272045, "uuid": "765f2be8-8e4b-4cb4-b5e0-06102a288c8e", "value": "12288:X3YucCl9NERfgINJXuVNOrrI6AxQEi0gDLtjLUOVWpeU+VSNtqZJjCpxdPuI:X3aC9GRoW+VNYr4xs5DSlYU+VSOUrN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686272045, "uuid": "4a7934bb-41ae-45a8-b342-bdfedd6cf50c", "value": 804864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686272045, "uuid": "ed97e91c-2d60-4791-afa8-70c72386c88a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686272045, "uuid": "cea63caf-704d-4e7c-a7b1-0d5e177eba57", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "197c2e74-069a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (WSHRAT)", "timestamp": 1686296941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296941, "uuid": "3b26a5d5-a7c3-4e51-8b2a-ba67457398dd", "comment": "Malware payload (WSHRAT)", "value": "6dbb855f97d596832fdf8e69305c0eb8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296941, "uuid": "05241c33-4f5c-4c66-8d7c-29551d020f17", "comment": "Malware payload (WSHRAT)", "value": "919ce7c9562ac3c75c038cee89f48b4ef7cc96e7e35ad85bebc2fff7a84fffdf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296941, "uuid": "7f4f2ecf-1d32-477e-8d81-adde84f40b3e", "comment": "Malware payload (WSHRAT)", "value": "b5d5778f7a28da671bdb14eb7c796566761a44f4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296941, "uuid": "d9a81f89-c2e7-48a2-8ba5-bd1fc7379632", "comment": "Malware payload (WSHRAT)", "value": "c264aca25b3e288a87a8b079f10953d7f8781eff932bed9b65187bbbad774177151a0e957f0f3eeb9208bb7bec3fc30e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296941, "uuid": "ea63213c-15bb-49b2-84bf-c91a043b6f3e", "value": "T1BBE19162DD012BDA477F7E395A0B1C8A40871E17495FE59A8A27F09D1739F002CEBAC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296941, "uuid": "0ccc780d-e078-4ba8-87f7-ee0d2bdac953", "value": "96:baKo33jkavQ9jRwGUvsvOwcvgGU83jwujQ9jRwGU+NyEujy48Eujy4U55FNda3Qg:H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686296941, "uuid": "d6c15245-20ea-4aaa-8b63-f841bdd2776c", "value": 7346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686296941, "uuid": "47904c61-344f-4b5e-874b-e6d3cb09b354", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296941, "uuid": "9a6a798e-84e7-4021-afd2-776aa2d2004f", "value": "ORDER-230606_List.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6256051-06a0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686299808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299808, "uuid": "0a6d11ba-4650-419f-960c-74dd8efaeb7f", "comment": "Malware payload", "value": "c45bdc410dd23ff081c0fa4389337984", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299808, "uuid": "0426b5db-3e52-45e1-b52e-9005070e2b40", "comment": "Malware payload", "value": "91c19873a6cb357be6a268bcba88946c84ddaaf58764a4b82ee08f9e1ac1e28c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299808, "uuid": "e801561d-442d-4985-ac49-f370303ebf0a", "comment": "Malware payload", "value": "22a0fbfa7dc3757e82eac76798cffb720c197c21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299808, "uuid": "9fbacb3b-0ce3-47ee-8d57-4cd50fa10366", "comment": "Malware payload", "value": "04894f11fc8544eb80087ef9840b3fe2cb0c76146e288ad2ccb895af3c8584e8c4e5d3366f3e1cbb4bde926dc386af96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299808, "uuid": "fc18e418-5064-446b-9301-5d9d55dac123", "value": "T19AF41228A3F7472DC56ABFBD4D500270C7E955957537E10B0FE3ADEACE12B2449D08A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299808, "uuid": "533e6320-93b5-4ca2-9f2e-f9a1cf25cb1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299808, "uuid": "adb443f6-9ebe-4537-b82f-b1a74669c33e", "value": "12288:02iNUewx/NscEQ+vgXK1Hsa0PIMQsogeJoYnZsRyAD5rVk+QxdBoxghrVVIpNG/v:01iewlqB6p8MrogeJoYWRyQ52jjuK8NC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686299808, "uuid": "da312c75-a563-4f26-ac4d-601a69121356", "value": 755200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686299808, "uuid": "17a5f164-1c98-4697-a88a-b92e9ed55f86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299808, "uuid": "61fd6654-1cd0-436a-8249-5b2757a2c88b", "value": "PI_1304021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d3f1286-06b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (PripyatMiner)", "timestamp": 1686310047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310047, "uuid": "67384249-6f7d-4b2f-a553-3e665f3d5c8e", "comment": "Malware payload (PripyatMiner)", "value": "f15c44b66366824e559fa0b585342481", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PripyatMiner", "colour": "#2B62D4", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310047, "uuid": "75da66b8-d4cf-4122-a51a-f8ba54931932", "comment": "Malware payload (PripyatMiner)", "value": "9259cfad718da3fc0fa0a80013b5817ca4263ecdd3f1763f38baaa29b18b594e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PripyatMiner", "colour": "#2B62D4", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310047, "uuid": "e2868330-a3c9-43b4-8624-750dbac4ce7f", "comment": "Malware payload (PripyatMiner)", "value": "72ac7381eb647f5b8c522b69507a81001ba7587d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PripyatMiner", "colour": "#2B62D4", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310047, "uuid": "2de118e2-dda7-4701-a2e6-dd3edd93e3c5", "comment": "Malware payload (PripyatMiner)", "value": "41fbc99ecc464eae8cf923e966aae740d4bac13bc04dbeea40025cf3f816b07152767bcca9bf50b8f5bcc0b27274caab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PripyatMiner", "colour": "#2B62D4", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310047, "uuid": "014b3e79-afa6-4044-ba83-4149bd417f4c", "value": "T13AA6CFD34F08B653D3A9737B52C04F57530A61B06F50B84ED69BB4178FC488B6EA2E89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310047, "uuid": "c580bf4d-fd83-4c39-99e6-37caae6fda71", "value": "f7505c167603909b7180406402fef19e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310047, "uuid": "2415ace5-ce36-458b-a1db-3f1139d5e763", "value": "196608:fFKU87S+RlCheenIKfKnAa8SwXHwzCKoLoxJ4L7pOP8ApVv9rNElFTkz4l:fkA+RlCheYIDq7wurfsVv9rNEPk8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686310047, "uuid": "bdddf406-be68-4510-aa4b-5acadab2f7ea", "value": 10264640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686310047, "uuid": "f15648e3-09ac-4c8c-aa40-9e8b7b9b58ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310047, "uuid": "75293c41-59ae-4c33-9104-32dfd5b47abe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a230a5-06bb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686311246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311246, "uuid": "eee56d3a-cf6c-4353-a8af-edd49b88ce59", "comment": "Malware payload (GuLoader)", "value": "e7efe8a92c6cf1d5d728760704563b99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311246, "uuid": "363173af-2bb6-4cbd-89ba-a237f52be517", "comment": "Malware payload (GuLoader)", "value": "928fa394add18079f31c050e00429abf5c13d01f5026670d47744a26a797de79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311246, "uuid": "cd20c098-3073-42c5-b96b-d5281485b428", "comment": "Malware payload (GuLoader)", "value": "896c01f4e09024d359a9ef66e0bfc5318451d020", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311246, "uuid": "7761157d-e052-474b-a260-19919af99c07", "comment": "Malware payload (GuLoader)", "value": "29a82ed522f31b2f540ca86c5ca8c864950b1d6409c577c36be7e30c9a1206ce0f33afb32e14ae38f0bd03c232549660", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311246, "uuid": "d64757ab-883c-47ef-a4a0-cdcc92d005f1", "value": "T186A4E12A6F57CD33E3492074D670EF3DAA7BDC141C1B861397F9E82BB114B26999E201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311246, "uuid": "9643d9e2-0a69-4545-8054-7f4d12b6c936", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311246, "uuid": "c8ec22cf-db21-4ffc-90d5-5c19477fd0ce", "value": "6144:imOPQGwvUsu5pjHWoFNgKu3/YOkzjzPU7Ldb2IXvckRgqqYg+lr:TRu5prWR58nM7LkIfrRhq/+lr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686311246, "uuid": "d6441880-a967-4038-9e2e-7440178b4f00", "value": 471870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686311246, "uuid": "ea21fa38-0e11-43ab-afc8-f7fa903426bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311246, "uuid": "ca7abf00-82f6-4ede-895e-ce1a56f919e2", "value": "928fa394add18079f31c050e00429abf5c13d01f5026670d47744a26a797de79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43eddd78-06bd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686312045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686312045, "uuid": "4150ee01-8873-4dba-b8f8-c90cb385b91e", "comment": "Malware payload (AgentTesla)", "value": "586715cdba830fb51193ea85f2ba03b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686312045, "uuid": "f81df106-1be0-4e7a-8f02-bb563cb7a873", "comment": "Malware payload (AgentTesla)", "value": "929a5611d83bb22a6014b2350e91cfae2fcdc369c797f14adb22b56465a90c68", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686312045, "uuid": "3110f62a-27f6-4be9-a84a-dac472766a6e", "comment": "Malware payload (AgentTesla)", "value": "73e102550ce916e586127664188418b9457ec5d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686312045, "uuid": "d9a1383a-4de1-4546-b565-389cda0b78f3", "comment": "Malware payload (AgentTesla)", "value": "05f5d1db1d145eeaf9855c1c3dcab52a01f58291db814e42f060ee480054b77ce276d5dd187648fc39cf15ea9d8ab723", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686312045, "uuid": "b5ffcd0a-682a-427b-94e8-bc43ba51a6a3", "value": "T17D5423A265EE0111DC04B9F8AFD0DEBD414DD571340AC2D0ACAB15FCBA715634BB93EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686312045, "uuid": "7ab202bc-7033-4b7c-a458-70af90b041d6", "value": "6144:Y9Abrg9nYf5QpRVpmPYrHVU+2qdQuPSlFuzyEV7YY7:HZfGP38YBQq1SlZ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686312045, "uuid": "3dc30aa5-812b-4873-9c84-6f406f4dfd32", "value": 278903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686312045, "uuid": "6fc4f246-3b80-4a97-8fc7-f67ced30e2ea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686312045, "uuid": "62a4db05-fdb1-450e-93e5-006fd77c2c15", "value": "SOA 620158497.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf45cf9-0691-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mimikatz)", "timestamp": 1686293404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293404, "uuid": "5f8e1519-f761-4b05-9fd0-2ea402f59386", "comment": "Malware payload (Mimikatz)", "value": "c6a2fb56239614924e2ab3341b1fbba5", "object_relation": "md5", "Tag": [ { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293404, "uuid": "636c5674-1f99-4bf3-9297-c173208ba35c", "comment": "Malware payload (Mimikatz)", "value": "92ad1b7965d65bfef751cf6e4e8ad4837699165626e25131409d4134f031a497", "object_relation": "sha256", "Tag": [ { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293404, "uuid": "d6a7b974-026c-4a4e-bffe-050932920f91", "comment": "Malware payload (Mimikatz)", "value": "bdd2ecf290406b8a09eb01016c7658a283c407c3", "object_relation": "sha1", "Tag": [ { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293404, "uuid": "01ef4582-d0d9-44fc-9afb-9522abe9f30a", "comment": "Malware payload (Mimikatz)", "value": "da119d995ed864d79c0f4562dbfecb46818040e44fffd62ef4e01494b73fd86d21346bfd653f449ee73e84f2b4ce2cc6", "object_relation": "sha3-384", "Tag": [ { "name": "mimikatz", "colour": "#4D024E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293404, "uuid": "0afc8783-98ce-4360-b69a-0af3ca4b28a8", "value": "T10E15DFC2A7836032FAFE0439852575FD9568A7EB6A0546DA339C43ED4A783C3F510E72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293404, "uuid": "70c2693e-34dc-438d-824b-1227ed1aecab", "value": "d0cbfb70904a6c2c4f1d40179a3943a5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293404, "uuid": "3028b3e7-b3f6-4852-8f45-1ea2a72d8870", "value": "24576:diQZitpSzuX+gltfyZE25LQv77cMhi7eobIMUGDM5Lna:rZif7+OyZEREei7eob8mM5La", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293404, "uuid": "74564fb7-fe44-4313-9e17-742d88fcd5a3", "value": 944128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293404, "uuid": "656f7724-8acb-436e-9eee-ceda5afaf0df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293404, "uuid": "f264904d-0ec8-45a4-ac5c-cb5df9355e15", "value": "01730499.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25dbc14b-06a6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1686302116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302116, "uuid": "40906729-1ea3-4d30-993f-9c5ef955c87b", "comment": "Malware payload (AsyncRAT)", "value": "40e90e03d1c397d3fede4c0e9d3dd2e4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302116, "uuid": "a89fcea3-766e-4573-abf8-9bdf856bd120", "comment": "Malware payload (AsyncRAT)", "value": "92b0cc6184468867764c824f3086da312866b47b42642fd32166bfb7c87bdf7e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302116, "uuid": "ddb4bbb3-ef33-487e-a80a-bb85998f4c18", "comment": "Malware payload (AsyncRAT)", "value": "2ca12b01d5a31dd2076a7a4c0ca70fb61451331c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302116, "uuid": "b3f081ab-4a52-45bb-9ad4-a3d18931f80d", "comment": "Malware payload (AsyncRAT)", "value": "4185d81a7545b3a677d1d5fb73e495798d377deef2e57cdec8cf228935e183ff171fdd6f66e85c12c10218f9533c8f5f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302116, "uuid": "c776af38-bd37-44ee-84ed-6ee3733a6d8d", "value": "T159053FBC5D07E6EBCE39E25A95F02307B3715417B65EB88C6ADA3B850D93DC122D060E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302116, "uuid": "3a6a48af-4492-4ab8-b805-44c8c917e55c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302116, "uuid": "2b192343-6553-49a4-8837-f8f595078752", "value": "12288:fCBNfZFHB3gwr+1yjPHx0HGkYDHjrTCq:abHBQyjPHxqYDH/eq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686302116, "uuid": "c1b437f1-5cf6-4fb4-9b64-92d4985fbd66", "value": 807936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686302116, "uuid": "e67c665a-3c85-4dbc-849f-8feb52b68469", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302116, "uuid": "f635f8e2-d76b-47da-aeed-b6d13243431f", "value": "New Order SSRNSSIQ102-2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16730be3-069a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (WSHRAT)", "timestamp": 1686296936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296936, "uuid": "822215f8-42c0-4889-8464-d6247e42c417", "comment": "Malware payload (WSHRAT)", "value": "25433bcfc0ecf4442108983d4906dffc", "object_relation": "md5", "Tag": [ { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296936, "uuid": "a0df0210-3dc9-410d-a648-28a26592e142", "comment": "Malware payload (WSHRAT)", "value": "9342cb79d87d6805b418365e721122fe97de75de0764daebc7293c4a99fa22a6", "object_relation": "sha256", "Tag": [ { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296936, "uuid": "e845245b-6a7d-4cc3-94a5-60d7ba06e0c9", "comment": "Malware payload (WSHRAT)", "value": "cfb6becf2639af133667902fe82041e0e64a9864", "object_relation": "sha1", "Tag": [ { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296936, "uuid": "a8a4e238-ecd5-48ea-a1a5-0c54b1ef575d", "comment": "Malware payload (WSHRAT)", "value": "da7b0fa0b8d393840ea265c7edbba240f441d846ec0f753ce7147c55980240fad67e2d08d483ceb785433b28c7f640fa", "object_relation": "sha3-384", "Tag": [ { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296936, "uuid": "68839014-387a-4ffa-9ef5-740cfad2c6f0", "value": "T19E01B58E50858A16F2F720806218531ADC21C1841F526CE3FEF342BAA108DF20970413", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296936, "uuid": "4f3f6e9e-bb03-42d1-8793-177877329e75", "value": "12:hyIvONCQVYDSmmU9pqfaHi+2BwWbZyAWuGK1PNmrDq41wnAyji3nPOAZve/ADE8j:h5vO/hmzL29VBwWbZyT7K1PQn1OjeWu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686296936, "uuid": "48ae499c-06d3-4c2f-a536-fa82880a8989", "value": 743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686296936, "uuid": "f1612b55-dfde-42f8-aacd-48287091cf73", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296936, "uuid": "b1fc8584-eab5-442c-bfed-fdab2568b85c", "value": "ORDER-230606_List.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb5ebd87-065e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686271550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271550, "uuid": "5074bbb3-b690-4496-91db-697d8c7cad28", "comment": "Malware payload (Amadey)", "value": "6c0b873980032ae0987fb724ee8ac9f6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271550, "uuid": "366c24c0-1480-4867-a5e4-de11fa843cb5", "comment": "Malware payload (Amadey)", "value": "9436f223ea2d64468aca352ab4b8bb7ec1090c92d0e15456ddb8c6ca0711b377", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271550, "uuid": "b202e2d2-42f6-4ac7-835f-5216858a7ab2", "comment": "Malware payload (Amadey)", "value": "358b93b5294b6ac4eaa5444e7b9016b90215e35d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271550, "uuid": "bed98410-4e52-4976-b3c6-fd092f7905ce", "comment": "Malware payload (Amadey)", "value": "f766a1f8fff2c64f8ae742b4833759d617c4ca3ac86976f25c6a81910725fb0b096475ea60091fcf6c1ef19d29631f38", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271550, "uuid": "ce7382b7-a018-47e8-a65b-bfbee9faa1ab", "value": "T144F41205BBE848A7ECB06BB058FA06870B357DA25C34433B7F61DD5A58B2590A73173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271550, "uuid": "2334ae14-165c-44a2-96ba-0c3fe7f74288", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271550, "uuid": "d8ea13e5-0c2e-4868-b6b1-371b0984aa99", "value": "24576:+y2OM08x70tZO7NHJ3msrY1zU01oX1T7SC:N5E37NpSluX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686271550, "uuid": "1566822f-01b5-4223-98f2-9e7f47723fbd", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686271550, "uuid": "aa48882a-af66-44b6-a27c-aa809ee04ad1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271550, "uuid": "efb5e365-088d-4280-91c0-8ab69b5f6a56", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6faa71e5-0693-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686294079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294079, "uuid": "8dcaab7a-4cca-4251-99d7-6cef76578e58", "comment": "Malware payload", "value": "d81acaef0db08aac297d4bd3c58ddf50", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294079, "uuid": "d345fe5b-05d0-4e18-a725-648cfe3becb8", "comment": "Malware payload", "value": "95d5594cac9cfa5826e1c0b12fec980ff8a01136364aed2831164b46cbb13ca1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294079, "uuid": "b8d999e0-3672-4321-b0a5-8559ab73f968", "comment": "Malware payload", "value": "02e6ac2c001c639078c3e842132f91509a6f7466", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294079, "uuid": "9b011180-5752-40d1-8726-e147afca8320", "comment": "Malware payload", "value": "6bdbf20cdb94b27721470c505ff52b833e225d175adddc30681cb093fbd099c4a666fd05053d86570661425a3079cf30", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294079, "uuid": "6012ea92-c2cf-4b3e-bbd9-f47ff7e98c94", "value": "T128838D03B6D184B0E9F30A310CB9D9508B7FBD664E748E572398669D4E741E0AE39B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294079, "uuid": "7d3d2f18-ab4f-4c4d-997a-d4c990d964ca", "value": "2e66f0419297ddafdf3c94b316590cf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294079, "uuid": "a4219918-1d39-484d-831a-b93bc3ccd7cc", "value": "1536:ryD2eyujEyC5YYafh1Mc8/gsWjcdjl9btC:r+2eytf3B9bQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686294079, "uuid": "07472940-95e4-4ec7-b240-ef3a8a3f4fe0", "value": 85504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686294079, "uuid": "47fc406e-e392-42af-a8cf-b93c74658d3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294079, "uuid": "e5521f2f-c0e6-4f7e-955a-52081a6714ef", "value": "05239299.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aaf5359-06a6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1686302124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302124, "uuid": "477050aa-bca9-4194-b76b-2b315360bc02", "comment": "Malware payload (AveMariaRAT)", "value": "2d468f779544244d4b23e7e23a56c7c1", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302124, "uuid": "dd6dfb8a-f020-46e5-a973-b8d0ed7768fa", "comment": "Malware payload (AveMariaRAT)", "value": "98a6a9d928a7950b00e180fb0a9aa8aaabd5a614125206d1cc2ccf4d2c0dc03e", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302124, "uuid": "2bdc76b5-fa75-47e8-a4ac-6771dc3da304", "comment": "Malware payload (AveMariaRAT)", "value": "e70f13241c3b2aaceb123fc51f1ae20719a52d52", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302124, "uuid": "7b220bef-c223-4744-b330-d6c103316f18", "comment": "Malware payload (AveMariaRAT)", "value": "111c6affb6a72ddd0da1020bf795b65382b5830311d5aa2a691a0dc5efed13d2993b1c6ac6fab3a56f2c1bfd0153f8cc", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302124, "uuid": "2cb1ed01-9b73-4ef7-b31a-b04635d6df2a", "value": "T151F42304B9DDD32BC69E533F84E2A01645777153E237F719ADCA00CA528BBD88526B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302124, "uuid": "1feca084-f5b6-458d-bdb2-27a8e5d1f432", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302124, "uuid": "4371d369-65e1-4998-a316-6b59ac9a6354", "value": "12288:PL9cELqP8LDXKZrRblcQPwfTKT1PS/kOv016ElrXsij51HEOC4yR8/aW4Vu7N+3H:jCRULDKZdhvQVJv016+wc5RuR8j4wV06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686302124, "uuid": "b22e6a4d-7004-42eb-bdba-7ac9530a9066", "value": 728064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686302124, "uuid": "243d6a91-0144-4c03-a3ed-b8d31a31e6e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302124, "uuid": "f4a668af-fa95-4a8d-ad9b-01e78537c2b5", "value": "Toodete nimekiri 780980ESEE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "981019a8-065a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686269666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686269666, "uuid": "03053074-44ac-4e86-affa-8e5b8c5c82a0", "comment": "Malware payload", "value": "441c59519a328d1542631f012e353dc4", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686269666, "uuid": "15d8cebd-0585-44c2-9536-118ce297f53f", "comment": "Malware payload", "value": "98baddbc6216fb8949030b5cf71d3b85191daa0200fe1fa43483f9387f4b850a", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686269666, "uuid": "243859a6-7174-4962-bcc5-ff6447cc0d62", "comment": "Malware payload", "value": "0ee728960fb4c8590885c557988864dbfaf198d2", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686269666, "uuid": "6b2d801b-f430-4972-a0db-838a60e68197", "comment": "Malware payload", "value": "4e2607211104a3b8def02b49eb1e51045e4d3d1ac153a722d84e22721eaf8e5273723919b74c94da6f21b961fc39c97d", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686269666, "uuid": "f5409d09-1cd1-4f86-ace8-3ca5ad77806a", "value": "T191225AEE641D8D51DFA72C0CC7F1A4389A2C7661AB231443BD70EDDE8C341D15DA8E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686269666, "uuid": "c0dc68de-b557-4aab-8a43-b227219dcd46", "value": "192:Cs0bROIsaiNM8VzYgVlg2qmrlCD7+LpaTtbfkPdzRfqTdw+TJNjz2:30EI8VzdymrlC+FaTtqd9fqTO+TJN+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686269666, "uuid": "b232484d-84af-4b6d-bc9a-8dedd1da056d", "value": 10242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686269666, "uuid": "5e954991-2433-44b6-9435-9b0189d5b41a", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686269666, "uuid": "e51f3c4d-95e6-4474-94c7-fda967ce97b3", "value": "inputs.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83a11884-0692-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686293683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293683, "uuid": "6519d1ec-6640-476e-b14c-e2c9385d84d4", "comment": "Malware payload", "value": "a0537a70a34c494a0e285cdb00db5951", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293683, "uuid": "f8e22077-b2d9-46bc-8f42-c68b7afe2bae", "comment": "Malware payload", "value": "9a9b645135f59dfa2ee39bbabb4ecedd4cf0339e21fab6a75969f0f5135b5b9a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293683, "uuid": "c952130a-d00c-428d-8152-bd78a567b3fa", "comment": "Malware payload", "value": "8d6186bdd4cbb394dee2890bf0301863c3f7fdd7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293683, "uuid": "304ad27c-6b4d-4790-8d9a-13954a61446f", "comment": "Malware payload", "value": "d7e1a2de0751915526c58580b47701db6e396368de2cbe9a7a50ca0b08afd9b8f4d4cfc9872b546a3f3f1cc8796a7df1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293683, "uuid": "8b16536b-b020-4c9e-9aa1-59a9b777ff67", "value": "T1D105AD32B2B0843BC5B31B789D9B82E55937BD103E29659776E94F4C0E386817A373D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293683, "uuid": "4ba1f731-0599-495f-b517-4c80551fd87c", "value": "4359802f317d4be3b49195b674da56d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293683, "uuid": "c1fad1df-1d4d-45b3-83da-2c9a1ce096c1", "value": "24576:sQQP8YXpc/rPx37/zHBA6pe0zza8/JU/6YCmxyjML:W9urPx37/zHBA6pxzmqJU5V9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293683, "uuid": "cb1c0005-f833-421f-b80a-ad99976bde38", "value": 816688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293683, "uuid": "3b39c9a3-f72b-41c7-981c-143d5ecbbd2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293683, "uuid": "33876781-7961-4203-b9ff-cb7c7f0d4a42", "value": "08778399.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "876b2e02-06b4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686308293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686308293, "uuid": "a6c81a80-ecf9-419c-bd71-fbe3b7a5fb4a", "comment": "Malware payload (RedLineStealer)", "value": "6aeee24a8c4b2d8d5fd87a9d3fd42e95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686308293, "uuid": "5dc8a8f7-9257-4ea6-87d1-888d63df340e", "comment": "Malware payload (RedLineStealer)", "value": "9c846d5c83a0859060aef40f0ea1e4a6577fa000783cf0237cd0bd83207d3f9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686308293, "uuid": "c827aaa3-0399-4ac1-891b-5a43ca6bca1c", "comment": "Malware payload (RedLineStealer)", "value": "0ad75c89ca6e686c90176ef9b66f083e692efd9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686308293, "uuid": "8de8d8d6-4a54-4834-b7d1-5d1437205f7c", "comment": "Malware payload (RedLineStealer)", "value": "10a51f0d07c1e7557beb22fb172e027b4595e24eb23e5181b328e1a57085a45696f00e6243ba034cd474f6561d5b2714", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686308293, "uuid": "c403ab9e-237b-4af4-a8e7-532cb847b73d", "value": "T10B54DF103248C17BF51B24B545E4DAB29AB9B8352B2F51EBFBC813685F213E1AB70747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686308293, "uuid": "dcda5622-f51e-4b0c-a8d8-82bb4fa72906", "value": "a723f6c3947c7a9054d33c021115e563", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686308293, "uuid": "12a4580b-caa9-4c42-8034-7174a33758a8", "value": "6144:aMjDXYCkr8yGUFUXv51eenPY/33qPcRjBYUM/D:NXYCkQyfFU/3m/36kRjq7D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686308293, "uuid": "bfa57f8b-d992-4778-813a-5f790ea354d9", "value": 296696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686308293, "uuid": "5eec4b90-5851-4c82-bb2c-4a0dceb4aeb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686308293, "uuid": "3ced247c-06c2-4562-a677-3bbb14d36954", "value": "9c846d5c83a0859060aef40f0ea1e4a6577fa000783cf0237cd0bd83207d3f9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f3ef8f-06a4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686301307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301307, "uuid": "94c813f8-44f9-43e8-80b0-50cd5df2fcb9", "comment": "Malware payload (RedLineStealer)", "value": "8130fa6b0279dd54179954acb33e57d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301307, "uuid": "36ea75c2-3bee-4379-82a2-e573eb4f0178", "comment": "Malware payload (RedLineStealer)", "value": "9cb5f384185b184718215c6fbe7525de88e6d4e47d0a28e3bd68ab56ea38b653", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301307, "uuid": "356e3dea-5555-4901-825a-9a912b16e9cc", "comment": "Malware payload (RedLineStealer)", "value": "b192962dd0354f81c728d92c5d937034332af93b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301307, "uuid": "099f4d07-b2ff-4ae0-bfdd-178b5a904ce9", "comment": "Malware payload (RedLineStealer)", "value": "e334caaeef42ffade355182eed476dbee709326bf1af5f1adf36028750d6921185d36d1d6e4bdd08106610e3a484796d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301307, "uuid": "af8d7c6c-6bb7-4e6c-9cce-b582253ebee8", "value": "T19F44BE96FD704AADEA59C23FF0A39B230BE2FF779071920BA088BD2134BE7564505552", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301307, "uuid": "95110ebf-a919-4e21-8d76-8d1abdb562f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301307, "uuid": "7b37ea8e-bc7e-4d58-baab-0f507a537767", "value": "6144:iolAaadF/Ydubm8/GOnTjHuo10sE0/YmxgR34TphOwdO6ZTunn0aio6z:iOAaadMq/DqsEOhxgSpndAP6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686301307, "uuid": "41713a40-8c5a-4ebe-84f9-5d98b901f1ed", "value": 278016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686301307, "uuid": "6f34b257-096c-40ca-a2ee-0e63e72c1ebd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301307, "uuid": "1d69f181-587b-460a-b405-3311bbacf329", "value": "8130fa6b0279dd54179954acb33e57d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f93035-069e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686298685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298685, "uuid": "f73d3bb1-3db5-4394-8b9d-3c44bdbf6a51", "comment": "Malware payload (RedLineStealer)", "value": "9529608f65f2286f098829a22c097bce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298685, "uuid": "8210ac78-eb85-4390-a3cd-9ce17feb51fe", "comment": "Malware payload (RedLineStealer)", "value": "9d0d22ee24f78d29a1a27ae1c42221204665a9750e28c8bb665856393f657f38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298685, "uuid": "108ccb09-8764-4a6e-8191-fb524c51497e", "comment": "Malware payload (RedLineStealer)", "value": "f957c77fad8b387122cff8eb958d42187225ca13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298685, "uuid": "97ef06ed-7a65-4d52-bdcd-667d3f83fd21", "comment": "Malware payload (RedLineStealer)", "value": "f34bde83fab7fec96cee5398cf09280a1437db440ed5e5b02dae595faea862d2b52f7e3f5165bfc9375475ac20921f44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686298685, "uuid": "e3852eda-7833-4361-ab7d-f74c9bf4ee42", "value": "T1F264CF0272F0EC25E73647758E2EC2E4F62FB9F15E58A7BA22545A1F04711B2E673312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686298685, "uuid": "32ee4888-313e-4bd2-b325-18c070cb8a3e", "value": "a893cdef2037cf7fbfb751a55d5016a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686298685, "uuid": "dba9c9fb-102b-49e7-ac40-60a85b61b813", "value": "6144:gyS14O2lJzl6RQ8ODHT0LER4dmbjIEDY:gyNTzl6Az0Iq68ED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686298685, "uuid": "4a2c6334-27b4-44a9-8e65-3555ba584077", "value": 310272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686298685, "uuid": "84a38ccb-97d9-4f90-ae59-ac557e617697", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686298685, "uuid": "f4890e97-82ed-48cc-9c6d-a302d94e937f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e1b7a68-06df-11ee-b3cf-42010a9c0076", "comment": "Malware payload (StrelaStealer)", "timestamp": 1686326557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686326557, "uuid": "68192416-8a87-45f9-b291-b332d1d8a8d8", "comment": "Malware payload (StrelaStealer)", "value": "1190a97479bea881730210db55eba2b5", "object_relation": "md5", "Tag": [ { "name": "12980215 Canada Inc.", "colour": "#2C28D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686326557, "uuid": "b72477da-73aa-4ee3-9aab-04930616cdfb", "comment": "Malware payload (StrelaStealer)", "value": "9e1467ab8e370a976c0274bc5a901b0beab5864683a14c018d15d07cc7dd7720", "object_relation": "sha256", "Tag": [ { "name": "12980215 Canada Inc.", "colour": "#2C28D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686326557, "uuid": "89d84fef-5288-4280-a4e6-0c8048031b0f", "comment": "Malware payload (StrelaStealer)", "value": "0ba8c080272162cb8d8ceb60b50582b27399f5d5", "object_relation": "sha1", "Tag": [ { "name": "12980215 Canada Inc.", "colour": "#2C28D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686326557, "uuid": "85b357ef-2784-4685-beb9-8a6bd1a19fc2", "comment": "Malware payload (StrelaStealer)", "value": "93018ecbee3597d2b87c513b5ff6a1e305e4300dbe7b72b30893c45d05c5a26e264350d76f27e0fdde4cfd2f368e90cf", "object_relation": "sha3-384", "Tag": [ { "name": "12980215 Canada Inc.", "colour": "#2C28D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686326557, "uuid": "721c5385-dc9f-4702-a8ce-3bf83873b46d", "value": "T147727D523B682627CE8647FF9CD387243B3057072AA4DD9F5CF16AAC5F01391760227A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686326557, "uuid": "e307b661-e140-4a80-a818-e664cdf16fae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686326557, "uuid": "3b6881c6-9c80-465a-a4be-96475924ba6c", "value": "384:XZ8ocMqD0PF/1tZvDJMx+24/KpwKNsy368TxY9:GaZrv9Mx+3//bkG9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686326557, "uuid": "14caa4a6-2f67-4841-855e-f6c9aa58f020", "value": 16840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686326557, "uuid": "b05a2f73-bad6-4b51-8c5e-fc1b47b24149", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686326557, "uuid": "3d3473a0-7238-4ccd-bbd8-032d2b1c8296", "value": "Fattura (3).bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc02d5bb-06a4-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686301616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301616, "uuid": "c3df892c-e7bd-4de3-bdf6-4fc10d2a146d", "comment": "Malware payload", "value": "d86704134f65f0ebe87032f76864db5a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301616, "uuid": "085ca0a7-95d9-45c9-bf1a-8edfd6e3787d", "comment": "Malware payload", "value": "9e57ccd47600e2e5483b7464549bad124f2f529f09ad29a570f4e583a3355968", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301616, "uuid": "e559b9ef-a3c9-4f24-a288-d6063b848e61", "comment": "Malware payload", "value": "4189ddc83b8a369cf73dc3632cb8ed28bfb79eeb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301616, "uuid": "9f083a60-dcbb-4859-9b4a-ebd032d2fa42", "comment": "Malware payload", "value": "735d8cf2b4eefa07bc43d789cfe64ec68baec98e37adef3fbdb77296c72d8e1660d8538fab01658fac0aeb325b46fb6a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301616, "uuid": "2db39d1c-9029-41b4-825b-2d017303cf07", "value": "T1AF16330AB9907F33C10ACB7B04D0D46C3B67D95F2F495393F1206FAE5A1BAE8A9161D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301616, "uuid": "32d69f92-980a-4324-9b42-2327013075a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301616, "uuid": "c03b9e14-3a76-43e3-8e8a-acb3898eaa7c", "value": "98304:XJs06Eg5LkheKEdyvea5ZUt9WnZQ+1yzmp8PN:XJq5cdQXCYSpS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686301616, "uuid": "ce96bd9b-3464-4676-b17d-2efa16fd4289", "value": 4212224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686301616, "uuid": "a11e9965-afc6-49c0-8297-42d3fc0f6151", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301616, "uuid": "9133440f-3251-4d7f-8622-03390fb05aef", "value": "d86704134f65f0ebe87032f76864db5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ae2ce6-068f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686292591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292591, "uuid": "6531148b-5eee-448a-bef1-3060ff694d81", "comment": "Malware payload (AgentTesla)", "value": "96264671b931c1a55bb06074032e5b28", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292591, "uuid": "1493863d-cb2e-406d-89b0-29f4a53ef571", "comment": "Malware payload (AgentTesla)", "value": "9f090c60579dab06ddcae55533aad49e67b857d77a7f39074105267870f0dca5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292591, "uuid": "579d8e37-fff9-42e9-bb9b-c3f24378be84", "comment": "Malware payload (AgentTesla)", "value": "3e6dc3305e2d14ed9674ec7182c8ea765e5caceb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292591, "uuid": "52e2c345-ff66-43e7-8bcb-4af2af563ab8", "comment": "Malware payload (AgentTesla)", "value": "a4b317eb2a14a49fd94573aa4b8cf3849fc08d77165efa0e1848254116de19a6816f16cc5428c9901b265f9286658bcd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292591, "uuid": "ef8eb3ff-2939-4326-ac5c-88dbc58b82fa", "value": "T1CBF412BE27B7566ED8967FBE8C202AB5D1E99A457577C6034EA3FC9CDC05E080C806D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292591, "uuid": "6e27d31b-af81-4c3a-96b4-41f002089c79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292591, "uuid": "dd81d47c-f0de-42d7-ae79-be4376f38601", "value": "12288:BEPWR28Le0cY+Yg9fb9NVBrJbp1ItoQa0NBi671k4f+Ur0+E21APO5r9czmmF:BI+xL9Rk9rVlJbp1cdN54wAm5rCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686292591, "uuid": "47cc2206-0267-4ccd-8796-99227f5457d2", "value": 747520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686292591, "uuid": "5d9bb763-b315-4b39-8018-bb6efca8f968", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292591, "uuid": "5a3deb8b-7c49-469e-ba17-704ff0a49039", "value": "TNT SHIPMENT NOTIFICATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ae98f94-06a7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Neshta)", "timestamp": 1686302554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302554, "uuid": "44e062c3-9a68-4c23-8022-a82b20584089", "comment": "Malware payload (Neshta)", "value": "f422a55cdba9f3fbfff923d527f41cdc", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302554, "uuid": "cc2dbad2-b7c3-4d4c-9453-83d00a1fb677", "comment": "Malware payload (Neshta)", "value": "9fc4f26a0088a9b28d0a5a4c83d4cee2ee9aeeafa3bd465a10a3c2a6d54b781a", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302554, "uuid": "cd979629-cd8c-483b-bf92-3cf4246fb404", "comment": "Malware payload (Neshta)", "value": "2c5089b871c2a19f837bacc56f4c437b5fab3e22", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302554, "uuid": "ce35c469-7175-421d-a92a-519a0c3759eb", "comment": "Malware payload (Neshta)", "value": "0bb0fe452da43efc6f2efcdf03cf1a5e0115ccc0437957841899ca1140fe03b2925cfc94c7286faed48f4687c44d3d00", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302554, "uuid": "4e86e67b-18fe-4e44-857a-4ffe18dfdf80", "value": "T104E4234E282315D20AA2FE5C05AC93F510091DDE1B75448FF4AF399A9BBCD7C3EAC658", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302554, "uuid": "139404c6-5dc5-4bc5-a9cd-d27c203bd197", "value": "12288:FXT0Zr3nJeNLUmcZt5+g2PayapZoYxObipIgeKD/iCEz87syIlGtvCa7zi:dT+LnJeN705+g2PYpiWppjRgEpI897zi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686302554, "uuid": "19a7ee3f-bc8b-4ec1-a317-4e4bc19da9e8", "value": 710854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686302554, "uuid": "7627226a-e892-45ea-a2b9-af1369497ac5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302554, "uuid": "eb8e8648-c278-4867-844b-3e1237ab2dcf", "value": "CREDITED PAY SLIP.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c74be6-0692-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686293638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293638, "uuid": "ba2aa0bc-4d81-404c-a061-425684ac1354", "comment": "Malware payload", "value": "abf084a4016e6cff2e56a1bc4f1873bb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293638, "uuid": "b0962c25-7eeb-4fed-828c-3b9e99bbe534", "comment": "Malware payload", "value": "a0238dd66435c44cdb3e5ac361fa3ab59242b53fa26ebb917a9a9a7fd4a5987c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293638, "uuid": "b799af00-da4e-4fda-a6ec-4869948c3224", "comment": "Malware payload", "value": "efa92b80ed431e876fad859be713bd65072bf053", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293638, "uuid": "02c2d7c0-da95-4c8a-918e-adfc328119dd", "comment": "Malware payload", "value": "50436b3f93ec1d050473d8ddb498211289d692ea67ed6ce41f1288679e2ea9648eb7b2e74c07353802dbc2204fb2250b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293638, "uuid": "725606b0-151a-4ba7-91f3-3f0402ad0048", "value": "T11A454B316505CAF3D165003C6C06DFE72C293E9B52ACC17B729833AF3DBB644A7A5A94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293638, "uuid": "8ef0f828-7ce6-419b-b207-0bac568fa06e", "value": "24576:p61wqmd/LIYDI0vH/wk9HuqbUZ0QQfOHoenypLP+c2LIrD:p+MLIKI0AKHc0QQfe6Bn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293638, "uuid": "18f42cb3-7b31-4b58-ace9-f68343445dc1", "value": 1263616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293638, "uuid": "a8ad9c8c-df30-4cc8-820f-fc9dac623b0a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293638, "uuid": "ed6cbd76-db9c-4448-85bf-0071d1d7a7a0", "value": "07490299.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b6134d3-065e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686271309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271309, "uuid": "bd731077-6c4f-4c16-b565-477c8caebd25", "comment": "Malware payload (RedLineStealer)", "value": "153d58dba09b489c0ac219bea980e678", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271309, "uuid": "dc880149-5c81-4e7f-974c-921394a1c22d", "comment": "Malware payload (RedLineStealer)", "value": "a07dc133adc03ba863a7114f40b0aeff50f90119e1db8363eae527102824396b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271309, "uuid": "0735a385-4b55-462c-b91c-5ac6355627ad", "comment": "Malware payload (RedLineStealer)", "value": "4b409822373176992360531222648ff7e5811d11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271309, "uuid": "7131c66c-faac-450c-a863-879ec0ce809a", "comment": "Malware payload (RedLineStealer)", "value": "05eb358436ebdf173d70892e63719381d0066045a358b3727834fd894194b47fb8ad294903053345ba317e4063575fb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271309, "uuid": "ea953b95-c87f-4db3-bacb-a6755fe55c5d", "value": "T10CE41247EBE48033C9B517B459FA13D30B3ABD615978827B7345A88F0C72B946931B2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271309, "uuid": "7e9dda9d-a217-41c7-b864-e751f1be64ef", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271309, "uuid": "36bf944a-3a16-49e7-a4e4-ec7484be1acb", "value": "12288:mMroy90GbqcsIjuezHD/XRrmljx8MKqXXu7vC6tdoJmRob4GF4oR:CyjsIpjVmn8yXX0HswRobJFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686271309, "uuid": "847df5f4-c0fe-49d9-8fc4-33e5089894f7", "value": 685568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686271309, "uuid": "986abe49-b8f0-4ec9-8a22-3132b50039b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271309, "uuid": "35ef9ec3-a6fc-4220-8ac1-09230d40cae2", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "881b8917-0700-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686340935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686340935, "uuid": "86543fa5-a77c-4755-94b5-2e8cf0e4923c", "comment": "Malware payload (Mirai)", "value": "b8aab20f8eb8063c9fe8d9c0794f56d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686340935, "uuid": "351a07b3-8607-47c6-b0e4-13f1035499a2", "comment": "Malware payload (Mirai)", "value": "a0ad32d179efcd11f9ed719e2b4d32655d2232b29f0fb47e8c8634060d500d4d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686340935, "uuid": "8dcb0328-c06a-4bd1-8f98-3f1e5fb6af6e", "comment": "Malware payload (Mirai)", "value": "9dd843aa1b64007f5b9ab18efa3f367fcb5db6a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686340935, "uuid": "8395a48f-8f20-44ba-aeab-f2f27b7aad70", "comment": "Malware payload (Mirai)", "value": "6543f70330be3ef2a19598772b6d03d48ea7f2df5b49e8b4afa92934adfb0c902a9e2dd7a4eb285e114265f20d7dc26f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686340935, "uuid": "2c25e05e-2b08-4434-922d-b06c0a4598dd", "value": "T178336C36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686340935, "uuid": "d1f668d7-7818-4774-a1ec-46d5112b6218", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686340935, "uuid": "8a4d1361-b95b-4a29-b861-89eb81b31297", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686340935, "uuid": "35428c4e-1681-46cb-a38f-6551251bed9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686340935, "uuid": "d54563ca-cf89-4ee9-b90c-b05ff07c544b", "value": "b8aab20f8eb8063c9fe8d9c0794f56d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "766f1c8b-069f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686299245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299245, "uuid": "1ed1c6b4-16f0-4612-aad1-ec74c3c5cd04", "comment": "Malware payload (GuLoader)", "value": "e5ec306fab21753b94a5df250fedd283", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299245, "uuid": "18a13044-1909-4977-845c-5856cb6f7a33", "comment": "Malware payload (GuLoader)", "value": "a0ea61a961e39a49c0eca608a4e0ae77ffb8dea27ddf012d0e095db6e5eb4ff5", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299245, "uuid": "8b0865fb-69a7-4f48-a917-c5d10d0ea1d0", "comment": "Malware payload (GuLoader)", "value": "cd6ad3aa8cfe655aad8b5a943e3ab731dd89cf27", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299245, "uuid": "26a38fe1-9927-4365-b82c-c01295917a4d", "comment": "Malware payload (GuLoader)", "value": "ed4bdc81d4987e5e4da91d28d3ed935853786b530aded6a747df61b0f11b83cb4c69dd96f8749db2af01a5b83cd2e7e9", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299245, "uuid": "63dc1105-ad39-451a-976c-15c99fee1f00", "value": "T17BF4AFA2F500808FEE25183FF576326C2AA16FED898A76D5135177D70D72A52C38F60B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299245, "uuid": "7c73a6ad-d77b-4791-813a-d966199adea0", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299245, "uuid": "803b3f1e-3259-4455-aac5-d4928ae6f6a3", "value": "12288:dgQ44tKHnuW0dekCitw497wrU7Rkt0p1sYaxV1zlr6M/Qo:d0CKHuW04Yzwwmt0pKYa71ZrR/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686299245, "uuid": "925e4038-5a91-41fc-8bc6-35bb14942819", "value": 769599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686299245, "uuid": "c1276beb-f9e2-4a18-8c2b-a35536ea6929", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299245, "uuid": "6e311d63-55ee-4801-8632-c199f0bad630", "value": "TM001829.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a8d8a35-0690-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686292621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292621, "uuid": "36b51092-c9e1-4c4c-be92-b0e012c46d86", "comment": "Malware payload (SnakeKeylogger)", "value": "5d1005ed68e079a59114d6b35da951c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292621, "uuid": "ec3d7dff-42e5-4c0c-a1af-be0da5027a85", "comment": "Malware payload (SnakeKeylogger)", "value": "a13f6ec50dba141af7c88bb503bcd0bf067b0203716d1dcd7588721285b1ffff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292621, "uuid": "d0881de8-a8fd-4504-9d63-612d380f2576", "comment": "Malware payload (SnakeKeylogger)", "value": "c902dda8b4c475f8e5eeac10e1b64de5697282f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292621, "uuid": "923a1245-19c7-405d-a1f2-3b85729be39f", "comment": "Malware payload (SnakeKeylogger)", "value": "bb91294fca61d1d0d67d45244f28a4e7c12ae9ed88a91e32558719684c46fe42c241b9e518af6b0c1a08896c4301749f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292621, "uuid": "92b4d858-906d-4f50-81a5-7d26d5c9f36e", "value": "T11C258ED5F150889BEC5B0AF1BD2B653014D77E9C64A4410C5AAEBB1B7AF3342209FE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292621, "uuid": "f31d6cdc-7360-4c0b-9cde-3563cb23a7a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292621, "uuid": "317c0c38-b4fe-447e-8795-d812a085d31b", "value": "12288:yXPWR28Le0cY+Yg9fb9XxyyHLpDadQ5E5l9IVRNMDva3XAt6:y/+xL9Rk9BPpCSE5l9ITNMDCXAt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686292621, "uuid": "01c82d78-a550-44f8-9b39-df39b2fca302", "value": 1000960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686292621, "uuid": "d330ad9d-c219-4442-94a9-e8b3aefbe744", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292621, "uuid": "f9c02c20-1188-44a6-bdd1-9857f732e44f", "value": "E-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a644967-06ca-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686317559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686317559, "uuid": "3d7e4aa1-c0c4-4d3b-b952-11cd77443a42", "comment": "Malware payload (AgentTesla)", "value": "3ca3db9d92755b60c970339bbb371b98", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686317559, "uuid": "fe6ba5d2-4c53-4694-a2d2-eb570f490a27", "comment": "Malware payload (AgentTesla)", "value": "a14b8e3a4b6cd4192cc72fb6a338124877a6405dbe9f26671006a3da383ebc01", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686317559, "uuid": "c3d11f5e-430c-462a-a70f-8384a7d10a8e", "comment": "Malware payload (AgentTesla)", "value": "db2bf8568ea49e991bdde068bbed06e4ab364fa4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686317559, "uuid": "3210e508-4eeb-4e6a-8432-a9549bc9b0ab", "comment": "Malware payload (AgentTesla)", "value": "3bbdc40dc8999422c8733176ad898314a4d89cffadbc1174b32b76481fefc7df4084befd715e71ef22639b9ccc8286d9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686317559, "uuid": "597c70f2-8fa1-44ee-b6fd-e7a754761193", "value": "T1B7E4337C8C04B965867B08237C7D64350B48BE59ABDD4441B80F77F2F22AE39493A5BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686317559, "uuid": "e5b885b5-58bc-43c3-b852-6c9f5b7e0547", "value": "12288:hWD3WiMisAU1OChyKyZhcdRXKw5n+kEC63fRoBXmg/W+5L24GNpIPHOj:hYWiMEUBhyvZCRP5n+kQfC2g/WOqVNC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686317559, "uuid": "e59462ad-1d6b-4d47-9d44-693285e92323", "value": 669075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686317559, "uuid": "e006b963-3b81-4942-9fec-427cf50d3d54", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686317559, "uuid": "f62d967c-e2f0-434c-af90-4576f3434514", "value": "Urgent request.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2bbdc15-069f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ModiLoader)", "timestamp": 1686299346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299346, "uuid": "76235c6a-39ac-4542-aecd-4d847b29afba", "comment": "Malware payload (ModiLoader)", "value": "3cd382b533a604380874cda2410b4c5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299346, "uuid": "a238d951-d78c-407f-8764-bdd866ac31ed", "comment": "Malware payload (ModiLoader)", "value": "a2df3dd9576de002a3731478b143e267c97155ef6ea939f1947dacbd48564cf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299346, "uuid": "efd4da1c-1e1c-42ee-a80d-f5106078f136", "comment": "Malware payload (ModiLoader)", "value": "cbe9d27dbc97584baeff54ff14b467b7f9030c64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299346, "uuid": "70861cf9-6158-44a7-80d0-8226aa91bea4", "comment": "Malware payload (ModiLoader)", "value": "94ba26718569582728e84585488125286da25ea667824e64f81f583d658953cc4590f42ee62ce8bcce10dbc28da92765", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299346, "uuid": "dc47213e-f97e-44ca-9114-6bf4b55b43d7", "value": "T17315D026F6A11833CA6A1776985F72709839BD041B1C9C7D5AE4BE0C6F7824CB8712F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299346, "uuid": "aa90f534-5510-43be-ae4a-a5027038e01e", "value": "56b9ee34a3c873bea4afe3c0ca147de8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299346, "uuid": "33cc359b-3b10-4d06-b5d3-960251d09892", "value": "12288:l/AeU0+lRGAb9ROvbNuMmUn/LR4q8M+nqwtv07f1O9noM5:lIBljROVrn9J8M+nqwh07I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686299346, "uuid": "fdd93559-1e40-4d76-afd5-af716534ce16", "value": 926208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686299346, "uuid": "2ba68002-0477-4fe3-b1a4-e52ad7a23877", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299346, "uuid": "51dea59b-2613-4864-8348-e7145952ce61", "value": "Sfazqilduugtht.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb8bd0f-06d3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686321428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686321428, "uuid": "ff9e1fd7-e0ef-4d02-8cf4-438054ee6d10", "comment": "Malware payload (AgentTesla)", "value": "47e741dd4805ffd50f5b18a89ddbf667", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686321428, "uuid": "a1fa7c2e-3e5a-4a81-814a-ffb5ef4083df", "comment": "Malware payload (AgentTesla)", "value": "a34d64d2dc1a0f3bb6ffa8f44882eea76f3ae20f493f546008679dd1ba8736fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686321428, "uuid": "a477d04d-5471-4f2a-910d-dce134de8a19", "comment": "Malware payload (AgentTesla)", "value": "126522aede0f8a685fbe7ce7f975744c46ac058d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686321428, "uuid": "8bafdff8-a2a1-4969-b1b2-b62a3076d0a9", "comment": "Malware payload (AgentTesla)", "value": "2b43ae65bdbde6725c0b32d7528d541d9abeac5235823a7d8e17fb3d8f51bbdf2b55e505a7217efda5b09e701b48119b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686321428, "uuid": "22b34969-8c22-440b-9311-371bf50a264b", "value": "T10605121D17FB420DD85A3FBD0D101671D3FA9A56707BC60B8FDBA8A8EF27B244590682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686321428, "uuid": "cf3ed686-38d4-49a1-8ea4-72ee2401d99a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686321428, "uuid": "03b91e7c-cceb-43be-a6fb-99d438b95b0f", "value": "12288:dNECB8fTkRVdiRobaFErwRgxIE5so7pa4KGwdqA0KGIU1nSeYZV7HV7hluJ48KE:40biRoSErVxIE577pajb0KG/SeIslK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686321428, "uuid": "d446db7e-d9d8-4aef-9bbd-097c64714da3", "value": 809984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686321428, "uuid": "934c6bb4-d6bd-43eb-ae6c-5647e0188e89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686321428, "uuid": "1b5cf083-0e90-4c03-bebf-84da637214ad", "value": "SecuriteInfo.com.Trojan.Siggen20.61320.429.3015", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7976d62-069d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686298495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298495, "uuid": "7ff99d9e-89d0-4874-a88e-2318a0e5f1c1", "comment": "Malware payload (Formbook)", "value": "83735591195b877481eda11e9d9952e2", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298495, "uuid": "1db3c36f-1f08-41da-ad08-3310b0340b90", "comment": "Malware payload (Formbook)", "value": "a4d20b334ed6ca9107b7dcb397bb8411bf13b6fa0021305a358415f8ffe83015", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298495, "uuid": "7299b7d9-377e-4a45-97d3-a0d76cb169ab", "comment": "Malware payload (Formbook)", "value": "4adec56eab19f97405b7f5aef43640e750494c5e", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298495, "uuid": "5140584f-516d-4b28-a9dc-ba551bb12f93", "comment": "Malware payload (Formbook)", "value": "f37ce05efca6d18f3ee5887e8d6563aa96f011effdcf677f432e044a88e1e016e331d90cd6f1b39788b62945a33866f7", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686298495, "uuid": "e44113c4-06e9-4488-948d-931431673c9a", "value": "T1B422BFD11BE14DADD4B2403090A24E3623167EE08D696823E691B2FEC7C69A3664E1F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686298495, "uuid": "fac4eae1-0d56-4fc8-b1b3-0b1af301c919", "value": "192:2IKwrHrrqMi5uC9Xcpmga9pWkq1KJ41d6ABIf:myH/qMoBcpa9pWzz1ju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686298495, "uuid": "b29401de-e99f-41b0-b493-8cc57bafccc5", "value": 10145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686298495, "uuid": "ae0c3d39-ec2a-4fb4-9196-09fd84a6ef25", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686298495, "uuid": "3753ad6b-f384-44eb-8e64-f89f39b96de3", "value": "06062023_648.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d0a470-06c6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686315855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686315855, "uuid": "52519a9b-8fe4-401f-b342-bbddcc47ea13", "comment": "Malware payload (Formbook)", "value": "90c945b94c8009ea59df1297db8d5109", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686315855, "uuid": "a0de554b-5b15-4c7f-aab6-a74addd262a5", "comment": "Malware payload (Formbook)", "value": "a7a67f0d8860da70cc96c8b72df93811f872175a4aa94230fa583ce2368f79b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686315855, "uuid": "99e6d28d-d2cf-4634-8c55-1a85ac56b034", "comment": "Malware payload (Formbook)", "value": "98fed5f6fd694523fda30db36d7ab0b772d8d249", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686315855, "uuid": "f3aa2af8-164f-44e0-b630-f3cbc1bded79", "comment": "Malware payload (Formbook)", "value": "93b2ab3fb65b7de48459a53bc26ec993edae745332c3e3027be776c936bb29b366d2f61b81ecd616c9961cafa47cd4e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686315855, "uuid": "a4260398-62d4-45f9-9271-bf3657f72b4c", "value": "T1C7A48C27A4DCEACBD4AC44761C2DF32D7125AC2584328C16BD8AF84D95F16526AF3B3C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686315855, "uuid": "66e3175e-95da-4cff-a5ce-ab03aa6553f4", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686315855, "uuid": "4ea580ba-7cbe-4d64-abd9-845d48d6a013", "value": "6144:OYa67yrc7o9gJ1nlshx+GbxCmVKduVlNxrlM8/P+ayMHZY2PRl:OYAwga1lsT+Gh8uhxrlx/P+XCfZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686315855, "uuid": "cb076281-4844-469c-84fe-0002245dadf9", "value": 478480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686315855, "uuid": "5dd5061f-d4a8-4871-a281-9aa309dbef1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686315855, "uuid": "591a0f32-3d1a-48d7-8e7a-0175707d872e", "value": "10133266447.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca78758c-06a9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686303681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303681, "uuid": "e2bab62d-7230-4b4c-833f-faa75e579db9", "comment": "Malware payload (AgentTesla)", "value": "b62a1feeabf595bd2caaa1ddcc6f78c0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303681, "uuid": "88154afb-ce63-4f3b-a4e1-057bd7a80768", "comment": "Malware payload (AgentTesla)", "value": "a7b9b1c09be1de07f1822163a243c2052dc5b6c5279bc3b34cda143cd6a7cf6c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303681, "uuid": "73ba0284-a456-40a3-9ed1-89dc4023d1e3", "comment": "Malware payload (AgentTesla)", "value": "39371f833f622ba0305945106658d430df3e3b9d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303681, "uuid": "3351da40-d70c-4e31-b161-0048ea124722", "comment": "Malware payload (AgentTesla)", "value": "9dfe1fb6740ec12293d52a93154fc774776c0d70d8cb3a690e8b536a32065663a9567d5a5f3003b56aadcce6f95171e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303681, "uuid": "519f988e-fb31-4676-a688-8ed90c1a85f4", "value": "T156E4334AAA5F4DEAA0E1C5E697C5C7284F1CB0F0F57AE0732233C7C468C916C7B6A095", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303681, "uuid": "d155f97c-7825-4233-84d1-9da6de609ea8", "value": "12288:jCLuvDx1YqUiqEIr1A+DLRUKKr7LgEV9bAtSHIllpQYMmsIBkvL3Rq:YuvVbUbr1b2TvCSHI5MUBkvbRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686303681, "uuid": "66992c84-fd16-4ec0-9c59-846c86b16d0f", "value": 666739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686303681, "uuid": "57ba61be-494f-4946-9285-c01fee5f2c69", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303681, "uuid": "17e03b36-2605-4356-9ed5-7cf94e9ea670", "value": "CREDITED PAY SLIP.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c33af00-06c8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686316756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686316756, "uuid": "6d5d0b10-d627-4779-b257-a8a844d39146", "comment": "Malware payload (AgentTesla)", "value": "dd329b3815943cb003f5b91d1a68a036", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686316756, "uuid": "28603d6c-877e-486a-8dd0-69198ef85e83", "comment": "Malware payload (AgentTesla)", "value": "a83423d3a684c1defbb7b445d0594e8074f803fbb4b170a3450e3879aa619886", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686316756, "uuid": "0894f493-40bb-4c74-94b1-d28aceb18d09", "comment": "Malware payload (AgentTesla)", "value": "4efc8b61727d0831036df2222fd7610d45918032", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686316756, "uuid": "74abeb1c-ac8a-4f23-ae29-7b82e9817239", "comment": "Malware payload (AgentTesla)", "value": "5c8395bc4d81ef960c4fe4406736613b4029473719334b3b364a2484077c154039e1c5138375aef402b667247b0e5066", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686316756, "uuid": "8c91453d-6766-487f-a48e-5aed03f8d412", "value": "T1A0F4016C1EA6845ECC823B7CCD303BB5D2E95D957173C24B9FA3B9589F37A0C0981692", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686316756, "uuid": "284c8fb5-b99c-4783-be88-1773bcac8aa0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686316756, "uuid": "2a0a0e80-dc0d-4761-b960-d4161a7a9ab0", "value": "12288:hNPWR28Le0cY+Yg9fb9XqYCUvCAzJJUo3h3YRa+AzCBFYfx:h5+xL9Rk9UUvCAh3h3bxx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686316756, "uuid": "1b414068-5e28-4a58-8276-3207317e3bb6", "value": 763904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686316756, "uuid": "7df9f4da-a63e-49bc-bccc-51f87606f0e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686316756, "uuid": "77cdea7e-c711-4a6b-be4a-db8385213a85", "value": "41570002689_20230609_05352297_HesapOzeti.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c73b8aa1-06c7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686316560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686316560, "uuid": "12cae555-3623-4369-bc1e-067bdb954487", "comment": "Malware payload (Formbook)", "value": "92a3eb7b0e4b72d2a281e5f48be97784", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686316560, "uuid": "0a95c66d-00c4-451e-bdde-b4a18700dfc1", "comment": "Malware payload (Formbook)", "value": "a90041c572a519d2de1a6ccfc5e527a5cd5935b58f362fe6eb0715c4354a9b8d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686316560, "uuid": "f85cc369-2976-4ffe-93da-26fcf6e90ab3", "comment": "Malware payload (Formbook)", "value": "84f42d39b978f4c1cea084c596490f84e497d8c4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686316560, "uuid": "5ea8ff82-987e-43df-8146-157c0316e1b9", "comment": "Malware payload (Formbook)", "value": "3c2769d43634bfec774a3d55bd1d53f6e3a0ab675d34b0b846958826e6774137a02e1c518d2bea1a9c592e769693e6d5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686316560, "uuid": "e8afc0b3-a6fa-46a4-a8a0-685d7f5c720d", "value": "T11AD4230ED526C744B9517E2B27BA105ABFD5D35A2BF3641660F32402E7233EBE93B900", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686316560, "uuid": "176bc098-283f-4cd9-8abe-e69b35575736", "value": "12288:erF/AY7H6s5w5KxT+HeTZ5J8xaSiJ1qTMm7CJxBwhY9ilntXa:eFH6s5w5KxC+TZ5HSiJ16OnGailntXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686316560, "uuid": "ae65e1a6-31ff-4eff-bb39-65f545e4de21", "value": 615188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686316560, "uuid": "947c175b-a117-4a70-8043-7559c11a34de", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686316560, "uuid": "98fddbbe-1a8d-481e-9223-ce43775d4379", "value": "OUR REF RFQ 600066536 - PR 10023150.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a2e990a-06a3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1686300808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686300808, "uuid": "0ce13e08-ba5b-4751-9bec-44e5555bbfa6", "comment": "Malware payload (Smoke Loader)", "value": "5206b4f1cbecc1257f755163111a4929", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686300808, "uuid": "ed7c72e4-bf62-4805-a67a-4f3bb53c8814", "comment": "Malware payload (Smoke Loader)", "value": "a9d1c36b151cbd42b112cfb10ec35fa05174f40a89876d2e66f1e9abf011af61", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686300808, "uuid": "76ecf058-3e6d-4c65-84d1-41e9e424a85f", "comment": "Malware payload (Smoke Loader)", "value": "697ea8de5769259d7ef84a229e42da0909cc2765", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686300808, "uuid": "d3a55657-32e2-4f21-977b-4718276c1dc0", "comment": "Malware payload (Smoke Loader)", "value": "a203ac8e53c0723c6cd87e49a635fef9172481556d9c088072defe4118e22d8b4ff199a9de09dced5a6cd6bbad09f971", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686300808, "uuid": "2e2c5395-7cc7-4533-8bb3-03258ddbd2f5", "value": "T11154F80392A17D55E9255B338E2ECEE9364DFA508E0D3B652A18AE1F24B1271C173F1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686300808, "uuid": "b49c2608-13f9-4596-911d-69b0dd27f63f", "value": "078c527316e58c8f8358ebd022c4bbdf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686300808, "uuid": "6c1e66b5-8527-4864-9822-db7a4778a21f", "value": "3072:YWdXkpZZ++/cLn31GY0sPKvQq2NEgK88F7tD74Ir/Uv7mRR:5Xkc+/cLn3VCvj2XK8I4sl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686300808, "uuid": "29ccd9eb-d78f-437d-b878-bcacaa049448", "value": 283136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686300808, "uuid": "65ec648a-9f40-4318-8544-dc107a7c6116", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686300808, "uuid": "dfa42410-e0cb-4d16-ad4e-cee89c54e767", "value": "5206b4f1cbecc1257f755163111a4929", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22a226b8-06a0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686299534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299534, "uuid": "c5f57e0e-18be-4dd3-a2e6-ecee40796d9c", "comment": "Malware payload", "value": "f9c8708a5b2611621ab6cf0cd328e2cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299534, "uuid": "e53700bc-c0dc-486e-b0c8-74688dbd7a0b", "comment": "Malware payload", "value": "a9ee6fc7da3d25c684750925c454726aeedf3a8335d0976b423f3e514d8874d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299534, "uuid": "d755844f-4268-4b22-8284-48de172587a7", "comment": "Malware payload", "value": "03592a6e5b938a6996bfae58207a37f565ac0fd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299534, "uuid": "21f240de-3900-4e56-ac18-be3505d5b4fb", "comment": "Malware payload", "value": "e75e0ea746787af1f9742fc0ef378e6127aabe6d70007f466beaa01d24435c3c21e7427447e87242bf05d5297afa36cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299534, "uuid": "f1ffa4b0-0a13-4598-8419-94141adc1273", "value": "T1B705122972BB4A0AC97B7FBE0D410675C2EC481AB027D1574FABBDC5CE20B1149E48B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299534, "uuid": "b049dc42-3957-432b-8564-b2ac9f9dc55e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299534, "uuid": "fd22f8a1-47dc-4fc9-9303-a519d4c5e6d3", "value": "24576:M1iewlqB6pEFF6Uky+KD7yN0PZrYxAyHi/T5v:MQe2q8pERleSPZeAyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686299534, "uuid": "3f79262e-55e1-4eb6-b15b-1943655abae4", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686299534, "uuid": "f54f19be-a200-4c24-8c9e-8e8f6f708f2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299534, "uuid": "a830a7c3-7467-4ba1-9774-52d802de2f24", "value": "Bg1GBv9s8vMLPhO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b7f6935-06cd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686319037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686319037, "uuid": "fb0d6a4e-f7be-43e5-8361-2a3f98e31f01", "comment": "Malware payload (AgentTesla)", "value": "d7a5e4465efb248ab4e9518c2320e2c3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686319037, "uuid": "63bb46aa-4991-4007-8b5e-9c81ca48c845", "comment": "Malware payload (AgentTesla)", "value": "ab55ab33808d211473c343f235e8e8846feb5537461d4d32ce1ec065d8bfda28", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686319037, "uuid": "b30f1dad-1c7f-45df-b09c-9044336c3aea", "comment": "Malware payload (AgentTesla)", "value": "e836f7bc751379fcf6478f25e1795d1ef6e78c56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686319037, "uuid": "aa0ece40-323f-4252-a3bd-3acc03dacb92", "comment": "Malware payload (AgentTesla)", "value": "c27e965a53da846d5d11f05564be6b0b68478dcd6ccff54e8e023c38ff3b2369bf56288ee868da6857e882f41b2d097e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686319037, "uuid": "03553798-72cd-415b-bac5-ca4f581908b9", "value": "T1B9F402AD17B3486ECC433FBD9C202AB6E1E9568A7567D6438FA7FD5DDC01A480D812E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686319037, "uuid": "d933663c-fdf8-4869-9792-3ba18c9d2228", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686319037, "uuid": "3e290072-56da-4248-8f3e-1904858a6556", "value": "12288:hToPWR28Le0cY+Yg9fb9Yed5spHHYuQzxerxFpxh1nVLicYLTCIfvpok+k1:hTU+xL9Rk9ye2HHYuLrDpxVFYLuOZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686319037, "uuid": "db9f9190-bb54-4730-a450-de81c4402460", "value": 749056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686319037, "uuid": "2a5e5ddb-06ef-438b-8509-7fe131020f6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686319037, "uuid": "db1ca888-96ba-46e3-b631-28b0cc7e9a1a", "value": "SecuriteInfo.com.Trojan.PackedNET.2032.26765.13282", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fed28967-069b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686297755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297755, "uuid": "710a11e1-77bd-4639-9730-92db66706508", "comment": "Malware payload (AgentTesla)", "value": "56cc7f08650f31f8611a141abb7810d6", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297755, "uuid": "847f44d7-7a83-4cf4-b637-be227feba535", "comment": "Malware payload (AgentTesla)", "value": "ab5a8fba6fdd7d5eedde07bcb24b7a0d4daa597dc9d92fe8768f432ae5e288f6", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297755, "uuid": "8a69b2ec-9172-458a-908b-6da9e8ddfe32", "comment": "Malware payload (AgentTesla)", "value": "71c7122a1aabb8816a34fd84b4402c1c5813b523", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297755, "uuid": "8bea1979-d74b-4e16-a7e4-1fac1c40922e", "comment": "Malware payload (AgentTesla)", "value": "eeda310dcfd11479ce52b96e304a4b138c20cb9a8ffb939ac513c0c2cf74bedf82ac7018deba427e90ab7ebdadb98d4c", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297755, "uuid": "51f43330-076d-4d82-91e2-a3503ad6aff5", "value": "T188D4231F6062EF34A1508BD51E41B298FF92496A69C389F7B0B74F0A3579927CBC9C70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297755, "uuid": "11d10146-7bd1-49fe-9ae6-1891b38096b6", "value": "12288:hiFcZkvg7nTI/oI5vymGOi8ixHcLFvjO6voab:hmSE/oItfudxHcL1O6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686297755, "uuid": "8576487e-111d-407b-9f44-a5eabdb6ef0f", "value": 615467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686297755, "uuid": "03f3d753-a7b1-4c85-aec9-1bf3b6fd7dd5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297755, "uuid": "262977a4-0027-4ee4-abda-0b914993d1d8", "value": "payment copy#0067843.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d1105a6-0660-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1686272117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686272117, "uuid": "d046065f-5e51-44a3-abcb-e36721d7ef1b", "comment": "Malware payload (Stop)", "value": "e4d67880e0d725e892c0b2778f5ccc73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686272117, "uuid": "dfb25594-a69d-4068-ba8b-e17aca68b92d", "comment": "Malware payload (Stop)", "value": "abdb2681d31f1a42e43813672f22a00a022614c9a4eb00df29f67df169432fbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686272117, "uuid": "c4b94e41-a415-41af-a7b6-0f958b8001c0", "comment": "Malware payload (Stop)", "value": "4dbeaff3708abb6fef880b13a9128d8e517a6742", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686272117, "uuid": "7d47f06c-2439-4a79-9bb1-e9fd28713eb1", "comment": "Malware payload (Stop)", "value": "9800014bb6a053439bdaf16b46c7094e256fc8557c04fc3375da2e441dd765c0780db96b0d3f441aa9ed80235c94ac7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686272117, "uuid": "cde00287-9adc-4678-9b96-ea0db1aac86a", "value": "T1CC05C003A3913D55E9255B338E1ECEE9764DFAA08E0D3BA56918AE1F14B0271C173F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686272117, "uuid": "205fa161-6d61-40bc-a1a3-a123d4bb171d", "value": "28bd912f7320c21b56564a89f943899d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686272117, "uuid": "993bfb0c-fc2c-4e71-8c6c-2b745a238190", "value": "12288:Zf/ZHp12D99XMmyjai87C2yJx/taU3jL/c58b+lKfeTlig6nb1sHh:ZfFpA9XMm2CyRaUfss+laeTsG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686272117, "uuid": "e62eeaa4-b574-4593-891d-c18dab325a7b", "value": 811008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686272117, "uuid": "ae2f0ba6-80ee-452b-bc6f-d3fa3a2ff5bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686272117, "uuid": "50f73311-02e2-4f78-baca-180a6e6e289b", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f08daf53-0696-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686295584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686295584, "uuid": "64e75f1e-6d54-4f7d-aad7-cffc729b6ee1", "comment": "Malware payload", "value": "d3338367eb25f2a9a9bb8cb99e5faaa3", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686295584, "uuid": "09438b5c-efe7-4d2a-a317-a98eaa7de46b", "comment": "Malware payload", "value": "acd36f7e896e3e3806114d397240bd7431fcef9d7f0b268a4e889161e51d802b", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686295584, "uuid": "43316204-f173-4671-8942-6ac06b222a94", "comment": "Malware payload", "value": "ac7b91f4f77b76de1b50751811310e9241ebaf9d", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686295584, "uuid": "8e151fa8-5d84-4f9e-abdd-ab0a1e25d69d", "comment": "Malware payload", "value": "0fb84a2fdb61e5a0505faa8281fe51c471422195cf83c2a784c01de609fdcb31262f525cd08017eb949d54965c27fccb", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686295584, "uuid": "28b4b6e6-7f25-42eb-b761-10b2b4861f33", "value": "T14D451243FF4299EAD7F74639893E85A9242BDE351E5382D35E00B23C947BBE053D5888", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686295584, "uuid": "eb30a5ba-e903-43e9-89d1-2b9e6f1b99da", "value": "24576:BHT3SF7SpjXiEXh1bkTZlXBYnEmLUnJGNn:5TCFujXiI3bivX2vqJo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686295584, "uuid": "07a03a9a-45b4-4b0e-ac86-7d26cea76651", "value": 1269940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686295584, "uuid": "fa9f77e9-5881-4337-8489-ea519f04e6cd", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686295584, "uuid": "814061b1-db3b-43ab-9fe1-a9953f9ece89", "value": "\u6771\u4eac\u6c34\u9053\u5c40.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14ec7cb0-0698-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686296075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296075, "uuid": "210d0372-e299-44cd-b8ab-4b1f3b076b90", "comment": "Malware payload (AgentTesla)", "value": "331bc06d67e4078e0779a9a0a5d355b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296075, "uuid": "df40790d-8fae-45f1-ba98-ad3b7bba8d0c", "comment": "Malware payload (AgentTesla)", "value": "ad641230d3be8895193642d333ed88e1d6e94c209dfcb6c1932cd6a7f324a82f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296075, "uuid": "3124efa0-4958-4023-a774-762c28867b94", "comment": "Malware payload (AgentTesla)", "value": "475924a69dee5e4a4ab1a66c944068fa2111db68", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296075, "uuid": "6423b793-d8c7-4231-86b6-40450c261a0e", "comment": "Malware payload (AgentTesla)", "value": "3d6465ee8122e70871789f5a43c78277dea6edb7506a9965d50e5a6f04c70261ec536878a1897cf4ba510ffe8cace6c2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296075, "uuid": "1df5e52b-e976-4679-ad9f-e90c7664fea4", "value": "T186F4129C26F7421ED59E3FBC0C404976C3E96A407833D1675FA3A9CDCE26F200D959AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296075, "uuid": "ab8351f0-2fcb-4f67-8944-ccb93a7d03bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296075, "uuid": "5eb5f605-a103-4612-ba96-bf2102051cb9", "value": "12288:sk+J/M+Jhewx/NscEQ+vgXK1HsaPbntTjlFhush1nPTs8HlaxYvR1toDvll2Hvk/:sl/thewlqB6pGjlfusbrs8UYvREblivu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686296075, "uuid": "af9e945b-c101-4b54-9978-0b5985fbef74", "value": 740864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686296075, "uuid": "e5dab067-41fd-4fd1-b8cc-70207109dfc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296075, "uuid": "2886bb16-4eba-47a7-aced-59b1d13fdb58", "value": "804152064.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c07a1f9e-06b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (LgoogLoader)", "timestamp": 1686310106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310106, "uuid": "3403c370-c891-4b33-ae5a-e8ca57240e36", "comment": "Malware payload (LgoogLoader)", "value": "9d846bb9fbd2e4ce0a2344b02d535e9c", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310106, "uuid": "05a48af3-f37a-40bc-b24b-8bf00dcf6a9c", "comment": "Malware payload (LgoogLoader)", "value": "ad6dd2baa672f859b2da3916317449966604627dbf0991f2872db0f7c8b9ae07", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310106, "uuid": "23dbc655-22e1-49f7-9d44-77a19a74ba67", "comment": "Malware payload (LgoogLoader)", "value": "91bb1d20302d740b733d155bd42556038b900380", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310106, "uuid": "b35cb206-199d-43cc-8483-0b5b434a356a", "comment": "Malware payload (LgoogLoader)", "value": "71a4f27bd1d94d894949f3249e93c8d04d7b39f25478c8d16ecda83d815db07f18c1371e9556b6efd7283fe663ef77fb", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310106, "uuid": "16a9127b-78c1-4210-90a1-a12972b159ef", "value": "T186337D0237A84B52C5FE123554B2018063BABB7B9B17C3493DDB10DFA9F27A68705B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310106, "uuid": "497b6246-7a79-4eb1-b9a0-8d1c9193c267", "value": "768:7eX7e/XWwa+6NMLh2J84nhRDsMx1zO1fu8iSUKWay0CE5qb4rafuPg:iS/XWwP6NkohRoE1zOFoKWarefuPg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686310106, "uuid": "19c9c0d1-673e-4fee-bf09-5058a071e7c1", "value": 51200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686310106, "uuid": "45db9a82-9d55-46b0-aadd-3c38d507791d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310106, "uuid": "bcca8e2c-3a88-40c8-8e6b-39018d59d7f0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "233e495e-069b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686297387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297387, "uuid": "2a819169-b436-4df5-a7ca-2f2fbfce98a4", "comment": "Malware payload (AgentTesla)", "value": "b122f1bbb74348538b6b29c4da2a73b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297387, "uuid": "141a8b49-d0db-4e00-8096-5cb9a7afed1a", "comment": "Malware payload (AgentTesla)", "value": "ae1d10a430aed6814f985efb49cca0a27402e8c32653a7864a48b706c4f9a03b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297387, "uuid": "fe3ce16c-6dfb-40af-a1f4-c77513e169d1", "comment": "Malware payload (AgentTesla)", "value": "ed1db755cf08229f981fb828b01ddf9c0986b594", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297387, "uuid": "10a9b57b-6a29-4a2b-9a08-7c5cf7f1d745", "comment": "Malware payload (AgentTesla)", "value": "2177e203d191f37e02b00cf7e02ff561a2842214598b30ac8c2bbc9c04d0dc392f821710775b0c41d42ef391be632dd4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297387, "uuid": "c5aff068-fbfe-463c-a886-3cc2965da5f2", "value": "T1A02593790D4266DBD1BF932A90EC1D1BFBA1B846FE56F94C78C2038B31A264E76D510C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297387, "uuid": "c9d003c1-77a4-4a32-905d-3ecf350d1459", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297387, "uuid": "3c86bece-4a2b-4656-90ea-74546a2cf22b", "value": "12288:KGF2GwMwr+YL7zatRUzlH0lR9xrpZo/GgxnPLBKcXgHTHybk:KRGpnUzlm9pZozRPocwzH0k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686297387, "uuid": "abdd1e6e-7c58-4d71-8567-5e7ad2b83f45", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686297387, "uuid": "17bc272e-4f57-47d0-ab21-9fb722b0f5c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297387, "uuid": "6e16f659-84e9-4b56-b11b-7a382e58d3f0", "value": "Shipping document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5b57bcd-068f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686292559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292559, "uuid": "aaf07b61-90fd-407c-bced-6c5c439e7acf", "comment": "Malware payload (Formbook)", "value": "13804e924b84b833164bd4d5807f660f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292559, "uuid": "ed1488bf-7152-46b8-8390-8110b695ab5c", "comment": "Malware payload (Formbook)", "value": "ae617e932d45d1288f1ef5ecd2b72b2da822d8167142d041b08f61defb59daf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292559, "uuid": "cca08d8f-8627-4fb8-94fb-a693886488d2", "comment": "Malware payload (Formbook)", "value": "322990c1a2c7b269169acf8238ec2710f756c984", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292559, "uuid": "59fba245-e337-460a-8099-7969f53406af", "comment": "Malware payload (Formbook)", "value": "5c15c5434563be959a03863623a375f61e746ecdb4e7ffbb7057b0f37f43165c0f5cd2d6df731b6878d0ba82f6a2db2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292559, "uuid": "2a2a90f3-91c8-4ef2-9894-6b8b684e0075", "value": "T1BD441254BB95C4D7E9E34330293DAB711EFA982600E28B1BA3006F0EF976652DD1E357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292559, "uuid": "61ec372c-3890-4a1d-9dca-026cd5bd5611", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292559, "uuid": "6234d4e6-5abd-49f4-9ba5-df842f931589", "value": "6144:vYa6R7d9kr3AMSfRQqZsBATEMTBW06yGvBx+zUJ:vYDQ3pSf2ATXmNvH+zW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686292559, "uuid": "33e71cf8-d778-459f-81c1-eae6067183e7", "value": 259465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686292559, "uuid": "d10279fe-f230-4e2d-9ad0-b9e2de629041", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292559, "uuid": "24079af1-c04d-427f-ba7b-9f623cede564", "value": "EKSTRE 06.08.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f45c315d-06a4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686301603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301603, "uuid": "13ba7f4d-2bab-4da1-9d55-09b435317fb3", "comment": "Malware payload (RedLineStealer)", "value": "9189a5b029e681245e8f98a196d76958", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301603, "uuid": "3fa2ba14-cd17-4ebe-b1c3-be3bd9543e6f", "comment": "Malware payload (RedLineStealer)", "value": "ae70f5ce813c1f6ccb01aaeb8c515f2f0acf158f3cb9b2468180962726d8a8d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301603, "uuid": "b94f711b-356f-417e-b8dc-fda656ab4e74", "comment": "Malware payload (RedLineStealer)", "value": "944975bb50059e3160cfc618b0efdce655923156", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301603, "uuid": "93c30a10-298e-46e7-b6ee-56152534425f", "comment": "Malware payload (RedLineStealer)", "value": "c874bfb2cd4e3bf66afe52014a6c080c38a61fc5f7337f5ff936baaf20b809112e8f666394c4aac821753a120efaf31c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301603, "uuid": "c4f3b8bb-aedf-4374-a19e-e4c0b6d92f80", "value": "T16376237977C2829DC196D8FD3220A37D85B8CD26D0DB9957935EF86AEE3E9400C072E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301603, "uuid": "2302d08c-28f2-4b57-9a88-4af551d88bc3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301603, "uuid": "ea9ebb49-a9f2-4b9a-9920-779b323da06f", "value": "196608:TxyLck5lKK54lp9QlHHP8xOnnozWYvsw0:TxA5s/7QJHP8Unatvsw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686301603, "uuid": "be8e2595-a087-466a-8907-1c6979b18c33", "value": 7502336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686301603, "uuid": "44c5a836-5107-433d-baa7-3d810eee1b8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301603, "uuid": "8ff2ce30-4543-4d6d-bf29-ed2fce0e63d2", "value": "9189a5b029e681245e8f98a196d76958", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ebd158-0693-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686293977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293977, "uuid": "4d997f7d-6e5d-406c-afdb-36944a855bd2", "comment": "Malware payload (Formbook)", "value": "6fbe439f481ba752b9f5abd27574cf92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293977, "uuid": "5f879798-cb33-441f-82da-7f779be59e37", "comment": "Malware payload (Formbook)", "value": "aeb067d24c4d47d1b44a570a101660d96398f52593085544581dfecdec4da526", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293977, "uuid": "99463eec-dba9-440f-b92e-f828f7be8446", "comment": "Malware payload (Formbook)", "value": "cb07ee411553c7d89df8efb148ff734268271568", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293977, "uuid": "d645f1ae-ea18-4cda-ac62-7409a0bac9df", "comment": "Malware payload (Formbook)", "value": "21514e2bc3419d2b06235dbcc14673e186eaa3391914eb632ac9e9d6f0b25c3da70f2299bf409c51d1369e0d32cfca20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293977, "uuid": "d4467e8c-3746-4fe4-8ae8-4c2f116fa3e0", "value": "T1E3F4124877F7850ED19B3FFD281011B0C6F96D963427D38B5EAB78AE9C91F400A81A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293977, "uuid": "20bf7917-1cd3-47cc-bd3e-b2307e87a274", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293977, "uuid": "b09b71f6-86e6-48a8-b9f6-e13e96ef28e3", "value": "12288:rujas/16/YHmM9mARLAV+/3ZEVv1fhh+4Jx2U95XoSMW8G1ecsc/TvJXfqdpdTJ6:r7s6cV9mA9ImJEHZh+4JHX9MW8utsgvj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293977, "uuid": "51d6b64a-4733-4e76-9676-8d7eaa01ee13", "value": 783360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293977, "uuid": "2814d8f7-b87f-4ce8-ad57-cdecd55a162a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293977, "uuid": "4bfec989-58be-476c-9c67-02852bb075a7", "value": "DTuSR9lv1VhTo7L.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c394db5f-06aa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686304099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686304099, "uuid": "5769407c-df8d-4b5a-9267-6d3952bb4823", "comment": "Malware payload (AgentTesla)", "value": "b0345c7cea14f038d6a0ccb8aed2c8fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686304099, "uuid": "86a55074-db25-44b5-9fc4-2dbde4ca713e", "comment": "Malware payload (AgentTesla)", "value": "aebd9abedf05d17f9fd3c7e3f5d35401ab52148f00b81e067f4688f84ed659f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686304099, "uuid": "8b98c848-a9a2-4346-bf82-26196e7f8206", "comment": "Malware payload (AgentTesla)", "value": "2aa16b9af23275e0c7dd4c0a43639c18e2573f21", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686304099, "uuid": "cf9dd761-5ef6-4719-86ac-275224278154", "comment": "Malware payload (AgentTesla)", "value": "0ecc582c632ea0158dde237a06c428eee378ed940f5ce45b2f5f651fd8b83607b1b40d91a40dc9f5990432c483f54160", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686304099, "uuid": "4f32acdd-b2c7-496a-ae0e-23ee961f5ce5", "value": "T18205E18863FAAF1BC0BA5BF90850147083F5495B313FD69B4DD2B8DEAE64F450A40E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686304099, "uuid": "5c3c9f98-d828-4fcb-9835-4cf53c1f09b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686304099, "uuid": "b41cac98-e992-4d8c-86a1-a4c4529d3286", "value": "24576:MUlRubOyqGUL8foEZRBcowPqxprgyRKFgTolj864Up:MUlRubNqGo8foEZgoLCC2gcljlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686304099, "uuid": "95c067c0-91a6-4385-9b72-15b2eb255c43", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686304099, "uuid": "3edf1319-a87d-47be-bfd8-90ef948af460", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686304099, "uuid": "4bb5984e-b4f3-461b-92b2-fbdb0a6d929f", "value": "uUlJW7EMNeoqXj1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b17aa549-06b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1686310081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310081, "uuid": "210a5df0-d2a8-4617-99d6-709321c71704", "comment": "Malware payload (AveMariaRAT)", "value": "0a4f85cf4998d6ef59e135a36f0f0045", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310081, "uuid": "ede4bd59-d3e7-4b7c-997c-95046f3ad26e", "comment": "Malware payload (AveMariaRAT)", "value": "af2c70c1898d6c26e7c6b1de3b522fac248e11eb9889230c52fa385c8a2fd3db", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310081, "uuid": "d6d3ad88-c403-4164-b2a9-eec9637d2443", "comment": "Malware payload (AveMariaRAT)", "value": "0ab91147cb53cdfa293641c4c43fcaa61c26ad81", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310081, "uuid": "975df0f9-a3c8-42a7-bb09-97abe547a8ef", "comment": "Malware payload (AveMariaRAT)", "value": "cb3d3d8d110d0e8dab164bfc4adcc184babc97bcab4b96f2617b07943a4432282bd6a837e1ea7b9c5e6dac547041df1a", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310081, "uuid": "773b1032-453b-46fe-875e-44f1693ef31b", "value": "T153E37D227BE54039F7B705701AF93E25D7ACBE310E31CA4B5BD4488B58B1589E9363A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310081, "uuid": "51f70a1b-7d00-46d1-8562-a58a04bc9ffa", "value": "0145d2c473bdbcd7b46a054bd6893ec4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310081, "uuid": "eeaaf4b1-4709-4a69-a0bc-4cc46bcdedbc", "value": "3072:2k4aHUBOO36YplMqBB3ZcPxlG+bBsDHqYzHKG0qIwj:2dx3wqz3ZcDeDKYzqG01wj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686310081, "uuid": "a04752eb-adac-4410-9276-dfefcd822b7a", "value": 144384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686310081, "uuid": "acd9d9b1-9989-456c-832c-3b90752b9822", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310081, "uuid": "479f7b03-9049-4350-a257-f36a9cedd926", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62769feb-0699-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686296634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296634, "uuid": "051b05cc-1487-4abe-b0c2-265d8aa4da34", "comment": "Malware payload (AgentTesla)", "value": "7bbe5ca30616d677f50972e71ab0e1e1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "tbz", "colour": "#802FEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296634, "uuid": "543bf345-a279-4f80-bc50-43ae83192884", "comment": "Malware payload (AgentTesla)", "value": "b12ec09beb5ad8e603643b07db0fb0e0a6b845843a6292a8829ae2d178719db1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "tbz", "colour": "#802FEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296634, "uuid": "61eabf67-c426-4cde-b847-f80534ef3766", "comment": "Malware payload (AgentTesla)", "value": "8b6a65ee73902b11878046de7d08f417a01cc963", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "tbz", "colour": "#802FEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296634, "uuid": "36b291af-52e4-486e-b24a-5b983d44c031", "comment": "Malware payload (AgentTesla)", "value": "55387469681201a546796f2a331025192bb6d50849f81fc5a8a3de0c228704070005fb689e03b8a80a6518ea3de70e4d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "tbz", "colour": "#802FEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296634, "uuid": "c4c09161-eaa7-49e4-bb06-b6f2067621a0", "value": "T1DFD423C5F5161C014D897F89F3DD42937676B44B92A0E2C97332AEB7065812CAF72CAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296634, "uuid": "0546091e-5262-42c0-94fa-6e30e558b200", "value": "12288:/PfaVFSmjyYUhMjO85CUA00+tlGUi+l31hEGVuWbmRmvFoHQVSzqt2K3a9I8X:faVFSYUCjFA0/bGURd1hHVVbmIUQVHL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686296634, "uuid": "27bac12d-af41-498a-b833-141ff1ed17af", "value": 647271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686296634, "uuid": "dd3e4ea2-2995-4407-9754-d37eda6d0cbf", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296634, "uuid": "869f40d9-3527-4baf-9029-03c5adfeb0dd", "value": "RFQ#R2100131410.pdf.tbz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c272347-0721-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686355089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686355089, "uuid": "d537e14c-4e2c-4cae-82fd-e7ee5893f7ae", "comment": "Malware payload", "value": "353ad2d5cc617a5db915d34bdb905005", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686355089, "uuid": "e696483b-5275-4a89-9200-7462b1e86cdf", "comment": "Malware payload", "value": "b2a73dcebb6db2aebf237518470be61cd9398cfa5dab9a1f79035a939fa3547e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686355089, "uuid": "0cf07a3a-ff69-4d87-951a-e8186677708d", "comment": "Malware payload", "value": "eaa07e9e320b2407bb12d54082c674c6245c967a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686355089, "uuid": "7fab42d2-13ab-4ee8-a0eb-a5824a049452", "comment": "Malware payload", "value": "00798b058eca164c87ab1221359309e763c37ca0cb9a0352e4014e8d9a731a70a0de276ea76f37cab9e41591a886fb69", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686355089, "uuid": "ecae4115-1fea-4281-acc3-e5332de9d548", "value": "T10F44E1213CF0CC32EAB774308936DB64A63FB87229709A4AB6B4125E9F327D15935747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686355089, "uuid": "e74486e9-8618-4539-94f0-53d53454331b", "value": "6634f111b355db940bd1eece3e8a51ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686355089, "uuid": "9e71d0fe-96a2-4c73-a8db-a78b515df9e5", "value": "6144:OTZfEqYPDW0gIkKq6YCxLOKcZoId8LsC9TvpoBClHqp+:efJwDW0gIFrYCROloc8Llpoyqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686355089, "uuid": "d9e485b3-4e92-41a5-bab3-caeb8f4bb13a", "value": 264704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686355089, "uuid": "e0c52bb7-d712-485f-b230-d4c6f6813295", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686355089, "uuid": "93546ca7-6257-4ded-be82-905a4fd2c958", "value": "353ad2d5cc617a5db915d34bdb905005", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6249a41-06a7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686302761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302761, "uuid": "de81fbc2-fb70-4efd-a98b-7a9a0903d5a2", "comment": "Malware payload (SnakeKeylogger)", "value": "1a33d7264cc4a85c1c2f501af9b82939", "object_relation": "md5", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302761, "uuid": "ef584cea-b29a-41c3-8034-c59b7991e7a0", "comment": "Malware payload (SnakeKeylogger)", "value": "b39503b06919b2f7c6a4639a55a54f9af6cfe5e6b8e5822d7b0a7f69a37a3675", "object_relation": "sha256", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302761, "uuid": "cf9282db-2074-4628-8e19-c63cbd78b52c", "comment": "Malware payload (SnakeKeylogger)", "value": "77ce929c109aea5b6f7608d08d8f0a2fc6f58b98", "object_relation": "sha1", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302761, "uuid": "ee81b304-b334-4948-a10e-a5aeeb7b8fea", "comment": "Malware payload (SnakeKeylogger)", "value": "51a6cefb761bb3a29191605c98ad31f18c09459f2b11dbb70befc21dfe45e4b53473cc57376c5281cd75c8c5bb7307fb", "object_relation": "sha3-384", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302761, "uuid": "ddb7800d-a8da-45c0-aeef-02450e33a502", "value": "T1DAD4234418CD5C669EE78AB04085BBE172DF3ED21653FB7D9891F1CDAE4E2A7308A053", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302761, "uuid": "18892bae-24ba-46bd-b39e-cbc53d8f0a52", "value": "12288:AfpIXt8Y92qmlo1QWghs0eETtXxPwM/e7Us0mG4ans0fdpeXIwk0SW1vyjUzspCO:AGXt8YTmfWs/foae41mG4Ujnwk0SWUjJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686302761, "uuid": "3f043f89-df35-4aae-be7b-6b666c31093e", "value": 625622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686302761, "uuid": "96f398f3-4c85-4409-9f4e-7a1304fce8b7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302761, "uuid": "52ff38aa-dad5-4505-96f8-8c1e1da9c9d0", "value": "PO-22-3194.PDF.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cad28dc-0699-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686296517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296517, "uuid": "3210873c-0648-4e69-9d55-5d18e02f3910", "comment": "Malware payload", "value": "70d915431f8f8e7e4c5eb081259a0332", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296517, "uuid": "71113367-5f21-4515-8f9d-7cf819ad079b", "comment": "Malware payload", "value": "b51ed7cb599ee973da39c6a09c0b1320db6500c86d8472292832538c7ec18922", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296517, "uuid": "9566a24c-b3b7-435e-a792-4c25d2e92fa5", "comment": "Malware payload", "value": "c274f82ca7e40670d6088d24586304c189ea794b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686296517, "uuid": "93d03450-1d93-4aae-b4a5-eec7e3e0ba44", "comment": "Malware payload", "value": "6e171626081720d1b4a0fde23b72eb742b3400574c2ae3dc56bd5f5968408fcad7a208e187a456f5199f76d58a789c92", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296517, "uuid": "8fbf4d3e-f10b-4ed0-bf13-dceeead030bf", "value": "T115342E9BF9C32A0DC4904173D6F1D7A60541AE207FC2450FF207BF6CA8729A269D7E96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296517, "uuid": "ba1d9c9a-f878-4f41-8a6a-7e343e7b56d2", "value": "6144:nZ+RwPONXoRjDhIcp0fDlavx+W26nAZAD:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686296517, "uuid": "6aa85e48-66fc-4420-9271-a27eb87e920a", "value": 249344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686296517, "uuid": "0ae9ec9a-6feb-407d-9271-3cd530f50fbd", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686296517, "uuid": "a5054c5f-f137-4ed9-b2d6-12f43cd5f653", "value": "POM21002942.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c303596-06df-11ee-b3cf-42010a9c0076", "comment": "Malware payload (StrelaStealer)", "timestamp": 1686326581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686326581, "uuid": "0e35690d-e85f-425e-af00-0bcc251f47fe", "comment": "Malware payload (StrelaStealer)", "value": "2528c8b93c299fd0f7ef78d704ed8d1f", "object_relation": "md5", "Tag": [ { "name": "12980215 Canada Inc.", "colour": "#2C28D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686326581, "uuid": "18d54451-2735-4869-ae8e-5ead7b70d6da", "comment": "Malware payload (StrelaStealer)", "value": "b521b430068af0ce4fdd0adf965d3d888be86695b4c0c8d6f74e90a11c61b5e8", "object_relation": "sha256", "Tag": [ { "name": "12980215 Canada Inc.", "colour": "#2C28D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686326581, "uuid": "e477e55d-d9d1-4bc9-967f-bea99e37df28", "comment": "Malware payload (StrelaStealer)", "value": "07e33fb72a2ea15e0dc347a3d794dc7de6629c34", "object_relation": "sha1", "Tag": [ { "name": "12980215 Canada Inc.", "colour": "#2C28D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686326581, "uuid": "f043169f-6656-4076-9b95-44bc41a44ff4", "comment": "Malware payload (StrelaStealer)", "value": "1ce50c532602702ffa760df63129ffac64397b14fb5dad03b8e5edbb9b2bb9a9bb8d454f815f52b8819fd5359d0a8137", "object_relation": "sha3-384", "Tag": [ { "name": "12980215 Canada Inc.", "colour": "#2C28D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686326581, "uuid": "0175080c-ebb6-4002-b703-8948f9fa4ce9", "value": "T121727D623B642627CE8A47FFACD357242B305B0716A4DD9F9CF06AAC5B41391760223B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686326581, "uuid": "29b19db9-2022-40f9-9f5a-f88c960bd264", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686326581, "uuid": "7e50b98f-8055-4c79-b78a-864c3f608c17", "value": "384:YZ8ocMqD0PF/1tZvDJMx+T4/QpwKNsy368T9d1T:HaZrv9Mx+c/lbkD1T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686326581, "uuid": "d4fdbebc-7766-41f1-8c61-c94d39933d54", "value": 16840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686326581, "uuid": "bcfc3d1a-4928-487a-ba71-fb29cf6724d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686326581, "uuid": "c58b46ca-8589-45ae-be9c-eeec91c25596", "value": "Fattura (6).bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b06fef4b-065f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1686271854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271854, "uuid": "194679e4-e4bc-4e1f-b966-d84ece2be772", "comment": "Malware payload (Stop)", "value": "f2fe29e59327fca5b6a18ec8244e8060", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271854, "uuid": "6cbc9942-01a3-49d2-8b6c-55a47607a5a0", "comment": "Malware payload (Stop)", "value": "b7f5d309309e41f43d6605b2007088afb5bf82c677bca8f50b392f27c3db8c1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271854, "uuid": "3c4e9e79-16fa-4260-a9fb-8df0efb2e266", "comment": "Malware payload (Stop)", "value": "0af3f379c5d010f4bb0564000291cceaef61481c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271854, "uuid": "3895c2a6-8aff-430f-97a3-31632298f40d", "comment": "Malware payload (Stop)", "value": "4890b7331821871424c04fdd73d994d22f26c1e7fd27fb89e691fa3b94d4d39f42d2b1b8801202a2b30516ca28a2d847", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271854, "uuid": "7a679397-ab49-4219-aacc-dea1134b665a", "value": "T12B05D00362A17C55E9355B329E2ECEE8364DFA518E0D7B652A18EE1F14B12B1C173F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271854, "uuid": "28d9ac59-d9df-4796-b66d-2fd112af2495", "value": "078c527316e58c8f8358ebd022c4bbdf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271854, "uuid": "f6d5f900-730f-4107-8682-f1ebb2d45e09", "value": "12288:k3y3EwowJnHSgWM9eX58M42ZPCXY3kssswt1N85VyThLVQYBmb:k3bKHSgdQ5342ZqolsH1N85kThLVbEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686271854, "uuid": "b33015c5-4ebb-4455-8a4e-3f6238af3cd8", "value": 804864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686271854, "uuid": "e8f3aa8d-1960-431b-aef3-a40ad4db473d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271854, "uuid": "0a532339-cd5f-427c-8c29-18a760716dcd", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33431c98-06c1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686313735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686313735, "uuid": "a078b4cd-0946-4ebf-b659-09315bee9a62", "comment": "Malware payload", "value": "481cd861a87666310a0f7ba8b544583f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686313735, "uuid": "74669eb7-775f-4a87-bdd2-bd60224af506", "comment": "Malware payload", "value": "ba083ef56235bf9063991decf537b26480496dc4a3632e1dbfefc86574328bf0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686313735, "uuid": "9356e432-1571-41ea-97f5-fcfd1ebf43ec", "comment": "Malware payload", "value": "591e5c0e6fdf7797efdc52ba6303027d221125ce", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686313735, "uuid": "25b6a1b4-42a0-40a0-9c24-cabf44cb8cc0", "comment": "Malware payload", "value": "b3c5bfd4b893ed442c58c6cbe5f34e18f117e2f1092beeec8786793d71ac92e8a9a6e6b1d49b6db1c6e9b55f12a33492", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686313735, "uuid": "60f1e91e-7c16-46b4-b538-4c1508015971", "value": "T19DF4F247B9C66E3BC34D0D34C0F6420DE73DBD529E42AA8A25617A5B3AF212167D2F4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686313735, "uuid": "e75e6dc8-c22b-4beb-9769-ce37e0f6a607", "value": "12288:XxP8p4gqWxuRt/Oh3+BZwIJ4GImU0cS41r0t3o3mb6A9iBUgPutyo++1CiZX:XF895ur2hOBHJ4G7g12Db6UiBH4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686313735, "uuid": "bec16827-8cc4-404e-9569-7c5528b7f979", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686313735, "uuid": "326cab9b-a107-4bb3-b1e4-29750b9d9f2b", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686313735, "uuid": "9cd3c7ef-fe11-49a2-93eb-8758cbfde2b8", "value": "Offre Commerciale Geocoyote 2.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd5c181-069e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686298801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298801, "uuid": "96a215c4-90e6-4439-8dd0-af5e2a1cccea", "comment": "Malware payload", "value": "c991afda5b44371c1d863d2d7b75ccb7", "object_relation": "md5", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298801, "uuid": "dba71dd5-da0d-42fa-a5c7-c06ba7d8de36", "comment": "Malware payload", "value": "ba2efed49b2dbae1fa29f44d2aaa219433cb7a6a499d3e39a106839591d5bf3d", "object_relation": "sha256", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298801, "uuid": "b70be8ae-ab17-4b47-b49c-a728298a66b2", "comment": "Malware payload", "value": "3974df88f4f15b961fcd8d4e42290803591e8687", "object_relation": "sha1", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298801, "uuid": "8000d1b6-f1dd-4d24-bd89-652348c4b753", "comment": "Malware payload", "value": "240c4681d71b964b07d07a06db48318d93cc90cf853bc11152a494d6a6affe1bc70a94a02222adc8facf3bc93e4d33f3", "object_relation": "sha3-384", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686298801, "uuid": "18a2c3c4-ce11-49f1-b00d-454c75195fc7", "value": "T13AF423A17C61872E8FC84EC9FCBBCE4A76A3F44875EE1625A0105601DBD9EF6CBC8544", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686298801, "uuid": "b8e8300e-281c-42de-a921-248688c3a69f", "value": "12288:UnlZy55b7zX6A0s0g4nvW+AyQ8DFxmrz81E2qwCclhaxTv/bymQIIzLBxXAqR:UlZy55b/XH0g9VyQaS81ZqwXCTOnLLjJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686298801, "uuid": "506143d8-6b99-4cdd-8505-93ca150067e4", "value": 767096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686298801, "uuid": "428da183-f3c6-4d49-a51f-f85edaf2e995", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686298801, "uuid": "6185d87e-63d7-4956-8205-849811ebff41", "value": "NEW PO FROM HAIAN RUBBER GROUP CO.,LTD QTTY.pdf.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "302a6345-06a7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Neshta)", "timestamp": 1686302563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302563, "uuid": "c1482d68-bb0a-47a4-ac7f-4e58dd9a68ce", "comment": "Malware payload (Neshta)", "value": "7d424fcd2cfd26574af4acdb87cbe15a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302563, "uuid": "bb8b11c0-5219-4d4d-b72a-88b8b2ac9e14", "comment": "Malware payload (Neshta)", "value": "bb741e7ac48085e964e7fdfbd19b97a7376712b09c540a95c9a5f1872034908b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302563, "uuid": "ba67c422-53e4-430c-b1f7-a5b4957457f1", "comment": "Malware payload (Neshta)", "value": "d1f2636c0a0a493cbc7522350de7abef29ae4e9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302563, "uuid": "c8b40a8c-0527-4c0f-8524-b3af0389837a", "comment": "Malware payload (Neshta)", "value": "fa5bcfd11b1016729fb786609e6852101b5df351bf53db9dc5bfb5aaba50b73865828aad3620bb6a83f67fe02b577f01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302563, "uuid": "0045fe55-18fc-40b4-b3f6-bdc3dc68302f", "value": "T1C815D04862BA9F5AC4B97BF90460517183F55DAB203AD2874CF274DEA970B07CD80E9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302563, "uuid": "80ddeac6-c22e-473b-8532-9d6afb6d8883", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302563, "uuid": "9f6c2d6c-a365-4903-98c9-36e39bd49441", "value": "24576:bUlRu4OyqGUL8ANdsS8hMrVl0nhwcnBH:bUlRu4NqGo8ANuS8hMrr09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686302563, "uuid": "6d848256-485b-4a00-b581-8f1b51a2a389", "value": 885248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686302563, "uuid": "aeaeb460-b110-4381-a3c3-06331f43d680", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302563, "uuid": "88d38afa-7cb7-4c28-96d0-51903ef015e0", "value": "0tMUNlnakQsCKNd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d983ee-06a5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Arechclient2)", "timestamp": 1686301661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301661, "uuid": "657b7d16-c884-4c14-b66b-6be55334c03b", "comment": "Malware payload (Arechclient2)", "value": "1cb6d749453b29c6052c5de20bf6e5b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301661, "uuid": "06df75f2-f892-440c-9497-29e09c65a355", "comment": "Malware payload (Arechclient2)", "value": "bcb64ec803aa8e0fc6936eaa75b67d7a40a0d189d28ecb67d5607ddd9912adaf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301661, "uuid": "224a02cd-0e02-4f11-85dd-8c40d657675e", "comment": "Malware payload (Arechclient2)", "value": "1cbb5f04761b93b18e250024a5340d43d0958541", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301661, "uuid": "271317fe-8857-4f84-8ea0-8c675f5b0791", "comment": "Malware payload (Arechclient2)", "value": "0ab3e93155589a5e4da9da9b5106f48467f71a6a5b896a92ff442ab0821307e90427290d3ef147afa6e201679809a0dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301661, "uuid": "ccce6268-5304-4db4-90b5-075b058b3ee0", "value": "T1C8762379738282CDC456DEBD3271B37E8298CE22D4CB4557935EF8A9AF7A9400D0B2D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301661, "uuid": "2c469b69-5e04-4ff8-bfd3-ed867228a8c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301661, "uuid": "23820e9a-d501-4a3b-a2b8-05f7d32527e4", "value": "196608:kFwkDed6xN5fxgfJ4En0te9LK8fX28Q301:kd06x3GD0I9rfHQ301", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686301661, "uuid": "7358524d-e71b-4a60-94b6-b96d0e510188", "value": 7811584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686301661, "uuid": "144a0637-d067-4e10-b86c-1a3a9ec81317", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301661, "uuid": "a6b365ef-ddd5-4bab-964f-6d6dfba25751", "value": "1cb6d749453b29c6052c5de20bf6e5b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2aca84c-06a8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686303319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303319, "uuid": "ba23915c-b12c-4d5e-9729-b38c020afa3f", "comment": "Malware payload (Loki)", "value": "60011175af137c3346811c4eb9bf81e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303319, "uuid": "a0d29732-6e10-422e-94f0-237427c2b587", "comment": "Malware payload (Loki)", "value": "bea7b46ebc24ba7f890efc9c50000392ce7c2c8fccf1c05c12c01b82b523ab77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303319, "uuid": "79b0e219-7423-4ac5-b371-f59010c34b1e", "comment": "Malware payload (Loki)", "value": "c0bc42cee0b04583146b2e3fd272b72c6cb285c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303319, "uuid": "07e53a05-00b7-4841-a7e4-601ad1351189", "comment": "Malware payload (Loki)", "value": "d519d00d2a838a99c1c9a93b08673ef21fda03a58096f61e01e0d6f47e3ace19179c170b8d77f24446df73cf4b6e2fac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303319, "uuid": "f366a95c-002f-4011-98aa-7a70b6cbfcc3", "value": "T1F75501726DC2FFEBA7A50C64DD5A25440CC468B783D85464F8C85BFEA2F5820EE15CB8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303319, "uuid": "e2e52bd2-4cb8-4f92-abe0-488422129fab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303319, "uuid": "945bd775-3ea7-4536-8cfb-0b13bc6d0d1e", "value": "24576:fntq85Gkm1i5yT8h4RY8wNnjlJI5jCD//v2Cd7qvf:PWgyoIDwvD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686303319, "uuid": "f789cf70-9c46-4264-8b76-7dd6e9eae30c", "value": 1318400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686303319, "uuid": "3c3f74c3-db01-451a-920f-5d487e06a8a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303319, "uuid": "54ffdc06-3f3c-433b-8961-b84543fec332", "value": "Invoice.PDF.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1652cbfe-06df-11ee-b3cf-42010a9c0076", "comment": "Malware payload (StrelaStealer)", "timestamp": 1686326571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686326571, "uuid": "1a3fba41-400f-4f2b-bcd9-7957e40f7a27", "comment": "Malware payload (StrelaStealer)", "value": "9430b38d61a9a0de898bcbd886f965a0", "object_relation": "md5", "Tag": [ { "name": "12980215 Canada Inc.", "colour": "#2C28D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686326571, "uuid": "b1d5cce5-999d-4f15-b128-01810c097f21", "comment": "Malware payload (StrelaStealer)", "value": "bf0dc5300f6f7654e37fee743caee1bcfcd19e4445784254b4f7bfa938799022", "object_relation": "sha256", "Tag": [ { "name": "12980215 Canada Inc.", "colour": "#2C28D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686326571, "uuid": "3d1a1b53-b981-402d-b05c-705e195d11e3", "comment": "Malware payload (StrelaStealer)", "value": "0ca60a42f2c61de8a726d915ea24c9d804696f8a", "object_relation": "sha1", "Tag": [ { "name": "12980215 Canada Inc.", "colour": "#2C28D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686326571, "uuid": "38e50257-6c2f-4fb0-aed0-7fcb66bd59b2", "comment": "Malware payload (StrelaStealer)", "value": "7d15b9918abd4eb3c1952bb832c8b13b474b7492da6103a22f7b0f8724a4afea254ee06f540ac7c19bcd30d093d0bde3", "object_relation": "sha3-384", "Tag": [ { "name": "12980215 Canada Inc.", "colour": "#2C28D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686326571, "uuid": "ed3a7ca7-8347-45ea-9b46-bc63fbf216cf", "value": "T1A6727D523B64662BCE8A07FF9CD397342B30570B16A4DD9F5CF16EAC6B01391760227A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686326571, "uuid": "22c3e126-93a9-41d8-993f-471cfb5b9253", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686326571, "uuid": "722891e0-8ead-4a53-b89d-b05f3f297aff", "value": "384:YZ8ocMqD0PF/1tZvDJMx+K4/0pwKNsy368Tv3wj:HaZrv9Mx+T/Bbkvwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686326571, "uuid": "dfdc7f8c-72a2-461c-af5e-0520707eaaed", "value": 16840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686326571, "uuid": "c7d628db-a5d1-4262-adce-e80e8292504c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686326571, "uuid": "177ab62b-db38-40f6-93a9-5374115e46bd", "value": "Fattura (5).bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d52f4e-06a4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686301448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301448, "uuid": "a097e75e-9f19-43d8-b0f9-e8ec3b6ffd1d", "comment": "Malware payload (AgentTesla)", "value": "8e2ba433bd90b8a4d96a38dbe1b226e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301448, "uuid": "0c5a01e5-43e5-45d0-82c3-a55a78b52571", "comment": "Malware payload (AgentTesla)", "value": "bfbda46a75c2c6eb06596955ff86bb015e2ec3bb060465699a54912ad54953f5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301448, "uuid": "14f30e70-6043-4765-85ff-ba0e8b7b7c1a", "comment": "Malware payload (AgentTesla)", "value": "f9f0efc2205ad79f46aabde683634f390c1b8444", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301448, "uuid": "fc1a2893-f452-4ff6-842f-22210a01daad", "comment": "Malware payload (AgentTesla)", "value": "99a72b2ff679aa4d60716a50b94f3a40e6280936094836f61eb918900b4dc6d5bad987e84b14752c589759bdbca4dc1e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301448, "uuid": "31eddbfb-d5ef-494f-ac06-2cc3727eee63", "value": "T12B8423130399EDC8854A46EEA8ED8376E7425531E83658BDF438BF473E35223DE61863", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301448, "uuid": "baccac01-c0db-4fd6-8265-72c3006b23e0", "value": "6144:w1AmD9sx90D3YqBnceWaW6PG7gEniLLK0m7FnMK6chV+2C4IIzNuin9zPl5TAw02:IlBsxoYqBncrd7gEiXK0m7FndhV+BsNL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686301448, "uuid": "f8e5ce0c-e34a-4f7a-b221-9ab07b3c7e01", "value": 374405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686301448, "uuid": "8620f617-da32-40fa-bdce-4d0c000c8854", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301448, "uuid": "381b61f5-3d28-4eba-8836-8f6626409ae0", "value": "Amended Order No. 60-230235.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "771f32f4-06ca-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686317714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686317714, "uuid": "4c261d25-910c-4bde-85db-54b4d7aaa5db", "comment": "Malware payload", "value": "ae1b1b996deff4c26bed7f12725c3c62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686317714, "uuid": "434778de-109d-41cf-82b1-3ae029406ebb", "comment": "Malware payload", "value": "c0bdd07daeb73c3739f70f84b9ed6dda1c45c305ac3c9edb152c2ac07286a517", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686317714, "uuid": "553d6400-9f55-4661-b8c7-371c3fc23326", "comment": "Malware payload", "value": "3984b335965d4bf281776387571f2b48a005e0df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686317714, "uuid": "ba25ce78-41ac-4d01-834f-196c886e7514", "comment": "Malware payload", "value": "0208807f27de3b381b57178f3f66f4c7f2b54b86265119cdfd051f389e007c3b9057cf0b7399885be7f84a6673793035", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686317714, "uuid": "b7d1af85-d3c5-4f42-ae1f-bb87760cfc8f", "value": "T144E64A07F89191F9C0ADD170C6369292FA303C485B3137D73A64FAB92B72BD46A79394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686317714, "uuid": "855be38e-f6bf-4d06-92ce-e2a75191e140", "value": "57c9b357ae0cb2f414b0a5873e2f216d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686317714, "uuid": "b515ede8-a2c1-40c6-b7be-817414082dcf", "value": "98304:v+T/NKOgiEl+CEN+fuz3xEM/4zdfHcBWdwOf:vC1KpiEoCEcuzCNzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686317714, "uuid": "a1e1efff-adcb-4847-b278-adaea77d28c5", "value": 14533120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686317714, "uuid": "a98484f0-a8ea-4ea5-9559-5e36041c7035", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686317714, "uuid": "1bc02cad-e069-49be-b46f-9cf9eb53c498", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72b1e305-0692-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Petya)", "timestamp": 1686293655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293655, "uuid": "3bccdc18-4df8-4ce1-b9ad-992f82fe59fd", "comment": "Malware payload (Petya)", "value": "4c03d0007047847a228aa0a1017c3d99", "object_relation": "md5", "Tag": [ { "name": "Petya", "colour": "#8B50CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293655, "uuid": "c3d18f44-1e4d-44ab-bb87-a653e45ca25f", "comment": "Malware payload (Petya)", "value": "c0d0665bc0fc83c9204e30057d7c626e80f3ebe1e0554f17930274aa11996ef1", "object_relation": "sha256", "Tag": [ { "name": "Petya", "colour": "#8B50CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293655, "uuid": "94dd0e31-317a-4d9a-882d-198618ce34b3", "comment": "Malware payload (Petya)", "value": "d2e423a27c49febecfe3ecb6d66e8107a0cefc66", "object_relation": "sha1", "Tag": [ { "name": "Petya", "colour": "#8B50CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293655, "uuid": "29fd04c8-d9e7-4443-b498-12af3dd22878", "comment": "Malware payload (Petya)", "value": "0a6f7f72ee5d7b49a3c6a4e646d4084c092cd2fc3cdc0b733e290d387dbf3500cb5565376c05da45380b7b912768eace", "object_relation": "sha3-384", "Tag": [ { "name": "Petya", "colour": "#8B50CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293655, "uuid": "57b9774e-be09-4b55-95d9-68e3a864fc03", "value": "T191A4CF02B6B19071D9A782395679B77A0C39BE2077E4D5F3E7D3285AC8302E1573D386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293655, "uuid": "89d650e0-92da-4bbf-bb7f-81450e1c612b", "value": "90cfb770dd8b0646a46fc541c93185a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293655, "uuid": "bf40f4a7-a0d5-4fb8-8ca9-f497794df0e9", "value": "12288:cPaAhutLwUVsvLPcFZXYl0o9Zdm9n50DNx:cPjutLRuvLPcX8VC5S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293655, "uuid": "d719c091-5587-4df0-bd1b-2228c4c352e8", "value": 484864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293655, "uuid": "7b1f7e23-c773-4a35-ac1d-41fa91396f86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293655, "uuid": "6172c6e1-8827-48d1-a679-64f7da36e937", "value": "08468899.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf30582c-06b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686310131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310131, "uuid": "be096d5d-05f1-4c22-8bff-ad0291ffe61c", "comment": "Malware payload (Amadey)", "value": "814cf889e2556a9b5deb46e77cbe2e41", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310131, "uuid": "23272112-e65f-4532-881d-e086fee610ae", "comment": "Malware payload (Amadey)", "value": "c0e52121d52fa0619a45f01c836fc13cae2565d5fb3ba111a8ddcbd040e2511a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310131, "uuid": "b74cf353-f6cb-4f2e-a080-97fdd580eca1", "comment": "Malware payload (Amadey)", "value": "2148de9636ed151440354dde07a45dca0ac5d856", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310131, "uuid": "81bbdd23-e203-4740-896e-a02db7eaea9c", "comment": "Malware payload (Amadey)", "value": "4ed8adf24ae49e5a52353b9f87f4664cb51d6461f88d414010d177694675f5c08065d813d87364a019dc6b4eae794e90", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310131, "uuid": "de06d379-30ef-49d3-818e-bb979b16eff3", "value": "T1F6D41212E6E48132E9E027B048F703D31A36BCB15D78836B36459D5B0E736C5EA7636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310131, "uuid": "e0e6c054-1ece-4ba7-88b9-67899b3b6d5b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310131, "uuid": "391b534f-79fe-4be2-a292-149612c60fcd", "value": "12288:tMrLy907B0l+BghzpRcWOMkx070kYzc063BRU7J8MwGf:Sy8B0lFhVR/kxXcfvoJHwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686310131, "uuid": "f302626e-d495-4fa6-9f1f-e74c1751ebc9", "value": 611328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686310131, "uuid": "ecdf1b8e-39cf-4993-aac0-6d93d5a9ab7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310131, "uuid": "16aeb6c6-1959-4419-b56a-d197fc081a71", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f51bd2a-06a5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686301783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301783, "uuid": "1ae71dc7-b760-4918-88bb-7e876ef4a1a0", "comment": "Malware payload (AgentTesla)", "value": "4c484b5dfbd3bd83b311cc70ac0d3240", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301783, "uuid": "db0d784c-68e4-406c-8659-efdf603d4615", "comment": "Malware payload (AgentTesla)", "value": "c1aa1452e66bc758344afdecb6ba86034c4841ee0c3bb98f462c7feedeb596d6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301783, "uuid": "e6085201-e0f0-42f4-8e2d-be2d1a7b85bd", "comment": "Malware payload (AgentTesla)", "value": "637ae08a158a9a8d720f0c1911d10ced059bf093", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301783, "uuid": "3b911e6f-9600-41c2-935c-053c74c43994", "comment": "Malware payload (AgentTesla)", "value": "3c6ba74b890bff9b9247388f93cce313ef7b4cd4d20f38b5142293fe14c01fdc5301a6850bd0446a398fea02ae72f464", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301783, "uuid": "70e2e4a3-fe85-49d4-804b-c0a95eded89e", "value": "T14EE43336C8599D03FD18AF7452CB5D035AA8E79AF85CAA64D31CB978B383D7F21109E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301783, "uuid": "fd5bd95b-0a99-47d2-b704-97606623249d", "value": "12288:Kuj7goNjnvXVo2lkbNPr2XZL4flKb+HcvTugG1A6X3O4wu2kS94:bjvF58NTmZ4flZ8voz3LwufE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686301783, "uuid": "33f37e04-5451-4afd-ba9c-48a9570f4e75", "value": 687284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686301783, "uuid": "8ca39734-d238-4c3b-84dd-e0d1d1054686", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301783, "uuid": "08a4cff3-aabe-49df-8781-c6182a54f582", "value": "remittance details.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaac6240-069c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686298044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298044, "uuid": "9e3d65ba-6e05-42b9-8ff5-ae3220e30ba9", "comment": "Malware payload (RedLineStealer)", "value": "f63c1ed6a26de1983aac1aaf71066e1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298044, "uuid": "050b542b-5145-40b1-b67e-577ec6c3f696", "comment": "Malware payload (RedLineStealer)", "value": "c1bbf378ed72b76c61a34003b784f9257ce5263ee3c19c4ad8d3038ae718df3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298044, "uuid": "a59be35f-5188-4a99-a613-ccf8563a73df", "comment": "Malware payload (RedLineStealer)", "value": "bff9f4c64463d0c9ed99595cde62622ba5e38724", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298044, "uuid": "ed5cb079-0b64-4a52-893c-e3a725377f92", "comment": "Malware payload (RedLineStealer)", "value": "eb21b6361ce2d7995217d7c44a0eeca1ff42e898541116330ebbf9684bb36ab615248123ab7cfb3aa5ebc37920ad35fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686298044, "uuid": "5964430c-ac33-425b-807c-7b8d4604e49e", "value": "T193547C09E4DF42D2FE4521B5256E8096F4BFD4F7577FC0AECF8A3AD20C531A09AA015A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686298044, "uuid": "c289e429-c27d-45d1-bae1-4e14d5f399c3", "value": "9a420839291c450c6e0e5c21b3466023", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686298044, "uuid": "9d96af3b-239f-481c-84b7-e5772ff6e6f4", "value": "6144:8PO4F1JmLIQXqxVdfj3zFaNufxpnI0buRaRhF7X7Xeypcx:8PO4F1JmLIQXqpfjDQNufx1I0bu07Bux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686298044, "uuid": "943fe60a-1de1-41d0-b179-0165df054524", "value": 285624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686298044, "uuid": "74c37ad1-5f6b-4c6d-afb6-aead63e2035e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686298044, "uuid": "d848e35e-814d-4302-b41b-0773ce21fc30", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31556885-06bc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686311584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311584, "uuid": "eeaa256d-9f0f-4fac-b1f4-57d4d2e5fd7e", "comment": "Malware payload (AgentTesla)", "value": "4ef95506966ec368bb5fef61b734eab0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311584, "uuid": "2c2aaf3f-1705-4d83-9ebb-8a02e855f90a", "comment": "Malware payload (AgentTesla)", "value": "c45219a3fd0cf51360c30b7aa0cba985ad1d28030785ab9dc5083090540409d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311584, "uuid": "9f98d1fd-84b4-4f45-8f52-d1329fb2a7f8", "comment": "Malware payload (AgentTesla)", "value": "b90a7bc656193221a4365ccd97fef88f1927d0a3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311584, "uuid": "0683158a-f5e3-4440-92d5-49429fdebb1d", "comment": "Malware payload (AgentTesla)", "value": "09b27b6587611145ef36b3741959fddde6a286bb9ee0450d2650d3654bd4c6aaedda35110c5691e00c13ba2a25569fd5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311584, "uuid": "71ba77d8-650f-4f19-9131-0462b6bd0080", "value": "T1E30571BC5D07E6EBCE38E26A95F02307B3651517B65EB88C2ADA3B450D93DC132D064E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311584, "uuid": "07be3b0a-dfe3-43cd-9e92-7488979a1aad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311584, "uuid": "993d1ee5-360f-4b46-ac2e-09650a7ceabd", "value": "12288:Jh78U1wr+DKIE+oBYFqdhshvZnCP+GREixvgOD:JhDT+p+IEvs3REilgG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686311584, "uuid": "e8475085-3d32-4d73-bd63-cb6847e7fb8d", "value": 856064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686311584, "uuid": "d2680af8-9be5-47d4-8f28-584c9ebddfcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311584, "uuid": "c8c2e298-4dc5-479d-a02d-3bc6260fa21b", "value": "Transaction_Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1294c354-06a4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686301225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301225, "uuid": "c06003cf-51fd-493c-9a87-17123d27a18f", "comment": "Malware payload (Formbook)", "value": "3fa620586430b9dd99c04f2cd2a19ee3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301225, "uuid": "3297ac5a-3790-456e-a45f-da2ac89b2c7d", "comment": "Malware payload (Formbook)", "value": "c5bc8a4b4bdd0dc3e44464209633552f942177d93bc2d9a957d4e434c5e8b0f9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301225, "uuid": "325e1069-bb5d-4da1-b38c-2c7cfcc0249e", "comment": "Malware payload (Formbook)", "value": "df36432bc55af3ef3271b7f7200406c51e7f28a1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301225, "uuid": "bd8c1c4c-4d8c-483c-9517-fde26243caef", "comment": "Malware payload (Formbook)", "value": "fe217231ae1aa1ee28663751fcbc6815ccd1c7d49bd467e196101e0ff5f048dbfa4649aecb3103cc62cf7b58402e20ab", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301225, "uuid": "ee6fe7e3-6709-4272-81b8-cd9bd5b91385", "value": "T170F423C94C831E36C479E5D585DF7CFF4E3E21C1ADB02A225EEC6B50A92881831975FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301225, "uuid": "6185937c-eb9b-4a28-82a3-7f98302572c7", "value": "12288:dk3XjiWtcUeVxeftyM07L0Wpg6bjm0lwBHMLPnZlgCcJvW8QoUwERCy4giaAfx4L:eXjosfPxWO10OybgtJ+nRCy4bxwBrpx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686301225, "uuid": "8f6928a2-7716-4fe9-a9fc-5ea262e538f1", "value": 788008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686301225, "uuid": "dd931572-f47b-489e-8f4c-2f031678c947", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301225, "uuid": "318dd49e-fd95-4c10-84c9-a86ccf929818", "value": "Invoice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0ff564-066d-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686277591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686277591, "uuid": "55b5916a-5a29-47b3-a8c9-9514fb5d95ad", "comment": "Malware payload", "value": "bfcffc1ba90629e540fd23ad570db1d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686277591, "uuid": "372c434e-9974-4e99-969c-d5b0771c0484", "comment": "Malware payload", "value": "c5dcc3b463c2f40e7a65f1fe5d0502dfd7ce5ab923731ae8b020e1ce30380cd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686277591, "uuid": "43453f91-04f9-47b6-bf09-710f7166b31a", "comment": "Malware payload", "value": "d5fec922174bb4aaa7c2020eb5416589b5a6515b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686277591, "uuid": "e8f8e0df-aa88-4045-84f7-883980b018a0", "comment": "Malware payload", "value": "8b171329cf3b841e7a29c5b4619a6f4620df44101e1e53444029f624817aa90879ac2343d64920ee6bda877b40cc73e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686277591, "uuid": "ff7155ee-0728-45bb-bc80-1083a8ed279b", "value": "T17D73E143A3506A21E4610E70FEA74BE45B349D54645A9B3FC2DABE2F5C7C720EA02F74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686277591, "uuid": "89a3e215-51a5-4059-b74f-01f5c75e87b8", "value": "1536:zYi9uoCINjGWmt8CXZ+63x+w4JD+0N6+XKa:zYi9uob6t8WHxSD+0o+6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686277591, "uuid": "b75c9dad-ea20-4883-859f-99ef3bcb74dd", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686277591, "uuid": "9339eea9-7ce8-464c-9e30-6032818d76c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686277591, "uuid": "ae2f7882-3665-4277-b01a-90f766ce6242", "value": "SecuriteInfo.com.Win64.MalwareX-gen.16833.15918", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae3b829-0693-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686293910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293910, "uuid": "d38f9e02-ee6f-4c45-be74-7f93ecd2e091", "comment": "Malware payload", "value": "e0d05acf85c5b690df5972943169a9cc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293910, "uuid": "c7d8932d-e57b-4883-a2df-36324e479684", "comment": "Malware payload", "value": "c6714dab5a5a0ad0af84c32d4b4d5bc7f41a82e413afff6b19d531e536fb2927", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293910, "uuid": "3c90c452-63b5-4136-bb5a-00af84d83412", "comment": "Malware payload", "value": "d37c59a0ddd52bb7cbe9333ba41a9f8b20d55639", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293910, "uuid": "3920f927-61d1-4cc1-9863-b0ea11804a68", "comment": "Malware payload", "value": "ea444f4f8d56fd2938b5527b0fce723c503890492777ce64cfb549f706988fcf5f86de3613216937355151c2ee2b5a35", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293910, "uuid": "1d490803-a784-4891-a98c-a672a67021ad", "value": "T1DC156CAF7140A53AE01399755C4BFE3C547F78012E9F25A42EF93D1C196A9807A2C2DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293910, "uuid": "9e846a9f-bded-438d-a386-6a71ff54f7b8", "value": "82afd4f7e321f3a2715e21ddf3a44a5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293910, "uuid": "49c2f1b2-737a-4f68-9cd0-4b17ec57b4ee", "value": "12288:+DphY3Z1ozyDQhElJqTHu0JxM2zg/YeFW:KTeZ1PDQhGJok2oZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293910, "uuid": "b53ad9e5-af22-420f-a405-af13afd2a62d", "value": 916480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293910, "uuid": "31ffac6f-5886-4d7f-ad70-0c965397e670", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293910, "uuid": "22014f4f-55f2-4391-87fb-83dec117ee77", "value": "08999399.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac8d9a8-069b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686297507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297507, "uuid": "814011e6-148d-4558-b6e2-e2725ae93aaf", "comment": "Malware payload", "value": "b19c80436b30fd1630bbf6738c1c418e", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297507, "uuid": "75babd0e-2d87-47f9-8ec9-2c43c91ecd86", "comment": "Malware payload", "value": "c760a87c19c6aa2ded5ffabf4f62f02fa067fb625103ea1747293bc12caf7a58", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297507, "uuid": "273a9973-3cb3-4497-8bbc-d32ffe17146b", "comment": "Malware payload", "value": "bfe5b6fbc74873c9f50d0e5bcba45bb7457578b0", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297507, "uuid": "318f5921-a21e-423c-9dbd-c5acaa66b697", "comment": "Malware payload", "value": "ee27429435d4e5ecdf95f7f0bf7131cebab6b25c9455b7db63491ba336734c0c4ce35c359ad77d68d0701eb15360f0de", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297507, "uuid": "2ef8a2e9-13ab-4f82-be41-91fa2a659f06", "value": "T1CD62AEE1C0914A2CE7454670A014A118D35B6773A37D356EEF30C9DE6AF8DDF160136D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297507, "uuid": "11592a79-17c7-4528-b2da-d74790a082cd", "value": "192:EPst/CzONVJ0spH3hN7ZtNYg3dx5BO8Qk5i9AE/yRVj1qqfu/M7ykrPwBJjXI8BW:Jt/aYZz/368Qk50arFB3M7DBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686297507, "uuid": "258a8ac4-eb09-48ac-b688-8f65d5c4d0e0", "value": 14966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686297507, "uuid": "fd6e048b-b0a3-40ab-a595-e4d882d481b1", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297507, "uuid": "1d2d9012-0865-46c3-aab0-e5acad12f682", "value": "PURCHASE ORDER.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "763fa9d2-06ad-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686305257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686305257, "uuid": "6dcb70b3-7159-46a4-8d59-a8aa65ea1e29", "comment": "Malware payload (AgentTesla)", "value": "5af24fc7f1fc2c55d515b0fdd11a9594", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686305257, "uuid": "a42cab5f-e0f1-4b5c-9e77-1e16344aef51", "comment": "Malware payload (AgentTesla)", "value": "c86b63c5c7cf3ff83175f60511151fbc993d42566f1bc38cabffd15719a14e59", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686305257, "uuid": "db1ff96f-031a-4cc1-b673-74de5bb2945c", "comment": "Malware payload (AgentTesla)", "value": "bab00e73497de8af1b474a9006b24958fd69b12f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686305257, "uuid": "958b4253-c453-4c52-a81d-b3160005fb62", "comment": "Malware payload (AgentTesla)", "value": "108609d8f7b04e27b08c3440488781b589336ce230a9af10a244832f9920debc326c4fe1d01266c8561b3d9d33a0f842", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686305257, "uuid": "f65c75d6-21b4-40d7-944c-d851d4d60de1", "value": "T1E1A4237B12B8FDDF07CB950BF69373AC8F0E60EB49147D4068AC84252874D4E626398E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686305257, "uuid": "7730d92e-e712-4186-b105-6cf6bef3becb", "value": "6144:b1rsyT/ZE2opEMgRHXx6y8IlyjbDEY/RV+gj3Mq/kHG6pTmbFLuRJauY7v+tUlOA:p7/22oqMglXgy8iYX53Mq//6sFiKuYFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686305257, "uuid": "ea492168-b3f8-4d79-9621-56faa2205e53", "value": 457189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686305257, "uuid": "2cb12f74-4d26-4d5b-8d80-cde67b140168", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686305257, "uuid": "71742690-e2e3-496c-963c-9513f5bfcdb4", "value": "Telex Release BL for 4704854 4665930.ARJ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a95cd755-06a4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686301478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301478, "uuid": "3604f52a-7c57-4483-a1f6-3b240b781ecb", "comment": "Malware payload (AgentTesla)", "value": "2402c29e427da138d43c2a6a2eaca870", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301478, "uuid": "4abf5ef7-b451-4609-9c24-cd54d0be627c", "comment": "Malware payload (AgentTesla)", "value": "c94280db9d63ff7ba0c3e1f92f48e9feb4c383285ceb2b79a00861ac446bca7c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301478, "uuid": "94e0fea5-f309-41fc-b32a-91fe3912a3ed", "comment": "Malware payload (AgentTesla)", "value": "bd12f4b91aa02d5e580ce3aa4d0b465deb158ce3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301478, "uuid": "00daab04-0ef9-4089-bad0-88e021074926", "comment": "Malware payload (AgentTesla)", "value": "88f14675430c18d9ab91911b919a8e8245b296fe3c98709795130f089a816019199886b38682eaaf9a7c0eaad0b5de6c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301478, "uuid": "48b0b652-4972-4515-a8b5-632e43096da1", "value": "T1128423130399DDC8854A46EEA8ED8376E7425931E83658BDF834BF473E35223EE61853", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301478, "uuid": "936ae02e-f89f-48b2-96ef-d2e974cf9de1", "value": "6144:81AmD9sx90D3YqBnceWaW6PG7gEniLLK0m7FnMK6chV+2C4IIzNuin9zPl5TAw0f:0lBsxoYqBncrd7gEiXK0m7FndhV+BsNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686301478, "uuid": "747b65d5-ce4c-4f6d-aa39-1e19bcb8d71e", "value": 374379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686301478, "uuid": "87229e3a-6c3f-4965-93bb-dcef97e809ab", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301478, "uuid": "18cebe30-b64f-4390-9d2e-a70f56a38af8", "value": "Quote EM092722.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53fe645d-0693-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686294033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294033, "uuid": "c0e1ab8d-8cc5-4ee7-b070-7effef0021f3", "comment": "Malware payload (Formbook)", "value": "03964ea54dd56c6be5d7295c75c31d5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294033, "uuid": "fc2e16ce-8916-4e00-aec0-9c85f962ca6a", "comment": "Malware payload (Formbook)", "value": "c9990afee1ca55f42a292a4fd4c81132e0a6825e99cba03444e285245297476a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294033, "uuid": "d0362a9d-cacb-4c95-a4d2-4e67fe29e7af", "comment": "Malware payload (Formbook)", "value": "65796ba3505653a3f1c200420bcbd680d2055bf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294033, "uuid": "99e55510-7fc3-4ed4-9a28-1b8202d77621", "comment": "Malware payload (Formbook)", "value": "d251a9434b088eefe0f894cdb535cc62df076514f59847e76535bccb1f840aff0206b29032e55ef9ef9d37894576dd5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294033, "uuid": "43d916f8-440b-4ff4-901a-c60304e52244", "value": "T13DD423244FE8E5E6FC91C7317E79ABDA2E75A6070C70B65A1391FF0E7107602D809792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294033, "uuid": "329ea618-db43-459e-aef8-1c1a2bd303bc", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294033, "uuid": "2fd74a46-04a1-4280-8086-0ff2afb439aa", "value": "12288:ZYD7OlRtNWDKhL3dmqNpPAf+KrN9XlYUnHDKBhuqv7ENHWhCw:ZYD7mtQutNpImKrLXtnjYIqv7EN2hZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686294033, "uuid": "83b6f241-f316-456f-8e97-9e931037c308", "value": 643889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686294033, "uuid": "12258009-0693-4e59-ba5f-5e387af402a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294033, "uuid": "80603db9-a2a7-499b-ab12-8f0d1a7a827e", "value": "RFQ-06062023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3008df38-06a1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (PrivateLoader)", "timestamp": 1686299986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299986, "uuid": "567d459c-0023-4ba1-b632-1a48ab31542f", "comment": "Malware payload (PrivateLoader)", "value": "e39512cff0d5a25c8e9f87ff213d14e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299986, "uuid": "87304740-570f-4cf5-8c99-a781bf8b841b", "comment": "Malware payload (PrivateLoader)", "value": "ca5a1526a7f3fcdc75fe9be2ea48f3f89d9762045d6b62c6e00d249a6c2d8c88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299986, "uuid": "aeffb637-1ae2-4ebb-b46b-0dd440c3b82e", "comment": "Malware payload (PrivateLoader)", "value": "a360d7f3ba75b850275f119782b8cd772635dc02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299986, "uuid": "db474cc5-defd-48df-a24f-656804b72af3", "comment": "Malware payload (PrivateLoader)", "value": "2777de3064d201037f6204351157f58d2443437e01940ddb7cb7ab7acf87291282af5ecb810ae4a2d9767f57016cf950", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299986, "uuid": "3bb60d15-7f7b-4985-8561-4271ac162367", "value": "T125169D12FA818035F5A601F292FE0B7A5ABCBE30131054D3D3C8699C6F655E1BB36B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299986, "uuid": "beb1c21a-0db8-4476-a0dc-6ea382bd0a8e", "value": "292aade11672b3abdd24722742cf6115", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299986, "uuid": "caed7e92-038a-425a-9940-ca9ca7144942", "value": "98304:J1S5nYFv7tmM5xeuYZ0KrCEdz/Fb0vo16UgSbfrT+7P7CbXIKc5zD6sILTjblMSN:Mz/uo1ZD2iLIKcosI3jhMSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686299986, "uuid": "5ae636f0-543f-41ea-9cc7-4dfc1c15d232", "value": 4223488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686299986, "uuid": "bad5cf4c-5b3d-4e87-a365-5d936969b71b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299986, "uuid": "ed5e9030-dfc7-4476-8892-7f0391e5bc6a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ad6b610-0693-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686294018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294018, "uuid": "a1e9244f-6339-4ee8-b833-a954cb748dd8", "comment": "Malware payload (RedLineStealer)", "value": "4c7c7f9e5fb5f706972574aca7a21260", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294018, "uuid": "e9cfb13c-3cb5-44a3-b27b-bac9bd8ed7e6", "comment": "Malware payload (RedLineStealer)", "value": "ca71816212ad21bb4e27bacdf9fd226acc1c9dbab6614e459b24212338f884dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294018, "uuid": "a08d57eb-300a-4961-9eb5-cd3c20bcd0d6", "comment": "Malware payload (RedLineStealer)", "value": "b2ae468be5e527db0a858bbe6b7f968479010975", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294018, "uuid": "2bae6ed4-4660-4199-89b5-3ff9af376d39", "comment": "Malware payload (RedLineStealer)", "value": "6bd9c7b9bbebcd268970d4e1a60d02a11535258149eedc30b102a6b0509d2e7072e0119a05dfc3348b45ccb33351bc5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294018, "uuid": "a73bfa7f-44a4-4fca-bb31-22f6bb57a5a3", "value": "T15B04C458364B657EC97F887D9C704CE46A7CACA21246AB079C8EF0E43D3B7819B151F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294018, "uuid": "e4fd0dfa-fa6b-4b38-9e52-cef62ec4a14d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294018, "uuid": "16cb24ed-f9d1-4bcf-a74e-dc401ebe09f3", "value": "1536:nF4TOrrH036sv0W7TNmNDrHS/VCN6eepZJk2ze9l/yx4xNx/YQ/7buLJoTIH0GkO:F4TOrLGYo/AK4xNymISIHH8e8hg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686294018, "uuid": "2b4f0116-d21a-40df-9027-e0bb35fca61d", "value": 176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686294018, "uuid": "28c45cbe-e1b5-4247-a707-a72043f9752c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294018, "uuid": "6f2f0726-f62d-4268-be20-0ac297368b16", "value": "4c7c7f9e5fb5f706972574aca7a21260.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3259c3e3-069c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686297842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297842, "uuid": "8887b1f8-5ad6-4898-9b67-4c610c8fa2ec", "comment": "Malware payload (SnakeKeylogger)", "value": "3ca828fc890e816e0328510d4a33129e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297842, "uuid": "b3822556-57ed-4d6b-96a5-34dfc569b3f6", "comment": "Malware payload (SnakeKeylogger)", "value": "cb0641e8f221b483c861a04a2cfa0840e4acf63f93095bc6ce7f250ff344dcea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297842, "uuid": "70911e88-41af-48e5-9c24-8dc197d518dc", "comment": "Malware payload (SnakeKeylogger)", "value": "ddbf8bebe1e979a6f3f1f7abb5278eec77966537", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297842, "uuid": "4cfb0f14-f564-40b0-9df7-5fa7724c35a6", "comment": "Malware payload (SnakeKeylogger)", "value": "b075cccf2b55aae959c2867e793933f7e7524ca030046ef0ee68c7bbc919c0eddf18366a6a6d7cba3495a2448568fa40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297842, "uuid": "3ecd6286-78cf-4b08-ae72-0ab5e5983e09", "value": "T14E2523017A06C4BBE1EE4F3F1A768F781AC4EE2619A6F3171350125C75A1C174BAABB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297842, "uuid": "03838782-f740-43ba-a971-8a36ca1395f3", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297842, "uuid": "124b412a-68ca-4a67-8c2a-d32de2880f56", "value": "24576:ZYDHiLp2ENU3m1WaxYESHSSROeGn5ydGDBjjxtyFWTP3TPM+:mAptlWoYW1eaQGDxVt0SPDU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686297842, "uuid": "c6b4b0e9-0ace-4dbd-9999-970a576d6112", "value": 981491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686297842, "uuid": "fb1fcd1d-db2e-4f8b-8edf-4ece5cb38906", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297842, "uuid": "8d720cf3-0329-4065-87a8-270be65bf313", "value": "bank swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2a2882-067b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686283818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686283818, "uuid": "7fb029b5-0b6a-466f-8852-d01403eafeeb", "comment": "Malware payload (Amadey)", "value": "f4d153c0a650e3183a8b29611c4c8ff1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686283818, "uuid": "ce22e2d2-bb39-4597-8961-f20e26742ae8", "comment": "Malware payload (Amadey)", "value": "cb4f213d58e190fd647be421ddd3e345a3d6e2281f103442f72dfbf5601cd408", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686283818, "uuid": "3fecf3e7-cd5e-4d1f-84f9-0075047dff9a", "comment": "Malware payload (Amadey)", "value": "4b33072bb61d0ed056fb52794cd79740d5497bf5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686283818, "uuid": "7f6bcf6e-43bc-4f4e-8552-6ff67f82ae08", "comment": "Malware payload (Amadey)", "value": "10de8decd00da94e0c59be0a3dc5b90e5e69fd8828c69eb295d5573d059063f52e426f6ab4a25dffb980ce8c5baf6742", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686283818, "uuid": "2900c9a9-9094-40e8-bf82-422a9175ea85", "value": "T1D5D41247FBE84572E9B517B028FA13C31B39BDA1A934532E2306694F1CB26D4E532727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686283818, "uuid": "bfb78ad6-4aa8-43fd-a83d-fc0b0c96bec3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686283818, "uuid": "3df3f98b-1d40-45a9-ba6b-164013cbe510", "value": "12288:GMrGy908Llncb7/tz+xMKbzLyKyQNGD0t2ciSr3:YyXBnEr8xMgHygNGD0t3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686283818, "uuid": "8588de3c-ecb5-487f-b4ec-c769b0078706", "value": 613376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686283818, "uuid": "2a9a8f5c-df19-48e0-adaf-e8feeb64a3c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686283818, "uuid": "f4d838ce-ac1e-4bad-b0a0-538db351e176", "value": "f4d153c0a650e3183a8b29611c4c8ff1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f96f64ab-0690-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686293022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293022, "uuid": "3931eadc-d9b0-4b72-935c-75a13c42281d", "comment": "Malware payload (Formbook)", "value": "129d14ceb2654fa798785a4928d8b9ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293022, "uuid": "5f2db053-484f-4069-902e-eeb98bb1e3d9", "comment": "Malware payload (Formbook)", "value": "cb50b7e491feb8d055174fd5ab348c2436f07ac29f4747236e997d29cbef61fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293022, "uuid": "bd407639-5cda-490a-8a93-e652c9a4140a", "comment": "Malware payload (Formbook)", "value": "75c0be5630b5b592eda5365ee51d72031c526909", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293022, "uuid": "83cc1474-ab38-4fd6-b203-c70961d8778d", "comment": "Malware payload (Formbook)", "value": "18e32973daa743a4b955a0b06f93f49a7e46ee2217bb4adc7deb48b1b885125807850946de15196919c1173c1117da1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293022, "uuid": "976e4f40-8092-41c7-bd1d-e7c5702c8fb9", "value": "T10B05021862FADB19E4BE7FF804C0907083F5A1567156E7460EC378DE1E75B828F4299B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293022, "uuid": "75141e2a-23e6-46ff-8074-5d9696b812fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293022, "uuid": "010cb9d7-926f-42cf-8d58-fdf852fba468", "value": "24576:3MOAWHlWxMiQW/O4ue7ktB0ChiOqkNgifoFbQAEo9j:zblYMiQWmS7MGOfOEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293022, "uuid": "905b2226-5976-4534-a682-7e8ad516b72c", "value": 860160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293022, "uuid": "32b91758-b5ff-4502-b1a1-b08e6b85deaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293022, "uuid": "e1c301f8-aa40-4bc4-8dfa-0c15971dd464", "value": "ORDER APPROVED #Pdr6YxrIb91jzTT#.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9844b4e-065e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686271467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271467, "uuid": "b91a4227-482a-4440-9d2e-6de8b1ac274c", "comment": "Malware payload (RedLineStealer)", "value": "4ff3735f063b6c47ee6384a5adffa7c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271467, "uuid": "fbb2e12e-9050-4fd9-8aab-2445ef82efdf", "comment": "Malware payload (RedLineStealer)", "value": "cc796a39d3a7d48581c28e249987d8ca8a2c1798bf39de1e19ef66536085ccaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271467, "uuid": "d756db90-ef39-4b8b-98a9-ce2e87912184", "comment": "Malware payload (RedLineStealer)", "value": "ad530004246fce8aca616ce6521cd16978e556e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271467, "uuid": "b3831e2c-5508-4e64-9a34-fd35e3faf109", "comment": "Malware payload (RedLineStealer)", "value": "b50528c094451de11a00171e34c4a00075f9ac3b665884a9111d7cf12ca1c06115e1e57885afe18471439bf9d5488d7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271467, "uuid": "f735e73b-35bb-4a80-8b31-f57870cc8c5a", "value": "T14BD41206B7E90036FDA61BB05CF713D30B35BDA259B4439B33416DAA0AB2AD0A531777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271467, "uuid": "88da8604-bf38-4f69-92e3-584bce6123ef", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271467, "uuid": "2dd036da-604c-4ff8-b53a-10b7067a0bd7", "value": "12288:8MrXy90RYMiSgIXoXUgw6D7XkzJAep4OoOhW6R6yckAu74VOU6:jydSgI4XUgwQo6UhWQ6tkAu7Y96", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686271467, "uuid": "00464fb0-da10-47de-acc7-310955af9b99", "value": 615424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686271467, "uuid": "233e19ab-c835-41b9-808b-cd1fc2754df7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271467, "uuid": "ec7ff262-a109-43e7-a308-d620ec7b55fa", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7eeeffd-0690-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686292993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292993, "uuid": "f482c018-5d79-4c32-9f2a-937101821a7f", "comment": "Malware payload (AgentTesla)", "value": "624de6b95e0057d42fe22be981e5ca38", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292993, "uuid": "7d69c75c-c2eb-41ec-94fe-c8f8df6a5931", "comment": "Malware payload (AgentTesla)", "value": "ccaeb0b170886fff263b2ee340badd07aa90186db8616f8947f330b5380a9a25", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292993, "uuid": "0287d2a0-1fe7-49f5-b87e-82821dfe43be", "comment": "Malware payload (AgentTesla)", "value": "2ea916c70b63b73f40a3aa02394556d82df3a835", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292993, "uuid": "939193d0-ea90-4871-8252-208b0c83fda0", "comment": "Malware payload (AgentTesla)", "value": "17cbb60d5d06c47bbe45564d8c6a9ffa86cfedf5443f8f1406a24dfefb141857596134173b6b7c4bb620a0610a2fb373", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292993, "uuid": "ab849eca-a33f-42fc-afc8-f96b4c1baa9e", "value": "T142E4230988DD989DB6415AB727E3FB02031D43D6B29B6D0AD374F2BD201A4CD41EB5FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292993, "uuid": "6bcf3bd3-5927-4553-9c4f-c7d1b53ae851", "value": "12288:9xh8udmSO2y1akaYe6UhdnzgVWIlagatpd94q6CSztMgcFtZGeoPZaNMXf1vsW7b:1YSOTwmUPNOajfUCQtMVZGzzXf1BP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686292993, "uuid": "668e51ab-e402-46f1-9a02-0bc84b031665", "value": 704997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686292993, "uuid": "319aa077-9069-4728-92e9-f7b2cd75f1bd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292993, "uuid": "b28bb2f0-3ccc-44a6-9582-a5652440b550", "value": "Invoice20233.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77e84114-06a4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686301395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301395, "uuid": "3a4841c0-0384-454f-99e7-dc971ca4784a", "comment": "Malware payload (AgentTesla)", "value": "4876888f39c5ca34c3f0beb74e780cbc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301395, "uuid": "280e5dcc-2c2e-40a6-94a0-6e13fa718134", "comment": "Malware payload (AgentTesla)", "value": "ccb3db997b58b968469df5b92f035c971fff3863a120992889c0d1507e2cdb9e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301395, "uuid": "e14b1199-74af-4e4f-b0dc-73ec22e0ad33", "comment": "Malware payload (AgentTesla)", "value": "e77f825f3e8a7a56d416fffb397268ed3244f2df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301395, "uuid": "62953c57-6343-4c7b-9d34-8a6c02cc3d38", "comment": "Malware payload (AgentTesla)", "value": "794442a6d944466676dea2852ee9380ae8fdb81b2ea5903aefec424470f9ca54f6027d8b7f7a58c0537d09f917debdc6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301395, "uuid": "f6432c06-11eb-44ca-ab2e-6543fb36161f", "value": "T1DB824B16B3F8C392D5FF0B35A87256800776B7B77812CF0F29D410EA5953B908A52BA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301395, "uuid": "456437fb-fa31-4b3f-9763-1f99452d17ce", "value": "384:SAqZSCDIqFDNOgLlPBB1kjNCa21wwhGo5x4f39esH+r5k41MOM2:mFDNBLlPF4FGxutSNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686301395, "uuid": "13162e4b-0291-410a-8ecc-aeadcfab74f6", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686301395, "uuid": "4a3fd1c4-f2bc-4eff-9000-9c2858078890", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301395, "uuid": "ce38c16d-5d3b-45a6-8545-0105c68a9a50", "value": "NEW_PO_3.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f63e8f5-06df-11ee-b3cf-42010a9c0076", "comment": "Malware payload (StrelaStealer)", "timestamp": 1686326586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686326586, "uuid": "2ff1f15f-220a-4e4f-ada9-fb342dcb1584", "comment": "Malware payload (StrelaStealer)", "value": "acd0eec0e0397688f5a22bd4eb8ac54a", "object_relation": "md5", "Tag": [ { "name": "12980215 Canada Inc.", "colour": "#2C28D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686326586, "uuid": "871f613a-19e1-4d76-8ba1-23140d493fbe", "comment": "Malware payload (StrelaStealer)", "value": "cdaa76263723a68b556dd109795aad222724b5ce4fd9aae0d1f913e34b6c4385", "object_relation": "sha256", "Tag": [ { "name": "12980215 Canada Inc.", "colour": "#2C28D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686326586, "uuid": "e9466a35-fac6-4d58-9f82-a1a1eebf15ac", "comment": "Malware payload (StrelaStealer)", "value": "c0828f881658cf3b5d4eeca6bc8f44dc031debae", "object_relation": "sha1", "Tag": [ { "name": "12980215 Canada Inc.", "colour": "#2C28D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686326586, "uuid": "f63cd259-2e36-416f-b234-b7c660ef7307", "comment": "Malware payload (StrelaStealer)", "value": "bec35409783d42d0ed3cc8147218cabe58b3f67cddc2e1d0b08dc1f5287db7c8e16736ebd043474ee00235737d54937e", "object_relation": "sha3-384", "Tag": [ { "name": "12980215 Canada Inc.", "colour": "#2C28D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686326586, "uuid": "e3e1919f-83ff-4c32-abbb-b5a80a83cb6f", "value": "T1FE727E523B682527CE8647FF9CD397242B305B071AA4DD9F9CF02AAD6F41391760237A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686326586, "uuid": "1df76a2a-6a8b-4a4f-94a4-55c7f49892e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686326586, "uuid": "c4488d72-02ba-4eef-ac09-98cd1fefa169", "value": "384:hZ8ocMqD0PF/1tZvDJMx+v4/kpwKNsy368Tng1:IaZrv9Mx+Q/RbkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686326586, "uuid": "2bfac353-3b73-43b1-86e6-c3879fccd5d4", "value": 16840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686326586, "uuid": "49783ec4-2676-402d-b3ba-144d66be9d85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686326586, "uuid": "5ad20755-583e-42c6-86c9-b8474490baf6", "value": "Fattura (7).bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c710a6-069f-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686299165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299165, "uuid": "c721eae6-ee23-4c65-99fb-9ca0a67da6a1", "comment": "Malware payload", "value": "58cfe01229b274358dced7c26d433c44", "object_relation": "md5", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299165, "uuid": "23eb1eb5-e5f4-4180-8b5d-2fb6b7cc3683", "comment": "Malware payload", "value": "ceb7b3bd060a2e95004ec503746a815ae9ed884d25b09fa3f62f816005f16427", "object_relation": "sha256", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299165, "uuid": "3fe8596c-6d28-4614-97a8-1db0aefa85ca", "comment": "Malware payload", "value": "a0017923e8d4468348673687c4a55a1e3d23602f", "object_relation": "sha1", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299165, "uuid": "dbb6265f-b897-4ead-9686-242699e184d9", "comment": "Malware payload", "value": "5b256c2c4c1d6be84b8f9ae53dea6a4fc15d12956d27af0db67fb42aeb66169f42cc00506a143b3ebb40e6a5acfa1d8b", "object_relation": "sha3-384", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299165, "uuid": "70d89993-62f1-4bdc-b3e9-eb9f4a7d2f15", "value": "T13EF433C19A8B4E51CC1157E0A7E0F426090A47BEF7379DD0E1EBE63A7FA1B1A4724253", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299165, "uuid": "eecd4a17-ab2d-43d5-8676-c9766cf0176b", "value": "12288:ahg7JpfAQMQpJUgUKpSYVdaS2AMlq+oeN5SuYQuRgYi+Ok0Dw0kBanmFlFZ8VeE:ahsYQMMJUGIXN5nYQuVip/Dw0kwuiVeE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686299165, "uuid": "68f4c024-a594-40f1-b515-589fca38d52a", "value": 748358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686299165, "uuid": "325a4db2-f2e4-44e5-acf7-173b34e2a30d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299165, "uuid": "01a4f337-9424-49ef-834b-71bf3476824d", "value": "quotation list.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf4f2c9-06a8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686303282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303282, "uuid": "06066031-b77c-47c9-bb64-4ed3cfecc44b", "comment": "Malware payload (AgentTesla)", "value": "1b8d663640efec2569212978b808f0c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303282, "uuid": "4d3a04f0-c1e8-4904-b51a-0eeabc3cf9a8", "comment": "Malware payload (AgentTesla)", "value": "cfc75e9e4f9a40fcfd3d8040a814a7922cde8086ea49087afafa6f23b97f048a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303282, "uuid": "df217d97-baf0-40c3-951c-0657e7719935", "comment": "Malware payload (AgentTesla)", "value": "16b4e1fd0eb44b901cca3cc67a0806eacd48123b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303282, "uuid": "1ecda937-2bab-46f9-9601-45b805b7dcdb", "comment": "Malware payload (AgentTesla)", "value": "d224241aec5d109fed85c5f447c6579c32b5927a719499baa8abf51211cc265cab5f3cc8e8e6ad79a3a9f379679d858b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303282, "uuid": "f5e6389c-458a-46d8-b151-65e802d22bce", "value": "T16B05E09863F9AF1BD0B96FFD0410107083F5596B313BE68B4DD2A4DEAE64F490A40E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303282, "uuid": "038973ff-dd2d-474b-aa1b-9bab285bfe02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303282, "uuid": "5f34a0cc-e837-4e3c-a02c-0ef54f629b33", "value": "12288:3UlRuv0haDnLMzIL2q+RTdOL8WIZq79S57BXxdlYvPmv7GmLlZi7:3UlRuSOyqGUL8WB7w57BhdlYvezNLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686303282, "uuid": "f64180e6-8f93-4dc6-8185-eab8fba936b2", "value": 814592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686303282, "uuid": "136ec53f-1c42-4311-aac2-1d20242324a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303282, "uuid": "f514ed60-d65a-4f0f-9023-d2a8afea07a1", "value": "RFQ-SIS190523CS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "626561b8-0692-11ee-b3cf-42010a9c0076", "comment": "Malware payload (VirLock)", "timestamp": 1686293628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293628, "uuid": "e9f52fd1-da46-4748-9dfd-bcd7ba65ad62", "comment": "Malware payload (VirLock)", "value": "a0a7022caa8bd8761d6722fe3172c0af", "object_relation": "md5", "Tag": [ { "name": "VirLock", "colour": "#148CF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293628, "uuid": "ee9da3d7-810c-42d0-a234-0b0b35fa1844", "comment": "Malware payload (VirLock)", "value": "d174f0c6ded55eb315320750aaa3152fc241acbfaef662bf691ffd0080327ab9", "object_relation": "sha256", "Tag": [ { "name": "VirLock", "colour": "#148CF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293628, "uuid": "1670bb78-18d2-40c5-8f97-89885a22ed76", "comment": "Malware payload (VirLock)", "value": "9c694094bcbeb6e87cd8dd03b80b48ac1041adc9", "object_relation": "sha1", "Tag": [ { "name": "VirLock", "colour": "#148CF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293628, "uuid": "d4e036be-ba60-46ca-8a57-1f0ff4f66bde", "comment": "Malware payload (VirLock)", "value": "cf686d44afed6d4db80d25724b2d742f5d770ac6517c4b06964adf22e0c0afd7366ae79065908564fccd27878ad75b09", "object_relation": "sha3-384", "Tag": [ { "name": "VirLock", "colour": "#148CF2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293628, "uuid": "328ca3ce-1017-4b6c-ab62-fdbdda3ac73c", "value": "T1A763C394A05083B1F761817692BB2DF7192FA8B273896EF3D395D06CF1A31E0F726641", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293628, "uuid": "4cbb1b4a-4c5f-4502-b53e-4392c6fb6ab0", "value": "5d6c401a6b949a20cdf7ef6568832788", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293628, "uuid": "bf89cd66-3099-4177-8918-fff40d131d28", "value": "1536:axwfRBCQY6gnX640EEIibAapV2kjg281fgKqjHAnD7gnVe7RqUR0O+GX3k:aifRkQY6gX64BEIibAapVP8281fgKqj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293628, "uuid": "1048a05e-8d63-43f5-ad0b-0bf6e93b6b09", "value": 68608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293628, "uuid": "381da3e2-3a3c-44cd-adf8-46b0f081a451", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293628, "uuid": "9cfe8c9c-9e4b-4351-8d5a-2a32145ed708", "value": "07084799.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bcd0075-0692-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686293482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293482, "uuid": "c1c82df8-0571-4d2b-8901-e084ebfa245c", "comment": "Malware payload", "value": "8a241cfcc23dc740e1fadc7f2df3965e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293482, "uuid": "21f857d5-1ac2-4ff7-854e-dd8e0c4b6de8", "comment": "Malware payload", "value": "d4b6524315d5de727a8af3e4e73e8b28dab27c62fd0a6a7a891460061c2f3d60", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293482, "uuid": "77dd65a9-3488-40af-aaeb-e907ed60b502", "comment": "Malware payload", "value": "1a5faa5637bec9805039a93d6e199bac26fce413", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293482, "uuid": "998865a7-15db-41a6-adad-8147593a77b6", "comment": "Malware payload", "value": "7cfd91344d0f7f271cb6b4c4f3afd78c292a2e413fce7c7e635237dfabe1a9c7755d6a64a5c58a9fa10aa40acb6d27fc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293482, "uuid": "29d63d76-b9c0-4daf-8c9f-7eab82ea3f16", "value": "T1AF157C03B3C7C0B6EFA229F3D97557325939B8242B3C89CBB7D4282DC9906C16A75359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293482, "uuid": "5d75fe71-d39e-4fe4-a50b-a8e2ed7a2520", "value": "b69d08e7a9e8d45257d48420e3bd8e18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293482, "uuid": "3d06c209-d949-490f-b525-dc70e06857e2", "value": "24576:CImRL6PbLwYTirTy9KJ+UsrTo3XuSKqLRS:TmebMdZIUgoO0R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293482, "uuid": "4799f5b9-0785-47cf-82ab-4c2ecdc3aa06", "value": 899584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293482, "uuid": "0d408c26-482e-437b-9d40-ea5abe84be55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293482, "uuid": "533d9470-8bce-4714-adc4-48147d4c9245", "value": "03854199.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbc39cc0-06f3-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686335439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686335439, "uuid": "030e53b0-7d54-4061-8ca3-0e7f3dc4472e", "comment": "Malware payload", "value": "58023a18dbd4101884c91549374f2dc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686335439, "uuid": "6e63d83b-e070-4625-834b-3e9d96c2bca7", "comment": "Malware payload", "value": "d58b2540494683fd6a4bfb1be1cf43896a1da9c3cf5ec1a4a6997e84c4b3b69a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686335439, "uuid": "0b78da9d-a988-4d2b-b151-fe575f833b5b", "comment": "Malware payload", "value": "408fa3c3e7f3dfa1f9800fbf4cff4d96e309ef83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686335439, "uuid": "02b93af1-5bb0-404f-ad46-347731d82888", "comment": "Malware payload", "value": "6f219903a00278fde3f67b6823159acefca26aa5a672ba7d12d8a1634cafdea970e28e7dd2ae874158e8803e9a61b873", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686335439, "uuid": "5ed3fd03-7928-4f9a-8dd9-bc4f045a79db", "value": "T1D7A34A47F9F1CC52D0208930555B9BE9DBF3F8564A021A47ABD4BF2F9872B05EE2A11C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686335439, "uuid": "a64557ec-4134-41e3-8ece-ddc2b00d4541", "value": "859223dea7d35704c3e28ae56f082f65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686335439, "uuid": "503b2cab-44d0-47e1-b9f1-1fb06e4d2614", "value": "768:IJHw3QtToCx7ILxE3mti1iN65sQqRM1cOA9F0v:anToCx7ILxE3xMN65sotA9F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686335439, "uuid": "69a4a41b-cb58-4552-ab3a-57d0a03ecb57", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686335439, "uuid": "452faa45-13e1-4525-9f02-898afc30e410", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686335439, "uuid": "e16b4aaf-5940-483f-8749-212f7cee9153", "value": "SecuriteInfo.com.PUA.Tool.MDCrack.12898.16823", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "431938bd-06c2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686314191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686314191, "uuid": "e73140e6-5076-4a24-9594-f7051ff1a900", "comment": "Malware payload (Formbook)", "value": "6e108faf5eeb7791325b1059ecbe617b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686314191, "uuid": "d26395f9-e709-4a20-b67b-44ce2b4b588a", "comment": "Malware payload (Formbook)", "value": "d612f5bbe5a52c3bfa7bae355fea53d60f252f0bad240bf12af3d31666b5fcf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686314191, "uuid": "17a7e545-c834-402c-9d4a-3125d25c07ee", "comment": "Malware payload (Formbook)", "value": "1681e84c42516e88b50f2b7b51555baea1db50d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686314191, "uuid": "34e2e055-33d3-45c5-8abf-e7a9dba3f66e", "comment": "Malware payload (Formbook)", "value": "f6a8b371c90187f87990c609518fc79cd1b650b2407ed008e52df826cb6d68d5241620d8cdf46527949baa9a76483302", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686314191, "uuid": "1a6e75d2-4557-4da0-b0e4-a66c6a255373", "value": "T167A49D2771DCEACBD4AC89755C2AF73D7112AC2584228C16BD8AF84DD0F165269F3A3C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686314191, "uuid": "ba089b69-5165-454d-9108-a871301c62a3", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686314191, "uuid": "e60d5fc7-317a-4078-ad09-08ec7ca11e6c", "value": "6144:+Ya6vdMC5muIKMGOZ9pgeOr+Nr+cNo0XUuvNS:+YXpkaCpTN5Uu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686314191, "uuid": "e044298a-bc1a-4be0-a8e4-33acb3cd62e1", "value": 479022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686314191, "uuid": "e133adad-4df6-404f-80b4-c77add16ecf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686314191, "uuid": "4e1d0006-047f-4b49-a01d-ebe74de2ecda", "value": "AGRUBU 0550.06092023.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "950aa420-0692-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686293713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293713, "uuid": "08a88f9d-37da-4180-a028-9fe4fb7f4930", "comment": "Malware payload", "value": "3aab057312f4f899b322f3f282eba2f3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293713, "uuid": "8bc4a38e-0b12-4b5f-a0a5-37194645f495", "comment": "Malware payload", "value": "d69ab6b8780792026dc20e123afbb0e8eab342cbe19b705cb2e1e03d19551986", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293713, "uuid": "2e57ac24-2a70-48ef-b07f-2a213fe2d606", "comment": "Malware payload", "value": "53907d8c91acd85e53c058562a7f61e998bd9002", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293713, "uuid": "dd91b9e8-dbe2-4b33-9730-3980b4a4e073", "comment": "Malware payload", "value": "d306b61a0989dcc6045a45844dbbd6e98c578cc541e30164473c89a4c209c6c65497aa68c387d1bab57aaf58ad36ef18", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293713, "uuid": "f8767bda-2201-4987-9d2e-c9c70e23dbf6", "value": "T13516AF11F7B2C4B4C98705714A1AFBF650B4E72D88209CD7A7C4EE5DAF32CD2D129A1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293713, "uuid": "65cc02c7-e90b-4cf9-960a-e7d947ebb877", "value": "f0668a314ba5d4392ffaa4e2d7f980ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293713, "uuid": "ea27d99b-ae2a-46b4-8aa4-be7f6190328d", "value": "98304:l7uFXK3RGjr6hbrFjuj6gOzZPuGjr6hbrFjuj6gOzZP:lIK3Q36tpjuj6gYP736tpjuj6gYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293713, "uuid": "bd4bf054-db16-4cb8-af2a-50c584f71b5a", "value": 4408320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293713, "uuid": "c7f2432e-dc9d-4408-90ed-5d66bebf7c34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293713, "uuid": "33aa5195-6bea-4bf4-9381-87862c777254", "value": "09490699.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "643d5fb8-069d-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686298355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298355, "uuid": "a83ddaa8-3d5c-47c1-bc79-d848653cecd4", "comment": "Malware payload", "value": "f7750a93372db7951006304133ad737a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298355, "uuid": "f98baa1b-fc90-4f65-b63c-cfaa7cce0c3e", "comment": "Malware payload", "value": "d6f5f66e63c87f7bd8b50fa0327beaed10a8b19f0402ec623616d4c638e962c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298355, "uuid": "dd22afcd-1a1d-410a-bf2b-c51a1fc478d2", "comment": "Malware payload", "value": "9a08bf0a7a46da1e7025de8c9a6ba6b7df77d0bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686298355, "uuid": "fb159326-cf23-476a-99a8-17ce6a1aed3b", "comment": "Malware payload", "value": "46379bb820b8130cffd634d2281864f507d6d703e72606bec6353a899027f7bcd0f71c1ccde8cdaa213516d66e9d16ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686298355, "uuid": "80aaa914-b892-4bb8-b7d5-2e16056ac68d", "value": "T173F4126C22B7865EC4AB7FBC0C1246B0C7F81941B563C5475EABACCDCE16B240EC8997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686298355, "uuid": "29503f23-020c-47ff-8f2a-b1df31eb4e0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686298355, "uuid": "6e5e8f27-24e9-432f-b831-db076d63560e", "value": "12288:52iNUewx/NscEQ+vgXK1HsaIrQnUdFu1C4AZuQZ+q8krXYQovWIXJxOdSQxl4+:51iewlqB6pN0Udk1CTAw384voHfil", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686298355, "uuid": "9b1bd1ee-5a14-4e42-bd49-e1d8c1840102", "value": 780288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686298355, "uuid": "2c76ecfc-85e1-4c0d-8cef-c1f6d8f123c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686298355, "uuid": "90e7b9f6-c9e1-4be2-a3f8-25ac308e0f66", "value": "proforma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f2fe83e-0692-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CryptoLocker)", "timestamp": 1686293488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293488, "uuid": "dcaf6ee4-62f5-4cf2-a0cd-e9344d014678", "comment": "Malware payload (CryptoLocker)", "value": "04fb36199787f2e3e2135611a38321eb", "object_relation": "md5", "Tag": [ { "name": "Cryptolocker", "colour": "#BD8F97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293488, "uuid": "92cef77d-e8be-44c0-ae10-f762e49569e7", "comment": "Malware payload (CryptoLocker)", "value": "d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9", "object_relation": "sha256", "Tag": [ { "name": "Cryptolocker", "colour": "#BD8F97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293488, "uuid": "4815ce84-2caa-4f8d-be07-2ce7b6cbed6a", "comment": "Malware payload (CryptoLocker)", "value": "65559245709fe98052eb284577f1fd61c01ad20d", "object_relation": "sha1", "Tag": [ { "name": "Cryptolocker", "colour": "#BD8F97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293488, "uuid": "e8e0b854-7264-4d37-b583-0ab9b6f048cc", "comment": "Malware payload (CryptoLocker)", "value": "dcdd229f3bafda610a5bf3e46d7147c60dd9a2708606d52730b68faa70209b91fd09db19d6dac20a8f30b98187ce9bba", "object_relation": "sha3-384", "Tag": [ { "name": "Cryptolocker", "colour": "#BD8F97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293488, "uuid": "f4e34d2d-d1ea-470b-b82b-41c628255a5b", "value": "T14F74E073B4919525E9E04DB4F6B9BD324639B8396F3D4BC792842D4E04701CBEAB9383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293488, "uuid": "fab6b550-8f11-4a6c-a768-372071ca90e4", "value": "7e8ad4139efc6cbcf31df3bc4b291dd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293488, "uuid": "6044e6af-8d0b-456a-b819-a7d048dc3cc2", "value": "6144:sWmw0EuCN0pLWgTO3x5N22vWvLRKKAX5l++SybIvC:sWkEuCaNT85I2vCMX5l+ZRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293488, "uuid": "9e735d14-1a43-4dc1-9718-bf2ce6fa19f3", "value": 346112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293488, "uuid": "edfbb3b1-a169-48e1-ad6f-8b0c2aeac012", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293488, "uuid": "66ff6cad-3ccc-448e-aecb-c5c7eb914b60", "value": "03989399.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07cb561a-06df-11ee-b3cf-42010a9c0076", "comment": "Malware payload (StrelaStealer)", "timestamp": 1686326547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686326547, "uuid": "9041ba1c-514c-48fb-acfa-d06d66399383", "comment": "Malware payload (StrelaStealer)", "value": "604263484e38494433439fc665646bd6", "object_relation": "md5", "Tag": [ { "name": "12980215 Canada Inc.", "colour": "#2C28D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686326547, "uuid": "4d778fa9-6363-4f2b-983b-ef47e9c2bc60", "comment": "Malware payload (StrelaStealer)", "value": "d9a84cdee2815df1b496dc6f268fb7367c9cb617604b7913607fdfc0ad346915", "object_relation": "sha256", "Tag": [ { "name": "12980215 Canada Inc.", "colour": "#2C28D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686326547, "uuid": "955847a2-3a8a-4568-9f39-ee1eb9251690", "comment": "Malware payload (StrelaStealer)", "value": "bc2dcfc1421731c6b1f1cc17126575376628202d", "object_relation": "sha1", "Tag": [ { "name": "12980215 Canada Inc.", "colour": "#2C28D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686326547, "uuid": "d84d26cf-0396-43e9-830e-ea533e017025", "comment": "Malware payload (StrelaStealer)", "value": "b9eb9980b045f0fd527bc1cd6c99f850cb90528e295a88fbc3462176800fcbc85880e4e1ad449e5021f0bba8ddb1409f", "object_relation": "sha3-384", "Tag": [ { "name": "12980215 Canada Inc.", "colour": "#2C28D5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686326547, "uuid": "5fcc5d9c-1849-4951-94f9-f9ab48713bfb", "value": "T121728D523B682627CE8947FFACD397242B309B0716B4DD9F5CF12AAD5B01391760227B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686326547, "uuid": "07bb22ee-4c31-48b6-b210-f8b3c6523de3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686326547, "uuid": "328fe9f1-e4d4-4412-8751-40db99f7eece", "value": "384:lZ8ocMqD0PF/1tZvDJMx+a4/0pwKNsy368TKsy:kaZrv9Mx+D/BbkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686326547, "uuid": "5f1316b6-b720-4a9a-8ec1-331c38624413", "value": 16840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686326547, "uuid": "3add9887-e22c-4dce-9dd4-e233bcd2529f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686326547, "uuid": "854150e9-7e07-4bfc-baca-cad500d84b02", "value": "Fattura (1).bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2083c37f-0693-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686293947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293947, "uuid": "3ec186bb-2581-40c9-929d-5e467dcec205", "comment": "Malware payload (Formbook)", "value": "49e7854bcfc4316d396cf9b2dbcc0da4", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293947, "uuid": "d83a5abe-6671-4ff1-89d8-98ba38239746", "comment": "Malware payload (Formbook)", "value": "da3b69ceb1129208e8a71301c40044a3263e88caf9884588f1d09d0b549b0140", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293947, "uuid": "9f3e8cc0-2558-4bb3-9bda-fb622c2bc452", "comment": "Malware payload (Formbook)", "value": "e3380f03095e3271d20282206c23b169a34c249d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293947, "uuid": "5202b998-2456-4d5e-b586-7de090c2391e", "comment": "Malware payload (Formbook)", "value": "f7c536530c9572fb6edff3efb6d2148c88adf926dc465879060d79129c20cd758b75f3cc3a9d19320c309e8725925233", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293947, "uuid": "e0174776-47eb-47c0-b2d7-21e8488d03c2", "value": "T154E21A5AE79B02B88F511272271F0E88A67DB23EB3515572746C833433E9C3E42766BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293947, "uuid": "0231084e-144d-442d-a4c5-73b8ab1599a4", "value": "768:0Fx0XaIsnPRIa4fwJMYSRN+fzolY3YVdT9+6F7U:0f0Xvx3EMnP+ro5Vdh+6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293947, "uuid": "37f3f683-1cfa-462b-b29e-0b7eb885dde4", "value": 31213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293947, "uuid": "c0e8cd7c-7099-454d-9425-c933ef70ca53", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293947, "uuid": "bcef121a-b290-45c4-8012-c96e2e1f1c97", "value": "MT103-Payment.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06aa9374-06c0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686313231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686313231, "uuid": "c5d758a7-a0db-4c8d-8e44-1352a5e8f12e", "comment": "Malware payload", "value": "c4a3584e8d6323d0a07a7a1159163997", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686313231, "uuid": "1b705247-a40e-4226-a02b-106507657a57", "comment": "Malware payload", "value": "dab816b127df34b88baa067ce8c326c97ff61d496b0b60adc3d0507817a0b592", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686313231, "uuid": "f9002096-4a44-4cf8-91e5-813f907c81fd", "comment": "Malware payload", "value": "45d45693b3b1abed317fda108f489e2fab9ecd60", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686313231, "uuid": "3c60f244-e175-4d60-904d-f97ee50269b2", "comment": "Malware payload", "value": "8a3e5b68c2536de838730518c3696f481f7183887e7e319fdd6593d831758bd215d573c8c08b008b3061137237bd994c", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686313231, "uuid": "e84dde0c-f1ce-49b6-b5c8-0971a57f94e6", "value": "T182E1AFF773A31F1E62D660BF36F262440832619B206A473BC3556E5D06C16569EC2334", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686313231, "uuid": "ccdcd97f-1e25-46c3-8d26-34d0d3906293", "value": "192:dGK+Hvhoackpmuj1zBR8FmTHsOhDn3U/lE4Sz8g:gVH+DamOzBR8Fm7s+n3U6Kg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686313231, "uuid": "654afb01-a70d-47a8-82f9-4941e3faca47", "value": 6965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686313231, "uuid": "a4c84c2a-1b07-42f4-829a-0585181d7515", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686313231, "uuid": "749ba5e9-b8ed-4fcc-a4fe-45eec103ed9f", "value": "Product_List & Samples_# 061300022550.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23ed51ca-06a8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686302972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302972, "uuid": "fe4ac31f-b7af-4181-8d36-7ea12fff03b2", "comment": "Malware payload (Loki)", "value": "fd6109c5ac3dd70fe38effa37f308f6b", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302972, "uuid": "3fe505fb-f4f2-4c76-9ecd-2b1cc7ef8d0c", "comment": "Malware payload (Loki)", "value": "dc70e4e9225430f194a4a4f79f127f0e847633d10854dcd1dad06cdd190cda4e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302972, "uuid": "dc2daa9b-1a7b-49bc-9f5b-0f14a0bb2b68", "comment": "Malware payload (Loki)", "value": "b761a6e71b402ac934df25ef46995ebf2ed60bed", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686302972, "uuid": "28bd9936-1bb6-4b8d-b480-3693a250f8b8", "comment": "Malware payload (Loki)", "value": "bc77592a5c1bbf818fa864dc18f5dbd0677d08e602f8517891a6e94131a922f2d880a3e013b7598086ff7da1421f963f", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302972, "uuid": "29b39c39-b781-42a1-bac6-1f00269eeb6a", "value": "T1B5D423583CBCD877C591AE6B7C438E8CE26CA0709A85DF0CC5EDBC0AFD2261D8D9554A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302972, "uuid": "35ba0842-979b-4b03-adce-8fccda3aeeec", "value": "12288:tgYVgf1hyA+KIqUNXpqHYg2A7EBCuupRBLqQMSQdkFIctHGc7lfnGpzD9yBwY:tFg1Mhn5q4gfKEQuIapQzD9yB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686302972, "uuid": "ca6f6404-eaf5-4ebc-bac1-9b981c6691e2", "value": 614290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686302972, "uuid": "af73c38e-4b63-4b13-9628-d684d92453a4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686302972, "uuid": "d878c5c6-a9ae-4c62-bcff-b87665cb9e1a", "value": "shipping docs S14-213008.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9866bcf5-06a8-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686303167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303167, "uuid": "df9d5986-c05f-4507-8eb2-961c0511abdd", "comment": "Malware payload", "value": "14305aaeb3a2f9a2e6b7a21c5793f011", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303167, "uuid": "cb1deb5d-024d-4c18-8adf-103986a36cda", "comment": "Malware payload", "value": "dd77a37a3fb9a99a1226dd79ec752f986bfbd5905cbfd62f38b978e6733f9bdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303167, "uuid": "df6dfd71-10aa-4d1e-8dc7-750ba474271b", "comment": "Malware payload", "value": "33b7cf77849f81b1f9a0f74ea6fd9d78d4d63871", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303167, "uuid": "423b10ef-d037-4fe6-8218-bb3450048df5", "comment": "Malware payload", "value": "d90396dba2b802ed801cf5a09940713c13c770907ba44510e5ba0cb43715012e8450f550a04c33a76af0be03dbf98b60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303167, "uuid": "2e0b80ea-951c-42a0-89a7-0f988de6ce8c", "value": "T1F7948D84B19EE174CC6200FF106E8419AF5E91BA927FF6C27F7163482AF3A9537509B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303167, "uuid": "00f3c0c1-33d5-447f-8656-d1c0f112a928", "value": "3a2003ea545fe942681da9e7683ebb58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303167, "uuid": "629d03d4-2cd0-4efe-9de1-955e99a2aed3", "value": "12288:4jauDReWmpDLyayGCF0t0sMDBETzArAG4:4DDqNyayRFnvBEgg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686303167, "uuid": "f9273638-391e-4441-96aa-4f28ecb41837", "value": 413782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686303167, "uuid": "fc12dba1-2d0f-4efc-8e3d-7cfd04797bd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303167, "uuid": "666026d3-cec6-421f-8d1e-3173b25ad026", "value": "dd77a37a3fb9a99a1226dd79ec752f986bfbd5905cbfd62f38b978e6733f9bdb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9bd37ba-0694-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AZORult)", "timestamp": 1686294606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294606, "uuid": "30394263-33c2-4838-8882-d11a73be4e21", "comment": "Malware payload (AZORult)", "value": "ece179c11014574fb33ac7b9bdf2890a", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294606, "uuid": "1a62ce90-a861-4ab9-b3fe-4cf7efd728c6", "comment": "Malware payload (AZORult)", "value": "dd9c79380713c26e11bbc7e83475be40de44e73348e66129252cdb042199af3d", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294606, "uuid": "85fa823b-90a5-41f3-8213-84eb3017dbcf", "comment": "Malware payload (AZORult)", "value": "2ea5c3da5162fee2d1b402f9f03c53bc4fae03af", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294606, "uuid": "d860c7c3-6c49-4255-9842-a4cd70b61d90", "comment": "Malware payload (AZORult)", "value": "c03b53a53895faa48f79ffc8dbd5d87b4429a7f4de0afdfcb0d511cf5852c93ae305aee6df791e3e28a0c09cc69cd34b", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294606, "uuid": "398633eb-8494-497b-8f58-f08dfe9427d4", "value": "T14DF4AFA2F500804FDE28183FF576766C2AA16FED988A76D12351B7D71C72A52C38F50B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294606, "uuid": "40332849-2a3e-4ae3-b5f8-7261aba3da6d", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294606, "uuid": "8f866215-1092-4021-8386-a42ae1530207", "value": "12288:dgQ44tKeaUrUNZIPWchYVC+SZ3fKuQMSl4uWWsGo:d0CKagk+I8uQpW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686294606, "uuid": "b1aa2cfb-122e-42e0-93b7-322475eb2262", "value": 724960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686294606, "uuid": "afeb3fa9-7e50-4462-95f0-ab05cb044338", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294606, "uuid": "195b3407-ea10-47a4-b289-c0a4efef3bd6", "value": "Products specifications.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c6966a4-0692-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Dharma)", "timestamp": 1686293537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293537, "uuid": "33de19bc-a40c-468d-bc3c-05dc1022375d", "comment": "Malware payload (Dharma)", "value": "055d1462f66a350d9886542d4d79bc2b", "object_relation": "md5", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293537, "uuid": "8df6376a-8880-43da-953a-e393f5072187", "comment": "Malware payload (Dharma)", "value": "dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0", "object_relation": "sha256", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293537, "uuid": "798a9d2f-6d25-44f0-ba75-311b77465844", "comment": "Malware payload (Dharma)", "value": "f1086d2f667d807dbb1aa362a7a809ea119f2565", "object_relation": "sha1", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293537, "uuid": "b96a0a29-32ae-40c5-a1fd-e7f043d0733b", "comment": "Malware payload (Dharma)", "value": "1bff9d0e545fd5c2260fb34248936716e2026c7fe1f794e50fe7f5f8671fad4e712ab71ce8fc68acf8356681a2a741b6", "object_relation": "sha3-384", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293537, "uuid": "57249aef-7125-448a-8643-c614a88d78a4", "value": "T18F357D22E6A390F1C0652170BD6EB7FF99273C544F1889E7A3D4361C6AB01D10DFBA96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293537, "uuid": "3078cdde-cdde-41a1-ae67-f6dab956a652", "value": "ad451900c0686f591cc20de73cdf7830", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293537, "uuid": "b77863d4-6532-493b-8c44-aa919881b22b", "value": "24576:FRYz/ERA0eMuWfHvgPw/83JI8CorP9qY0:FE/yADMuYvgP93JIc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293537, "uuid": "03973fa1-b41f-48a8-9395-66f3aa8d1ac5", "value": 1062912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293537, "uuid": "496c8d18-3469-4ebb-8ec5-4982831b34ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293537, "uuid": "643fed5d-2a9e-43e5-ad2a-fc90fca808c0", "value": "05484199.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2d61ae7-0691-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686293414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293414, "uuid": "31c01d60-c347-4cea-b2b8-592fdd8810ea", "comment": "Malware payload", "value": "7e179d064b2d20b4ea5e6d492abf8f2b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293414, "uuid": "fee7f6c0-7bd9-4dbf-b3c1-643b39d85293", "comment": "Malware payload", "value": "dfc56a704b5e031f3b0d2d0ea1d06f9157758ad950483b44ac4b77d33293cb38", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293414, "uuid": "adb6f1ed-d083-47b1-a9db-9289be8d51f2", "comment": "Malware payload", "value": "443f89939b9cd36a169aa04e15fa0637ec228a93", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293414, "uuid": "ad852324-d604-44a1-8f5a-7f1c7eab546d", "comment": "Malware payload", "value": "1828694ea6faa4228f4513442cec70323fb984b04576e89c41eb91538d4e58b16fcfdb6bcb85f9752e392a744fbb71e8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293414, "uuid": "35a5112d-2cfa-4e87-b6fd-a00c26404c37", "value": "T1B5058F02F59180F6C655153015AABB3AAA37A6024F24CFC7A7A8EE5D7D331D0DD3723A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293414, "uuid": "225d0f11-c35e-4aa0-a478-5d3318159b3c", "value": "003c10d19e270b817faa7e33f2d6a323", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293414, "uuid": "6aec1fd5-2135-4649-a0ee-156fd3c6d590", "value": "12288:axPVLTOnLRrLHO0zKX1AsE7eTZni5Kyt5dh2:a5V/OLRnHFzKFAsTTZiUyt5dh2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293414, "uuid": "60456447-0ea7-42e1-9f71-042254127924", "value": 864256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293414, "uuid": "3ab4d817-ec50-4646-90e0-fc4ae73f8048", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293414, "uuid": "bda7d2ec-0175-47d4-9941-98179fc093b5", "value": "01831199.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38bea17c-06cf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686319757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686319757, "uuid": "cd82de47-cb84-4afb-937a-a049606c2d12", "comment": "Malware payload (RedLineStealer)", "value": "632b578b72ca75b9303527299fb314e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686319757, "uuid": "bb656e91-9419-4322-9a83-52077815dd48", "comment": "Malware payload (RedLineStealer)", "value": "dffcae84ebda170d95386a17f14c0dc450adc3b05fccf1f7a53d0cd65c2bf3d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686319757, "uuid": "0f758300-4c6a-45f8-a193-b75bace7ba86", "comment": "Malware payload (RedLineStealer)", "value": "3b54f8b5ced1473df826d9e64d0617c502fd05f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686319757, "uuid": "d97b31a4-bd7c-4911-86ef-6e4388c9cd69", "comment": "Malware payload (RedLineStealer)", "value": "6e2eefc93aa28cda984347f8bb30343dfda92edaa9e2802cb8d284773ba7ef379e6e951406dde2b66804aecffd66176e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686319757, "uuid": "64535856-b8d0-424d-96d4-0bfae0f1c6d3", "value": "T1D194231757F4D50BD9D283706ABF21E36F3DAB1229F8460A0B600E2D3A357919A193B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686319757, "uuid": "7cfa217d-c4d2-4fd5-85c9-6f502f040239", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686319757, "uuid": "483d3553-0911-4259-9df8-c6f039ea7152", "value": "12288:/YoQJwJcrHbqUtjlCpqAQaJHb7iOC6nGo13wuW9Y5Ak9:/Yo4scDbZCQAz96Uj3wz9Jw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686319757, "uuid": "756f7f27-64aa-4e78-8774-56a3e24e9ad0", "value": 432314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686319757, "uuid": "be79a42e-9563-4420-b289-e2f11b69c2df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686319757, "uuid": "087b87ca-0e99-4cab-a906-bd1d38fb1e8c", "value": "rPO-59035.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "828a3054-06a3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686300983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686300983, "uuid": "041620ca-662a-405d-a2d4-1201b63c34e4", "comment": "Malware payload (RedLineStealer)", "value": "aeecd80aaa207ae9555ba4aa1caf9c6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686300983, "uuid": "98c1a13a-a9df-467f-9f5a-379a882fca9d", "comment": "Malware payload (RedLineStealer)", "value": "e025d1cd91880ce26cf9bcbc4ec1689c5769e7b8a74cde1b5d606a226f14d6dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686300983, "uuid": "100e4075-b3b2-4dc0-85e4-c59d8fcb8e70", "comment": "Malware payload (RedLineStealer)", "value": "4d0ea6ec5eb5c2171cd1e6095d2f4213c8d46268", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686300983, "uuid": "26c8a5fb-278e-4377-b2c5-7c1315564b75", "comment": "Malware payload (RedLineStealer)", "value": "579d98b3d4ea8948f69414eb3dacd55465416a9b80b15f7997dde8af995f5cc8f2a78f801aab0ca74e18398dd66dbf59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686300983, "uuid": "a8d45f31-21ea-43b9-bae1-7b5bdc195893", "value": "T11A44AE163682403DC9E2173A99F64172A5B9E1304B6069FF33506E3A8F613C299F677F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686300983, "uuid": "d74bd398-eac9-41be-9aea-5bb3fd6cb905", "value": "eeed1d5b1f2961ffe63cf4606ba4e44d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686300983, "uuid": "04ca02dc-5965-457d-840a-1086982fabc8", "value": "6144:AD5k3As3tgCHwbg1rLBsEV+NphkSMIWWVXEw0a:AD2yCl1OEVCtMWV/0a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686300983, "uuid": "cd6ba3f0-3227-4ad8-a385-64443d0f50a0", "value": 270968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686300983, "uuid": "efacb033-84af-4d46-9658-bbc0c5404910", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686300983, "uuid": "0a90027b-7dd9-4399-a458-7bfb50796ea9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9d217a2-0691-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Petya)", "timestamp": 1686293425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293425, "uuid": "3b209782-c1f2-4f37-abbc-0fa8a8c9453f", "comment": "Malware payload (Petya)", "value": "17c25c8a7c141195ee887de905f33d7b", "object_relation": "md5", "Tag": [ { "name": "Petya", "colour": "#8B50CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293425, "uuid": "61768d16-216a-49d2-b14a-7808fa79df53", "comment": "Malware payload (Petya)", "value": "e079fa28ea51fa98644164caf585ae3231d25372fccca1245902fb57488d4660", "object_relation": "sha256", "Tag": [ { "name": "Petya", "colour": "#8B50CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293425, "uuid": "7281f07a-25b6-414d-b1ab-e7bec47440b0", "comment": "Malware payload (Petya)", "value": "7fa8079e8dca773574d01839efc623d3cd8e6a47", "object_relation": "sha1", "Tag": [ { "name": "Petya", "colour": "#8B50CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293425, "uuid": "51e3335d-1b29-4639-913b-01b255ee757b", "comment": "Malware payload (Petya)", "value": "9c68e590004b8bc567f3883dddb0ebf18dc86c745525b6e0ba665455eb7731905911ee3b9a61854ba92c42163b6d015c", "object_relation": "sha3-384", "Tag": [ { "name": "Petya", "colour": "#8B50CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293425, "uuid": "8ea70cd7-168b-421e-9a71-174aa67cd269", "value": "T165A4CF02B6B19071D9A782395679B77A0C39BE2077E4D5F3E7D3285AC8302E1573D386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293425, "uuid": "ebf8872f-0026-4078-bc23-b9b99e5ad8fa", "value": "90cfb770dd8b0646a46fc541c93185a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293425, "uuid": "2cc692c1-fedb-4d73-a95e-531a4a5c9926", "value": "12288:ZPaAhutLwUVsvLPcFZXYl0oIZdm9n50DNq:ZPjutLRuvLPcX8mC5S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293425, "uuid": "7ec77cec-dc2d-45ce-af8b-d38d975758e8", "value": 484864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293425, "uuid": "d50c951f-ee95-498b-86b9-c8638441b156", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293425, "uuid": "0c3013c6-b768-4d69-a198-bf74033ad228", "value": "02288399.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b85be7c-06aa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686303870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303870, "uuid": "8e552e30-d33c-4521-9192-56243b4a180b", "comment": "Malware payload (AgentTesla)", "value": "ba4ab7f9baae5a8aa26bc0dd1037e762", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303870, "uuid": "319f6a72-bbbd-4783-82a8-63ca2cb983eb", "comment": "Malware payload (AgentTesla)", "value": "e0dd4b2728e8fdec97e24c2ee5ec3825967158b3b9089c0a08fbec65af801db2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303870, "uuid": "bb461231-0e55-4bbe-9795-bc5da8d4ffdd", "comment": "Malware payload (AgentTesla)", "value": "8f70c1755fb5abe889fd86f36b6e298255f75615", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303870, "uuid": "22eb1c32-7636-49cd-b415-5be4776f5b77", "comment": "Malware payload (AgentTesla)", "value": "af7faad04da69d4ecb0f0bcb5a44b30036862bc7ff1026e5f099ccd28d396f1afca9695eb2899d09d23960de1739de73", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303870, "uuid": "9807ff92-afcc-4b8f-a73d-9cd7a6b63178", "value": "T156E423402C1181BE4CF9933B639227CC7C95DB595180BBDC727AA14BBD9E061EAEB1CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303870, "uuid": "2218e7de-58c9-4d8d-b0ff-983c5947ce61", "value": "12288:NkMLG2zCpyfxEc1BkUNYpgHs1ybzdfUwaogF+XDNwr1PSp8CIV8/5ChWASg:NpGXA5cgEUdfUsk4BwrK/jng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686303870, "uuid": "041eac68-3989-42e3-8c29-012ceb8f54e6", "value": 687089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686303870, "uuid": "36bc27a4-6355-4d4a-a2bd-9dee2e4da77e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303870, "uuid": "0361d733-f099-4908-9058-b4e3bfc706a6", "value": "PAYMENT CONFIRMATION.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6a7b830-06b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686310117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310117, "uuid": "a66003d5-0e69-4503-8d92-fe53e1c0dfe3", "comment": "Malware payload (RedLineStealer)", "value": "46885d5b2f4726fe476e5bcd72996a74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310117, "uuid": "c2f82f7c-2cbf-487a-81fb-aabf91b58ea2", "comment": "Malware payload (RedLineStealer)", "value": "e149546242d925d24473153a5e6bafbb3e9a4cb36ba86865dfa465d40617be22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310117, "uuid": "5667b220-a253-4432-be37-a25f2c5e0da8", "comment": "Malware payload (RedLineStealer)", "value": "5fa8264cd16d3a11b6ad9a2032cb2c370284879e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310117, "uuid": "b1c1c4df-663a-4421-bd66-5b08f2af1d8d", "comment": "Malware payload (RedLineStealer)", "value": "ec8610bd0641c29e8538d715769dc413e3f784e95f45706aca45acb6c517de6e5b7e4a5d817459d592462759bd76aba6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310117, "uuid": "42be2ada-af83-479f-92b5-57909f08f223", "value": "T12264BF12D3E17C65E76747328E6EC2E4761EB56D8F69637B22085B2F04701B2E63331A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310117, "uuid": "71185133-9664-4625-a8c7-8dad4b9f118c", "value": "aa8c412c6f10c6f5df55a30b0bcfcfd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310117, "uuid": "00513da8-f123-4e80-b2b6-999521c8674f", "value": "3072:RhSepUiqSgirSH7kWBi07HmOHNth45WTQjRPCUvpSBD/QyWUDLu3Qzu0VT5QFUoF:6sLSH7kWBlLjDURPCUvc0KO35IuCE7/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686310117, "uuid": "32a3a54b-9f57-4e32-9867-f03a2ade6483", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686310117, "uuid": "31779cbf-5eca-493a-add3-f916c97f5045", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310117, "uuid": "d8ed1b62-3bd4-4055-8559-4c6054a49f3d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e7c3ba-06a0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686299678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299678, "uuid": "aa4929f0-b501-4eaf-bffd-268202fbf82a", "comment": "Malware payload", "value": "2b581203ae90225e7558c6dc8c3c4bef", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299678, "uuid": "2c14d993-5404-407a-bf53-fdfcc601dd13", "comment": "Malware payload", "value": "e2a6f08d7c95c527259b35e6bbecdb8b686940facce05d1e85686bc8eaad0fe6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299678, "uuid": "c1fb88ce-263b-406c-b329-c7ee05c6c437", "comment": "Malware payload", "value": "b2e92e7074479d787ac5827b69aebbd73e32731a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299678, "uuid": "bed8bc5e-4f7c-4e4d-ad6b-ab1ab3f081ca", "comment": "Malware payload", "value": "75adc27627ea794f23cef02df4e48d42015c3c3472f464718fcfa459bf3323742c45d5d7bb73f1eb0e1c2a561219c565", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299678, "uuid": "6914f5a1-8034-4ac6-b5c5-c49f1cd3c418", "value": "T19413F2BACD1137B2D77BD1B7E52920D9D4CA6153D325B5CF5D1821BC46803BE820A9CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299678, "uuid": "33ecc90e-c4a1-401b-a689-ec0fbcea8dcc", "value": "768:vivqZLQdeermdwzwYTLBthxwDflufBYJV/fnmJZWzRmULFqR/1H:vWqpQDuwzXfBtQbQOnfnESlFqhd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686299678, "uuid": "62e1f0bd-2a8d-49cb-9981-d547b2de1d32", "value": 44757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686299678, "uuid": "4c0a0593-d2d8-4772-9649-b401253d4ce5", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299678, "uuid": "f9ff982a-cf1d-490b-b8c8-0101d7bb3655", "value": "MESSAGE.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45242387-0694-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686294437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294437, "uuid": "e9548291-8b07-4322-b4a4-238902ebc1a3", "comment": "Malware payload (AgentTesla)", "value": "6d4b2779ee3fff4a4774297329c64548", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294437, "uuid": "a1a634ed-3a72-4bee-8826-fe236cd2d7f4", "comment": "Malware payload (AgentTesla)", "value": "e52bf3df9ac10f10f9a9e7e8287950565ba725dce1c6b9315c77b4b361d7edb0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294437, "uuid": "ef22bfda-c5bb-4c75-8ed5-fb00a0395855", "comment": "Malware payload (AgentTesla)", "value": "8ec01dda07ee4f20c47679b8ca8af62157245cf1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294437, "uuid": "54af329f-0105-4277-8488-e5ce01565c31", "comment": "Malware payload (AgentTesla)", "value": "116641d86890d99fc96d1e82727d280966cf1453cbe0dd09a6f836e9493bbaf57962d0fb243819edf9d7ca92627b5800", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294437, "uuid": "9efbcd05-6b4c-483f-9b21-aea0049acb30", "value": "T1CCF4120C3BFB450FE66E3FBD0D201170C6F9298A7523E39A6E97795C8C957450A81AE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294437, "uuid": "c8824444-bcb5-40d4-b6da-6b18e3b4b4a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294437, "uuid": "d455a48b-a946-4d67-a8d9-af02f67c712e", "value": "12288:LuIas/16/YHmM9mARLAV+/3G+XG8okfztty9AnGwNQWju8+3q8KTyut1SM+YRg:L2s6cV9mA9ImJW8oyX73uW68+3q8i/SS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686294437, "uuid": "5dbbb4ce-b3da-4eaa-b8ac-768d7840719f", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686294437, "uuid": "158fa178-0f71-469e-9275-9d2c4b65e003", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294437, "uuid": "1f161643-4139-4301-b3c1-3974e5263dc2", "value": "BA432620038169584432 EUR 49705,50_06062023-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b8e6f74-0700-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686340914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686340914, "uuid": "eb9aba12-0b27-4d87-8361-90578f73b914", "comment": "Malware payload (Mirai)", "value": "7a6a60f73204f12fcccbf03eea87b53c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686340914, "uuid": "1c593a73-9645-4ea8-8dca-2826c1aed850", "comment": "Malware payload (Mirai)", "value": "e60c11e7e2646154227e1592c810201960b73f8ad9db4b10049ea967e5d9d796", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686340914, "uuid": "90304a48-3fdb-4d03-b428-57b200bbefe9", "comment": "Malware payload (Mirai)", "value": "3d14aec7bc1f2b00f21ac8ccca52d879460cc40b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686340914, "uuid": "298d9b19-227e-416f-bb61-7c5761f1332a", "comment": "Malware payload (Mirai)", "value": "37922f9f049c08806fc0fac54c3f493c052a4fe5c4d5e99dd87bcff53853827f38d80f7d3dd3880390fbf83136bc831a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686340914, "uuid": "12ea3bf0-12a9-4321-b3c1-10c79affeed0", "value": "T1ADC2E1E07726FD31C420AC3DE52B4D893A51067C91FF383664258D399FC169A77E88B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686340914, "uuid": "a43fb976-8053-416f-b87c-efc97597a717", "value": "768:JMKyhegCCMqfizjoNpd2vJdX6vwrHs9q3UELuf:OKy4qfqoeJdXWgVLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686340914, "uuid": "7678e9f1-fda2-47a7-9aee-f1088130d389", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686340914, "uuid": "27cd2179-c2dc-44ac-a362-3dcca1bbb5ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686340914, "uuid": "3fc1ee8c-8a42-4fcc-9467-b1c77b4139db", "value": "7a6a60f73204f12fcccbf03eea87b53c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e629cb3f-0661-11ee-b3cf-42010a9c0076", "comment": "Malware payload (njrat)", "timestamp": 1686272803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686272803, "uuid": "4fafa4a7-fd0b-47d5-9a67-4fd8f6b42808", "comment": "Malware payload (njrat)", "value": "e33dafb811a56b8295d2cfb4cac645c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686272803, "uuid": "e55d6b15-892e-40ad-90d0-33fd47587019", "comment": "Malware payload (njrat)", "value": "e7ae497afab39d1799e228532ded33ea74ec4a6bf8c79964a7d0f557c7264fb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686272803, "uuid": "a96e8766-46b2-459a-a53d-f739324f2789", "comment": "Malware payload (njrat)", "value": "8d93eb10381a824464b4324a62735e4ec96393a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686272803, "uuid": "7b4349fa-fafa-41c4-bde0-9a44f886354c", "comment": "Malware payload (njrat)", "value": "d9f3f659bfe259caca50b5c63cee34024feeaa8ddd2f569c921f8ffe5a6d5834f87c346148363ddc876e630432fb943b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686272803, "uuid": "82f99a3f-20af-44d0-9867-217d82926b28", "value": "T13D13D78DB690E174D5FF8BF1B4A1B2890B70A05BA806D30F99F154D94BB3EC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686272803, "uuid": "d73adf1b-3def-46a1-b385-6252f9c8d5c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686272803, "uuid": "6504e40b-3bb5-411b-9d25-1cb3e8dc6700", "value": "384:rZy54oi98Na5yCSh1zWHjREYbul60kzsIij+ZsNO3PlpJKkkjh/TzF7pWnSSmgrq:FEiywwCQtg7WEuXQ/osC+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686272803, "uuid": "4fdbf35c-ac84-4c9e-9f2b-a81336624e2a", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686272803, "uuid": "4458e075-d7cc-4a6f-a5dd-1d681d6e6271", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686272803, "uuid": "b5c5da78-7e70-4e55-993b-0885595b70fa", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "571b50ed-06b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686309930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686309930, "uuid": "f144cbd8-22cf-4f00-a1a1-0e2fedaab1b3", "comment": "Malware payload (SnakeKeylogger)", "value": "c55b05f72666b00a2153c92628979f2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686309930, "uuid": "c56f4c2e-fcf0-4e9e-a0d2-268e32b2851d", "comment": "Malware payload (SnakeKeylogger)", "value": "e7d13ec9ec5f7941487d13791dae5640ebac867970f1b855d812798032f91720", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686309930, "uuid": "3cc0e1f8-4a06-4255-b850-4af45fd7c06c", "comment": "Malware payload (SnakeKeylogger)", "value": "d0419e3feb4215c08ab82853e6474f9b108438e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686309930, "uuid": "dfe74500-e72f-4f50-adde-d7c8c0ab49e1", "comment": "Malware payload (SnakeKeylogger)", "value": "cb7952cf762a589280aa7b2dda7d3b4671f3fb5b8babe5bfacee5e8e7304db6ffbd0e182c57e7ca46e44ef1fccb159ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686309930, "uuid": "10712940-7ac2-40a1-a930-f4b733c06e93", "value": "T102D32A1D2BF88800E5FF8A7705B15112C776BC42192BCE1D5AC2F55A2A3D7918E1BFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686309930, "uuid": "122d8d38-1029-46ab-94ee-f71f386cf7ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686309930, "uuid": "04624634-1252-4def-ba10-51dc008a81fe", "value": "3072:qOOYz2BVPhpxCsyYAbb7ZwHwBWjTWgbY:7ziG5buT3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686309930, "uuid": "17da1495-8dab-4aea-90c1-8498dad3cae5", "value": 130560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686309930, "uuid": "d0996876-b44e-4c64-bd10-2497ec84aec6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686309930, "uuid": "ed3cfc06-5c64-4f9b-a945-6c82517e0a3c", "value": "e7d13ec9ec5f7941487d13791dae5640ebac867970f1b855d812798032f91720", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5762f5a-06c4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686315215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686315215, "uuid": "a80d48a1-63dc-48e0-a070-d961f178d091", "comment": "Malware payload (SnakeKeylogger)", "value": "7fca74aa3d889f511284042cd24ae33e", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686315215, "uuid": "ade642fa-1a57-42e7-95bc-bac343eb0ee1", "comment": "Malware payload (SnakeKeylogger)", "value": "e89dcb9021fc349ad0a05bfdb6ebcdddb405d8f172aaa8f399f8ec0ab9c99d58", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686315215, "uuid": "a86f9e8c-5b23-488c-a5ea-7f87c23a7ad6", "comment": "Malware payload (SnakeKeylogger)", "value": "08495d3af654659a8ac64d8b162bad4a64cbd470", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686315215, "uuid": "843f1696-81e1-4dad-8e53-b8bb2c989cb9", "comment": "Malware payload (SnakeKeylogger)", "value": "ebcbf8e56e117782df67df4b97760f9281544fa208b460367133c8cd0dc3cc10f86b911dacd97ceaa46e747811661c48", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686315215, "uuid": "1612acac-5958-4f3e-899e-8e3b24929ac1", "value": "T1C8B423CB0B452EF567326B391F95A6A2B0D471CA29D392D0BF771E34E00B4A837C9653", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686315215, "uuid": "6259ed1c-c893-4192-88a1-48df9b920722", "value": "12288:suiCWwNBt6DLGPUFXWc4jvtKjUBvlQl2ZQWJ:su4wNBt6DLGSWOjpPWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686315215, "uuid": "f60f1120-d302-4743-b6fa-6cd0923c2219", "value": 506815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686315215, "uuid": "9c8f7c05-4553-463e-ad71-eca995273624", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686315215, "uuid": "1dab4031-4b45-422c-8b1d-8e8666bb98fc", "value": "P.O 3805.PDF.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ce1e2e-06c8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686316746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686316746, "uuid": "c9f6acce-7f6c-4eca-9b17-800e9060e3d0", "comment": "Malware payload (AgentTesla)", "value": "b108b4b3402ab633e702b966461eebc2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686316746, "uuid": "b6209113-3624-4ec2-ba46-d9967a212206", "comment": "Malware payload (AgentTesla)", "value": "e90252ad8735d7bb17b50fb0c57f1d6d71e1c1e46c92e47717fe550bff17d4de", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686316746, "uuid": "52b522fe-50d2-4ecf-a1e7-67e03032d55c", "comment": "Malware payload (AgentTesla)", "value": "790a00c1280044e9d01ffe1725b7d6255ae10b82", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686316746, "uuid": "da832a74-9209-48a8-8794-4230c0e07cca", "comment": "Malware payload (AgentTesla)", "value": "fc14ff16c4e5499325c77e1d41d7ec528ddfe3d36e97298a9333efde7746e16fc1ed799a64876531b36b244aaf05bcfa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686316746, "uuid": "52746f95-88d5-47bd-8138-d006afda72ef", "value": "T1BE54234C0DB3E688D2A13C0F28EDDE1413CDA422512A706DFCC954A5C56D7DEBEE549B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686316746, "uuid": "26ad2a5d-ccaf-4337-9b77-d09370df6209", "value": "6144:nmWJFq6/zSVKZKf2Kog81OrkHK6j2xwusgB85egNxk:RvGKKf2KaW6yqdgB8tk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686316746, "uuid": "9b2d1846-59f2-4911-ba38-ee99c5a291e7", "value": 279013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686316746, "uuid": "3ec47d33-30ba-4a2c-911d-467549948789", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686316746, "uuid": "9f902e78-999e-4219-a5b8-81c6dd1f8577", "value": "Invoice 381293331.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ff2e3b8-06bc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686311635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311635, "uuid": "0ab6c53d-a8d7-4930-9442-e701416609c5", "comment": "Malware payload (AgentTesla)", "value": "bfea33627f36adc9dd65bb6aabf39dba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311635, "uuid": "2fcda951-13ac-4634-b2e3-4a6460a85d58", "comment": "Malware payload (AgentTesla)", "value": "e91da65f2e92a516fa93fd1d80c4d141efad8714f830ec76cd1b11c65d97f95c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311635, "uuid": "6e145e5e-44a3-46fd-be06-fca044fa8764", "comment": "Malware payload (AgentTesla)", "value": "35776f365586253c12a45a0367aefab81808289f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311635, "uuid": "db1e5bbc-f8d3-45c0-a47a-c3c2371dd3e8", "comment": "Malware payload (AgentTesla)", "value": "eab4b6432a06523aff039114fe5cf431ea9f0ce64bfa7c9910640f24229ecb22db7043ef976217322399c3278ed7030d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311635, "uuid": "f9c2abb5-ddbc-4c2d-87d6-fc0fcd22a650", "value": "T11CB42301F80D5E6E6B27F62B2C0AC5B75171631D688FC1F6E44234C75ABA2CE9A71CE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311635, "uuid": "a95a25c4-b0c1-4980-bab3-71fdf8445e69", "value": "12288:1V/Qog6E/fVSlcj0Q8XlrGrmhVkQuYEukqOUbjpPrZ2V4g1:+VkcB8VemAU3k6jBrZ6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686311635, "uuid": "2bed10ea-8b83-4820-99c5-5c31eb9bd446", "value": 513059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686311635, "uuid": "8b5ffe60-0e00-4a7b-a1e7-0d521e8798d0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311635, "uuid": "8476010f-380a-4951-a4ca-b9396605e330", "value": "PRE ALERT DOCUMENTS.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4efd6f5-065d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686271003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271003, "uuid": "76973b34-b5c0-4751-baf9-8a0e421d02d3", "comment": "Malware payload (RedLineStealer)", "value": "dd85106e003673b034347fe3e4ebdc5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271003, "uuid": "670bf162-1e24-467b-941e-b2161d1ffd61", "comment": "Malware payload (RedLineStealer)", "value": "e96dd0b309b24dcd980fd017ed7190631541e1c2190a5a428d1ee456d1e18f2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271003, "uuid": "265dacbe-db16-48c4-8dc6-43a2be75a5a2", "comment": "Malware payload (RedLineStealer)", "value": "8ccbfbb9d5c3d4e53acb82168eb650de6a481379", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271003, "uuid": "287273f0-99ea-40b7-ae25-8c23abaad13c", "comment": "Malware payload (RedLineStealer)", "value": "ee6419c4f47e1018f4aca370096242b8d9ec879b62e14f802e010ecfa0706b4b6910ef0700d64e741191c3e0b8d6b6df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271003, "uuid": "72dabe28-6e25-470a-bef9-9949979eaa8e", "value": "T199E41247AADC6072CDF92FB198F313834A31BCA699B452472B856C1A1DF3680E536737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271003, "uuid": "c2a14b23-486e-46f0-94fb-050de69f7ff7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271003, "uuid": "a1c85b19-ce35-4e6a-a146-f29569ee3a2a", "value": "12288:JMrxy90NmceAEvH4XlOz+RVtjbAs9sVE7BJcmuUDUMEyqJVdl/GgoBt:Yy9c0AgzmjDsVE7U+rMdldIt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686271003, "uuid": "6622aa27-9783-4455-91a4-fc69d52a28f4", "value": 686592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686271003, "uuid": "cf5135ee-9c48-4440-93d4-810ec459f246", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271003, "uuid": "76bdb2a6-3927-42b1-b066-18f9c3ce0179", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a67dde-06c8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686316661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686316661, "uuid": "79eec769-2f8a-4ade-86ec-e992d11d09bd", "comment": "Malware payload (Loki)", "value": "742b900a1c224071272540fcf8b14da0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686316661, "uuid": "591c3219-06df-46d5-860f-44f2be5117b1", "comment": "Malware payload (Loki)", "value": "e9c141cc8f4535f2abc77198d303fb533cd4acedb9b1aef39d57529dd6bafe65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686316661, "uuid": "ed2791f6-a46f-46dc-a9fd-500c37cb4380", "comment": "Malware payload (Loki)", "value": "4f2ad8b71aac38e13c972d842510c0d4369ad555", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686316661, "uuid": "29f45301-50fd-4772-a19b-ab67f506c657", "comment": "Malware payload (Loki)", "value": "5fd70d392685771e81d5f8dea4d1a6a610ea33d5d8e835e9a33f68c72054f4fb531e6a6dc44455dc60fbe45a1bd26a52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686316661, "uuid": "cd637fc5-17aa-4599-bbc9-1aa8f05050b6", "value": "T10CF4026D0AFB461ED55A3F7C1D5002B1D2FE8A567637C6178F8BA8D8EF137140A90683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686316661, "uuid": "95582004-326b-4a02-9b24-fdc92fd0e8d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686316661, "uuid": "cbbe70be-605d-4667-95ae-583046c9a459", "value": "12288:qyXECB8fTkRVdiRobaFErwRgxIE5sp9sqsqVcC5eIQ2RQ6d9sLbFT7OWP:rs0biRoSErVxIE5Ms6MJO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686316661, "uuid": "207e14aa-7f5e-4ac0-b135-af86e32e5261", "value": 730624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686316661, "uuid": "3a5905fa-db5f-41b4-98e7-3d8bf84ed7bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686316661, "uuid": "9446d424-4abb-47cf-b3c2-46ca16081250", "value": "kellyzx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e897bd12-06bd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686312321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686312321, "uuid": "7b1b2b54-2335-4673-904d-dbbce19064a4", "comment": "Malware payload (AgentTesla)", "value": "e4cf36ea1a34e5b0a5274e1de4496a5e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686312321, "uuid": "1c30e7b2-6090-4d15-90b4-42efcc2c87bd", "comment": "Malware payload (AgentTesla)", "value": "ea053b7a3fafe6e29c66d8bf5ae31e99751d4d4c3eb081a26d2c23ee8bff41d0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686312321, "uuid": "36fb3279-5ec8-4228-acf7-5b072c7e0907", "comment": "Malware payload (AgentTesla)", "value": "a9693b93da6084cf4c704ab8c139952918d30271", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686312321, "uuid": "4f486de1-4ca4-4991-914c-f4e24fc7b9d0", "comment": "Malware payload (AgentTesla)", "value": "b55e2da7c28753ccc9f1b1e43cda39887bc28db6dce42522858ab65ee2e4c6df590a5105cc86f1c8b87eb718bef7307b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686312321, "uuid": "465760cb-bf7d-4673-a7fd-bf6938007a21", "value": "T1A6F4122E3BF6001BE67B3FBD5D201230C6F86A4A7163E39B1F8B749D9C94B514990693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686312321, "uuid": "1a18ff15-0008-4005-adc7-8ce8e787f91c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686312321, "uuid": "2a13f64c-85fe-4a53-81ca-a22f2e7b9485", "value": "12288:xujas/16/YHmM9mARLAV+/3IdWPOLuGJG1vf1rXJysPwnplQgNEDaSkT:xPs6cV9mA9ImqXLfJG131PDdkT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686312321, "uuid": "afa4d32b-8425-404c-804e-514a498c76aa", "value": 759296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686312321, "uuid": "4dec8d9e-c0a2-46f8-abb6-e0b85a7a6330", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686312321, "uuid": "bde43036-ca40-49e6-8699-a60c4cacee7a", "value": "quotation list ,DR and material date sheet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e6b4d3-06c4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (QuasarRAT)", "timestamp": 1686314971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686314971, "uuid": "aabc439a-da26-4171-baf4-db79e0785ee0", "comment": "Malware payload (QuasarRAT)", "value": "9f7fb2e4d23a162b9a47b291f1eb7763", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686314971, "uuid": "867ffa85-43f6-409f-9208-1cca2faa544a", "comment": "Malware payload (QuasarRAT)", "value": "eaffa2b674b3afc1110ddd54a2835ebe59ed686a564f256dccb40b3bac1010ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686314971, "uuid": "c50246be-8bd2-4565-a2c9-8d4d71d1fc1c", "comment": "Malware payload (QuasarRAT)", "value": "a829bba9362aa433432e40fc4f48849a2f80a460", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686314971, "uuid": "ba385e47-6447-4c04-b6b2-9180826f8167", "comment": "Malware payload (QuasarRAT)", "value": "92aec4664a9a18842b5f710384ce38096325ea431d0d3711c5e75886bd38a76d616eb12ffabc3ecbea079621b47945af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686314971, "uuid": "d41031aa-6762-4095-8f2f-6c9f3ee5e5f5", "value": "T19B352924F7F855A5F06E7F76747158050B38FE03693D974B2B96A0980A6A380DCB2F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686314971, "uuid": "5ebfd3ee-40c3-4f75-8329-f2c8005bbbe1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686314971, "uuid": "2a350b09-9705-4c87-a8d3-f4c9b1a9e672", "value": "24576:5aynkc1ZzBvtrZHFjMKY2zNolelHmkn+nF:Iynkc1ZzBvtrZHFjMKY2ClelDn+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686314971, "uuid": "36fe1573-c823-4509-9af3-887ac5a73461", "value": 1085952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686314971, "uuid": "a43173c8-f5be-43cf-aab5-0522ca945177", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686314971, "uuid": "3f40b909-b09b-4ca7-835d-701a7e5be0de", "value": "xZ3Qraz3mopj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d3c1673-065a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686269648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686269648, "uuid": "d7d3668f-8914-4934-87cf-1acb436b196d", "comment": "Malware payload", "value": "e88f1b60b9650f37bd71d0a84be716fd", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686269648, "uuid": "eb47d1cc-c077-46d9-b2bd-ed912492e945", "comment": "Malware payload", "value": "eb71a9590b4c4277595f41b0095a5abb3a2e32878b0b1648ac8eb4b5dc5b1373", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686269648, "uuid": "0deca618-1c74-4ac2-ae57-34ab58799f74", "comment": "Malware payload", "value": "1c7ccac277eae62b37c41c73bc42b44a4637bad0", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686269648, "uuid": "b2190e38-d497-44ee-a5a3-f1f79e9d4cc4", "comment": "Malware payload", "value": "2f761d501b6346863dcd017cddf811c43262de1236c9a812a0dc2c260f5efc667af36ebd91c93b5f5c3e249706dbd663", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686269648, "uuid": "9304eabf-f1e6-4d72-b66d-a446cfbb2768", "value": "T1F8931EA6DBA21F7F02290A9FA920653D33D45942C4DC5277C4A007CD3ADC7DBEAB4D92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686269648, "uuid": "f01c29cf-d8ed-4f3d-b4ce-140275c77845", "value": "1536:9wZdoo7wLwZdoo7wLwZdoq7wLwZdoq7wLwZdoq7wLwZdoq7wlZ3tYo5R/gO44WXP:Ydoo0Sdoo0Sdoq0Sdoq0Sdoq0Sdoq0lI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686269648, "uuid": "6aa98457-e391-4d72-8363-c159bc513692", "value": 91559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686269648, "uuid": "0c01d82c-936a-4889-aa56-0e73968b74b9", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686269648, "uuid": "cdd5c6de-d235-46f0-8867-dec8fcd128f1", "value": "index.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92eb7994-0693-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686294138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294138, "uuid": "93c7841e-bede-4737-888a-ab168eeeae0c", "comment": "Malware payload", "value": "99ec3237394257cb0b5c24affe458f48", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294138, "uuid": "8f970780-8d15-4f8d-be5d-f9407ea17817", "comment": "Malware payload", "value": "ec17f950f6ee9c0c237d93bc0b766aa6e2ab458c70320b534212043128177b51", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294138, "uuid": "15bd427b-1046-46ce-af2d-25c27e7b3237", "comment": "Malware payload", "value": "5300e68423da9712280e601b51622c4b567a23a4", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294138, "uuid": "a32185a6-d8ef-4d0e-a11f-5bf3490f255c", "comment": "Malware payload", "value": "b5a4da1f0541281ab0cb51ff19605f7b7a9a179b03f1537036d9c6136432d96c6957289ec607e51e21d52f49070ddb7e", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294138, "uuid": "1f58f612-0b84-48c4-a47d-3287b47533ab", "value": "T11B23A78847C164F09150BC09B845FA378375CEC07C6B56BEE953A28EB415A6AF0F60FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294138, "uuid": "54ce5977-2df1-48a2-9b98-c4d69a9fd671", "value": "384:m71ThEgivcqpCghtpCAhDnVLri57VurlgRL1xCLI05ej+1DPpUo/i/vFCbWZkraB:m7BGV95hIG1/d49gsCDsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686294138, "uuid": "b989d3e1-6377-40a2-9538-c5777a13334e", "value": 48110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686294138, "uuid": "ec6273cd-2476-4c20-b9b9-d6b7e45568f2", "value": "text/x-asm", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294138, "uuid": "2fe27dea-1da8-4794-a1ff-18c7aa018faa", "value": "07506199.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84b28a91-069b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686297551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297551, "uuid": "5912bbcc-4dc9-403d-9908-b275a9b32c23", "comment": "Malware payload", "value": "8481438a877606a4bd759dd3d58e06ef", "object_relation": "md5", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297551, "uuid": "3e4b9c71-cd9a-4c0c-bc26-40361aeac7b2", "comment": "Malware payload", "value": "ec98136d2ea53205505b9d4f782e3d9587db6ca5e58ac58b96e6886110a2b877", "object_relation": "sha256", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297551, "uuid": "4a6d3204-370f-4229-8472-39be607e578d", "comment": "Malware payload", "value": "fdeb13231ec4206f4834113c4e559762656afc87", "object_relation": "sha1", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297551, "uuid": "3bc2c4ba-80a9-4064-bcf1-cfdabc79eb1a", "comment": "Malware payload", "value": "16759ca80011080b36f94934ba926760404e37464cb9f7bbb03de3e85295eb2acb55e241b5d48d7168f18449b4641352", "object_relation": "sha3-384", "Tag": [ { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297551, "uuid": "7893c853-191e-4bb6-8e37-10c21f946ade", "value": "T193F423A17C61872E8F884DC9FCBBCE4A76A3F44875EE1625A0105601DBD9EF6CBC8544", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297551, "uuid": "a2383f0b-69ce-4b45-bd7b-8a9628172281", "value": "12288:FnlZy55b7zX6A0s0g4nvW+AyQ8DFxmrz81E2qwCclhaxTv/bymQIIzLBxXAqV:9lZy55b/XH0g9VyQaS81ZqwXCTOnLLjd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686297551, "uuid": "24e4eda3-d03b-4f23-ae2d-9158ddceabe2", "value": 767038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686297551, "uuid": "b6931039-6399-45bc-bd4b-4985eda0ce36", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297551, "uuid": "131db701-c41f-499f-b329-a074c62a0e7e", "value": "Quote JQ102474.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ed186cd-0692-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686293675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293675, "uuid": "56e43600-6966-4cfd-8235-0714624a240b", "comment": "Malware payload", "value": "c8623aaa00f82b941122edef3b1852e3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293675, "uuid": "15a8dd80-c432-4315-8bc0-2e5ddd0845c5", "comment": "Malware payload", "value": "ecc5cc62c8200954079191e586123522f88aa1414ae98908380176d75d2e7eab", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293675, "uuid": "b1335634-1620-4b55-a268-c17aee8a80fe", "comment": "Malware payload", "value": "1785230107633bf908034ef0d5403367765bcafb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293675, "uuid": "e95a9f74-883b-4973-9f90-4a11e7c652c0", "comment": "Malware payload", "value": "d7979e2113af97ccb6f632520e8ef82d8a36dff6cce8499c582a0af81f91fab16c7ace98cce55f1c62a1fce5fcc554e9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293675, "uuid": "acc3006b-26de-4b92-8125-75e0d5020e4e", "value": "T170548E237FB4C476E862063A4D75B2E941BF7EE25D708B0B37F4126E8E705A09970A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293675, "uuid": "3eb03ca6-459b-4931-b250-41d2ca4fb8dc", "value": "d2fc5a35dbc5369c768616e1f8fdcc1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293675, "uuid": "b51837cf-9e83-455c-afee-008c11e6182f", "value": "6144:13hghT/p3pFlD0r5RZQa0cWhkt5yfx2NFreU6:lhgprDY7MhkQsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293675, "uuid": "e0211ce6-4938-4c8c-8438-f31a48e4091e", "value": 286208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293675, "uuid": "18684199-dbca-48e7-a61b-550775bd901d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293675, "uuid": "9d7700bd-673f-44ed-9aad-3a7e58cbd57a", "value": "08753999.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a17071ef-06b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1686310054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310054, "uuid": "e20a6145-4701-4c8c-9a76-ef504ab09098", "comment": "Malware payload (CoinMiner)", "value": "eee7b971e0b76a0df56bdac2ac2fa343", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310054, "uuid": "927e66b7-ef52-4318-9f87-cf88bce5d500", "comment": "Malware payload (CoinMiner)", "value": "ecd60313ba990f1300b37db4064977e83f109fdf93a728cf434106c1b5b5a2d5", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310054, "uuid": "260f32b7-9d65-4f6d-bd83-5d8b6a8b0c99", "comment": "Malware payload (CoinMiner)", "value": "c80f9d9de5d0dff115bbb7638554dade321d7c65", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310054, "uuid": "fbd08a91-1f3f-4fb2-bd14-cd3c0b9ec2a7", "comment": "Malware payload (CoinMiner)", "value": "890460269e60644fd4601f98cb299169191ccb173b66ab693f7e89f8a4f7afa2c9dbe6bf8f2d32d63bcef1cbe4a39688", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310054, "uuid": "54838355-3de1-43d1-9bd1-c9d107c6ef05", "value": "T129A6D06D86866FE6EB880AF3491D47B6DEE21DF425E7E13180F8DF3325FA8800395195", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310054, "uuid": "dd15eed9-95e2-4a0a-8cbc-9fde37e9be6f", "value": "f7505c167603909b7180406402fef19e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310054, "uuid": "b14d7515-fd5d-4afb-b39f-f78bbbfc993a", "value": "98304:AScdwkEObD07UX4SIf6Ky9UBMJs52fvaUhOAllh3uJZbZSvHzmmkvgDlWBixnxCa:Ald3Z0I2T0gAfCbZSvTlRXqbtci+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686310054, "uuid": "c5a2886a-79a3-424b-ba62-308b6b93993a", "value": 10264640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686310054, "uuid": "eaea3b72-da49-4c97-ab91-0fc89a19f060", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310054, "uuid": "4ccc5b6b-7e7d-4cdb-9cda-0000a0e0426c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b88442d-069c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686297804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297804, "uuid": "8a40fab1-7521-4b9c-94bf-60862e70a231", "comment": "Malware payload", "value": "4a56dd5b2b05226e0e366f1b2b39c1a7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297804, "uuid": "74c6416e-1454-4dc6-b6e8-d7aa30e0c245", "comment": "Malware payload", "value": "ece347647c5eb622ccc3a4f81a9e179353cc0739856dcfb3a10826a88c13096f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297804, "uuid": "0a5edecc-c053-41fe-b530-ffb8cab8f5cd", "comment": "Malware payload", "value": "f5cd069d4fef739711725c43f8902de0fa2baa2c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686297804, "uuid": "c9ee1fc0-c7b4-4377-b483-9d0204ffa1d2", "comment": "Malware payload", "value": "940c4c8d0f95e5a1865c6d4442043f26a56d85e2fe7356605f03fe5ccf1ab1520fd8ef0e4e90c12cea65d4b6c34e7224", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297804, "uuid": "b9011038-94ce-49c1-b44e-0b12902b3ead", "value": "T16C3302C7D8962DEB7F5775385029913F8C7A0A0AE71A1ED2DB01381CDF837E20254326", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297804, "uuid": "928bff2f-ffb5-450a-b483-cefbcebc58f8", "value": "1536:lQKZ3rLha8Y1jzeUf7Wl0O5rweRg97P8+T:d9r9a5sx6eRgxP8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686297804, "uuid": "71f47b87-59ad-4f05-a732-98af422d059b", "value": 55093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686297804, "uuid": "af9739be-5d79-4985-8a03-3a768e842c03", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686297804, "uuid": "750383d7-9f1a-4205-b89f-2d7d2f6ddc98", "value": "purchase order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46eb220f-0693-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686294011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294011, "uuid": "778054a6-1caf-4607-9d02-2a215ad62871", "comment": "Malware payload", "value": "584f03161a17b36b2f5163dd85bc0b77", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294011, "uuid": "ab1f8983-1640-4c71-9d6a-ab3681fb5e30", "comment": "Malware payload", "value": "ee2a2b418e82683de196beb5d4f6cb213e7579d783b06b9949f4a988f515b324", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294011, "uuid": "4f6d1a75-f0f7-488d-a1e9-853216c91aec", "comment": "Malware payload", "value": "04dad07d0146ff09c0dacc3f248dbda16055a609", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294011, "uuid": "ff77421f-9078-4b34-b445-449107693a54", "comment": "Malware payload", "value": "8e89522106fc105e3fcb1dcd1095cfe18ab929f1c557487db42b64b0f6999ef43b5593624833d41aee2d4900b8d43029", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294011, "uuid": "4b3cfe5e-9134-48ad-b013-65379feb68cf", "value": "T1AD352332DB015DAB95F91A828C4A4D145FACE593C3228DCC71F866DB815967CCF2A8F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294011, "uuid": "57d83616-d478-4e7d-8b92-4362042ad649", "value": "24576:gjSdueeKiZeXA940z802o5mNBriKgcdgUixQsUgk:gjSduKCeA2oqdJqfk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686294011, "uuid": "c68457bb-dcfd-44cf-a25d-b2789d871111", "value": 1116699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686294011, "uuid": "a64e8f36-c916-4db7-ace4-ea45b4be5625", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294011, "uuid": "16c5fe41-1fc3-401d-bb6e-560887239d69", "value": "01799099.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24cef318-06bd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686311993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311993, "uuid": "9fde4c89-be60-4bf6-883d-8814b3fbf53d", "comment": "Malware payload (AgentTesla)", "value": "8d66c3ab701aca56ff9d883baa5a8dfa", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311993, "uuid": "88c2b190-4923-4abb-b4b8-0cf3efc3e05a", "comment": "Malware payload (AgentTesla)", "value": "ee38a762fbe525dbac038852d66a4d0fa3518fe60337478917a608ca3fd7da30", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311993, "uuid": "833caa12-03f0-4d94-9e91-4845ffc28c46", "comment": "Malware payload (AgentTesla)", "value": "5162c448d5358a19ad52450f77fa8d8e67a88149", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686311993, "uuid": "78f2e5f4-1827-46f5-8f9e-e52deaf81e52", "comment": "Malware payload (AgentTesla)", "value": "4f9209d1f132a8032c962ce790256ea78d92f8ddcd0507d1dcf287d3ead661bf2742b47dac7ec449a4829b9d47db4107", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311993, "uuid": "ef6270fb-b59b-488c-90e7-f6d647e061bc", "value": "T16EA4237B12B9FDDF06CB950BF69373BC8F0E60EB49147D4068A894152874D4E626398E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311993, "uuid": "580053d7-c07b-4e02-bd8e-56b0546d537c", "value": "6144:g1rsyT/ZE2opEMgRHXx6y8IlyjbDEY/RV+gj3Mq/kHG6pTmbFLuRJauY7v+tUlOA:C7/22oqMglXgy8iYX53Mq//6sFiKuYFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686311993, "uuid": "83784c9b-dd6f-472a-8641-b6bbeb2f5bc3", "value": 457171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686311993, "uuid": "016d9b1b-feff-4ed6-9fc4-0cf028d1d4a1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686311993, "uuid": "e2f54b6c-9e29-4397-a1a0-2c8f8efaf3d4", "value": "SHIPMENT DOCS 2X20.7Z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34927940-0692-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686293551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293551, "uuid": "18714ded-8c65-4513-871d-bca6c610f739", "comment": "Malware payload", "value": "8ed9a60127aee45336102bf12059a850", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293551, "uuid": "609cbd2e-4ba9-4804-a609-1bde5bf6c67e", "comment": "Malware payload", "value": "eefa052da01c3faa1d1f516ddfefa8ceb8a5185bb9b5368142ffdf839aea4506", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293551, "uuid": "57911b74-9575-4f5e-815f-0c8b3d308304", "comment": "Malware payload", "value": "b649b9bc9436d373fd09a89ed71840aa7ac5ec54", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293551, "uuid": "e1f43bfe-6a5a-4cc1-8dde-ccb207ff2112", "comment": "Malware payload", "value": "b415b0f73da04a22785b98c56cd329329aa9b50aa414033fa821449ff86efb740f670b0c5bd46cdac4a80d5c5f9b9999", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293551, "uuid": "f182d254-9e78-44c8-8b0b-ed3a6b9f637e", "value": "T1C0648E213795F83DDA6204348FE78B6E52FEF1A5E43A1D87E3C40A1B5E76C41812EB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293551, "uuid": "59d51327-3397-4e21-adc1-2d1419934d57", "value": "03e225ed8d142359cb962f60d24cbe92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293551, "uuid": "a5fd21be-0626-453e-bd4e-769ce4418f88", "value": "6144:wDeUVJuo0tl4VJLofrFD68Y7LE8DO11bEVUNNa:IuFl4VJ4D68YUQO1tEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293551, "uuid": "eef39ceb-befb-47fa-bf93-b0c098a338cb", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293551, "uuid": "ff67b3e2-a0f8-4b5d-bc6b-0dd67814b539", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293551, "uuid": "fae671e2-cca2-4bfe-af01-57802b4a7274", "value": "05880799.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adf046f3-0697-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686295902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686295902, "uuid": "aa1df8c3-7c67-4a75-a6ac-ca2b17245183", "comment": "Malware payload (AgentTesla)", "value": "6a3458dea5a141d129c83de36a99d9ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686295902, "uuid": "e3efc6ea-68a2-40a4-9a06-e7b211f78e94", "comment": "Malware payload (AgentTesla)", "value": "ef30052ac363410d23b70490792ef58d8cb48be9803141003bd5b732ae2d4a31", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686295902, "uuid": "4fb17ccd-f2aa-4c3f-8ff4-56a7ad15ae68", "comment": "Malware payload (AgentTesla)", "value": "36116a38fbe1e4195f7793d289d25e5833563514", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686295902, "uuid": "95b2fb5b-6bd9-46b4-8264-6885b370c932", "comment": "Malware payload (AgentTesla)", "value": "6cdcdf5c05294a6d46a716a97ecdf143176d103e3ae2a3f848934c2701bbb848df5c8001c93da2aa8db9de2df4ab8759", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686295902, "uuid": "556490f0-6f9f-46dc-88e5-4da20125cec5", "value": "T13D1561790D4266DFD1BF932990E81C1BFBA1A886FF56F94C78C2038B31A264E76D510D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686295902, "uuid": "e4993e87-db9e-485b-9228-216efa9e6653", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686295902, "uuid": "5b826eea-f14e-44b1-8c83-63f8f709d72c", "value": "12288:VXNiP2N7Zwr+HMESeZUTPniAdx1PCceiL+UTKXaHzMGfZB:VXJNHMuUjniAluGhKqAGv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686295902, "uuid": "ceaf8d73-c9cb-48e2-b316-ad72371f7e39", "value": 958976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686295902, "uuid": "2ddfb10f-7d86-4757-b391-50ff861eb142", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686295902, "uuid": "6b28179f-42d4-41ad-b80d-0cc9078f6e31", "value": "payment instruction for payment inv#0095.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13ef26b8-06aa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686303804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303804, "uuid": "0c9078e9-3485-4e61-a5af-da2cd9e6afb6", "comment": "Malware payload (AgentTesla)", "value": "a2b511ab65c531335b61214131b2aca0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303804, "uuid": "95fc0771-d0cc-4a83-abf2-b56cc64fe37d", "comment": "Malware payload (AgentTesla)", "value": "f07a0a8fe2896a0a56233ef9a0fe8a9beabf09c6cf54740342d466c07d91d7a7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303804, "uuid": "d692053a-f2f6-442c-835d-d84fcd8c644f", "comment": "Malware payload (AgentTesla)", "value": "27cdb256e3059cacd53ec3e38bffcae2869c73e7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686303804, "uuid": "d2ab9a60-3917-4439-b5a5-49fed86675e7", "comment": "Malware payload (AgentTesla)", "value": "7b60104bf358c55d5b139322384376bea24596e841769d76e5ef54df61ad9a779dff2d16d25375c4091501878262b1cc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303804, "uuid": "bc574009-c56f-41cb-a359-77368e6fb699", "value": "T1C005011D06FB521EC41B3FBD0D5402B2D7FE8AAAB563D6074E9BA8D8EF127144A40793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303804, "uuid": "ed8d48f6-0998-42bb-98b3-7dde475b3933", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303804, "uuid": "8deb0aff-6e38-48e8-8be9-366c63e56f08", "value": "12288:p8ECB8fTkRVdiRobaFErwRgxIE5s8sfmNIQIzYA6ExNwkP0ZrnRasTP+cFSiJh:F0biRoSErVxIE5YfyIQIpxv4RzPgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686303804, "uuid": "727ee991-f62f-4254-8782-64dbb800900d", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686303804, "uuid": "42cbdb97-0970-49a3-b12f-15e0752709cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686303804, "uuid": "0265de0b-1915-4391-ad42-ccb7951633cb", "value": "payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ea2e10-0690-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686292909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292909, "uuid": "cd52a7a6-f32e-479d-821c-412daa9b655d", "comment": "Malware payload (AgentTesla)", "value": "6fb4457677493adb9b3cdc49f5d5769a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292909, "uuid": "e82cfb9e-05e3-442e-965c-575a6c95e592", "comment": "Malware payload (AgentTesla)", "value": "f0d37856426530f2658e81c1fc07465e09830d1be989079be04a774300658857", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292909, "uuid": "8b84c9c8-054e-4bd2-9ce6-238359bd9647", "comment": "Malware payload (AgentTesla)", "value": "cfa6ac2f54c2c4bae55733241732ae0e924f25fe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292909, "uuid": "a17e5b58-2f20-4056-ac99-d23f7653a061", "comment": "Malware payload (AgentTesla)", "value": "0f09ed3f8c99c86e02ffe3a22057160ff9550057953fbd62697ab5c873eaf9d11f22655509ba23bdd009f2be233fff78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292909, "uuid": "3eea6896-f3f4-48a9-9912-b8c625f57ce9", "value": "T165E423D7C6EB44B7C47D863D1604A910F9897D1972ACE8B1B182E7E6C2D37F70825A0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292909, "uuid": "23941e1d-ff59-478f-8400-411dc1b877af", "value": "12288:1+BNReJN0B5qLExHN8qP9jJHavgNe/v7P4KeoQt+WhCyoDZ1kXN19KFm/bki:ESi5qLExHWC76INe/vcKzC+WhCyuYX9b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686292909, "uuid": "15e4f6e5-5a3d-452a-9e69-4ac418cdf876", "value": 705018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686292909, "uuid": "22652704-8769-4c8f-baad-02f8eb34a23f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292909, "uuid": "52ebc05f-af2f-4706-a947-09a8b062f7e7", "value": "SOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d75f7172-0692-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686293824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293824, "uuid": "e82b6e3f-b9c3-4c96-8584-872bb06fefee", "comment": "Malware payload (Formbook)", "value": "38a43b0d704770ab33756e9daae97bf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293824, "uuid": "5520a46d-9b18-4199-bd0e-3fb37d6f4760", "comment": "Malware payload (Formbook)", "value": "f1a2809f94c92e79ee855d25fb1f0c369833fcceacceb6914051cddd9f767091", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293824, "uuid": "c9ebe2ff-15e3-41c4-ae0f-fc48239b59d5", "comment": "Malware payload (Formbook)", "value": "7934c52d343822e3d8fb1d85f50c42f018619d2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293824, "uuid": "74d56df2-64e0-497c-8fb9-a0c8551f3c4b", "comment": "Malware payload (Formbook)", "value": "252c31538643ef50b8940547bbe8f13b23d4e85b54ea0f3bb9b154a7315e69fbe38aba8b2f38277376fc3df344e55426", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293824, "uuid": "ed5ca7b1-09c9-4752-9a51-c53b056d09ee", "value": "T1CE44120493E1D8A7F59362B25C7A1316DEF9EA05157A9B3B03045B5AFC363C2E90F362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293824, "uuid": "026c7570-2b49-4863-b318-bec62c669451", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293824, "uuid": "8a331cfe-ca20-442e-86b3-619624b53785", "value": "6144:/Ya6jMlZrGr6w/bsHuNtdDE4ilBZOJHSF1+ao/VPJ:/YxMlZrGrrbsHutE3lq42j/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293824, "uuid": "1e70af87-4fe3-4378-ba5c-22f1a285755c", "value": 259156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293824, "uuid": "dfd3620b-0e9f-468c-ae8b-67e9a6f4e336", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293824, "uuid": "70fc0c0d-ccc2-43f8-9ef0-c3bc533f9bb2", "value": "DOC-OP220104001_DOSOCO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f042a48b-069e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686299020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299020, "uuid": "803edd90-fbb0-4907-ad07-4b46ce527f4e", "comment": "Malware payload (Amadey)", "value": "7c36c9c998dcc8541c298390f94c107f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299020, "uuid": "07e46f3e-2121-41ab-a6f5-1604999e5df2", "comment": "Malware payload (Amadey)", "value": "f1c82464b7e4cba6736b09b7d945d4e22571e1dfe4439c579f28ba2b3d58ecdb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299020, "uuid": "c62aa558-fee2-4525-bab9-e70b46ff1243", "comment": "Malware payload (Amadey)", "value": "52c5042bc21bee394578171a54a917dc8e661eeb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686299020, "uuid": "3122eede-95fb-4c2b-8f9d-ae149a466743", "comment": "Malware payload (Amadey)", "value": "83e4bc0198bc19d616f8703e137f57d08c5ea64d8fc13176a2b85c9235d9fb37cdbd327c6eafec66d9cfcb74cd80f2fa", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299020, "uuid": "56992343-54e3-4f2a-9d05-b4d3313cbe8c", "value": "T157051222BBE5C533D9B9177098FA03C30B367DA04974936B3B969C9A1D71BD4A13132E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299020, "uuid": "8186e5cb-bd6a-4ba7-bd9e-e67d50e5fae0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299020, "uuid": "1ce8b73f-7a85-48f8-a9eb-ae3000b54049", "value": "24576:5yosStVGV1IbcilvludRR+6qaiFCqOU3wd:s07GPIwCudR4Rbw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686299020, "uuid": "5d97f941-dd12-4d34-975e-887e75404059", "value": 844288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686299020, "uuid": "45b62393-ca32-4371-82aa-da5c6d7e5717", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686299020, "uuid": "f762a435-b441-4bf5-a2b9-d18b97f60bdc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75f1ef77-0693-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686294090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294090, "uuid": "866fb1dd-8d14-4b13-848d-8756e4907de5", "comment": "Malware payload", "value": "84f3c37fdb672384a0e08284eeff44e4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294090, "uuid": "be0b60b1-8d6e-46fd-b6d5-dd47b9ddab38", "comment": "Malware payload", "value": "f2e38262a1478bc7b3d91d0a780bdf62068be238e17c95d93928c32182dd70a4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294090, "uuid": "e8f1582a-95cc-4f28-b00d-2eb4ea98a6e2", "comment": "Malware payload", "value": "f7cec096a35c5708c09698a64444b1fe81e73ee6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294090, "uuid": "998667a8-e472-4138-a4f9-2db2acc0e7e1", "comment": "Malware payload", "value": "f5fbcf42f8f4dd5b72b39b7c9498fbc586eb280c9c37999c6a938e622472402a83597d6eaf8fc6e7fe1c75cde493a6a0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294090, "uuid": "71eaad9b-285b-47db-a748-2bbcfa1d921c", "value": "T10F642354B3F9452AC27A03B91CB249509771E356D002C7A86D4F27E7AF82FC9AE01777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294090, "uuid": "e392a5a6-5d80-49dc-94f3-c992c77e3ada", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294090, "uuid": "51068760-dd51-422e-b23d-bc6165cd3152", "value": "6144:D99jZMz/y1rekkCkVg+AW93YVfhZR3MM+SYRQlsQc0EJrQ7QJ:pXC/FkdkVg9WlufR3MM+PRQvcZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686294090, "uuid": "433d2319-c9db-4eae-a763-f3c3e07ab25a", "value": 321024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686294090, "uuid": "d5649e11-978a-4305-a0d2-3833250d951a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294090, "uuid": "f1f7fd9c-6046-4461-bfba-e4dde9f88408", "value": "05601599.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6180804e-0693-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686294056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294056, "uuid": "8b93452f-272e-4e7e-9d92-1467148fba12", "comment": "Malware payload (Loki)", "value": "0252468543da8345536d409b89a589eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294056, "uuid": "b399cec2-f1bc-476f-b8f3-768a12c754c2", "comment": "Malware payload (Loki)", "value": "f37ca6c053e17063d8622f5016bf9547e95a06704c1226fd8d09e88f33a52957", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294056, "uuid": "998fd168-2bf2-4319-a8d2-555b6d7a8c01", "comment": "Malware payload (Loki)", "value": "98d3fd922e7500c0566a41a6f590a231f0586611", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294056, "uuid": "fd5ea5d2-4895-4541-9758-a4b6fa7f8dcc", "comment": "Malware payload (Loki)", "value": "ba9a926829aebaab05f0308f9974fa1412921e359b748e173189c4dc0d73ae15e0487236649a237a09cc65d02ee4b7b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294056, "uuid": "19d88176-1981-4fb5-bf03-f0d52fca4e5e", "value": "T169E401683BF6580FE56A3FBE1C1001B0CBF81A463567D39B1FD7799D8DA4B050981AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294056, "uuid": "8d6410b5-361c-4c72-8cb2-99040654bb7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294056, "uuid": "2329d5e7-1a50-41b2-ba4b-6028ec39fa46", "value": "12288:Ru/as/16/YHmM9mARLAV+/32bxIE50M9EFUPRc7ekvlA7+ymvqhkm9:Rfs6cV9mA9ImGbTfzRyU72DM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686294056, "uuid": "e3ef5bc5-4c87-45e4-a245-9fb464626e5b", "value": 687616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686294056, "uuid": "0445acff-1280-40cc-a9fb-6c43ae24a31d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294056, "uuid": "8ad2bab0-8c48-4a32-81aa-f23d7025c81a", "value": "hldSvUXe1w4W6qo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "063e1f31-0692-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686293473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293473, "uuid": "9c0f82c4-fc76-4de0-b7de-4693cab408df", "comment": "Malware payload", "value": "7d80230df68ccba871815d68f016c282", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293473, "uuid": "a33caa44-6af0-49e5-8cb4-7ad1a0397ad5", "comment": "Malware payload", "value": "f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293473, "uuid": "c69f9840-0c16-4ca8-9083-812906c9a871", "comment": "Malware payload", "value": "e10874c6108a26ceedfc84f50881824462b5b6b6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686293473, "uuid": "61ab81b2-c6ab-43f4-b1c9-ce0302f4fa4e", "comment": "Malware payload", "value": "c82f8a6c8721d7224432cbef3067ca00b237cf5c7f571199e525782954193c0dc61ad19e1654acb708eec98aa083907d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293473, "uuid": "7152a0f7-949f-42f6-98b2-34dc900c4182", "value": "T10844D01071C1C2B3C4B7113488E5CB759E7A347247BA95D7B6DD2ABA6E103D1A3362CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293473, "uuid": "d6f07edd-30a3-4c99-bd42-610a917a1222", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293473, "uuid": "3a0ed183-9eea-4e2b-84b8-c8d25f985614", "value": "3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686293473, "uuid": "29722b0e-22a4-42e8-a424-2948e44e96c7", "value": 267776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686293473, "uuid": "79742367-5ac8-4539-b860-a45302e7676e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686293473, "uuid": "a6d4b950-fe4c-4ac9-8adc-dffd0cddb999", "value": "03769899.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8a65d3f-0697-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686295893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686295893, "uuid": "d9a49e1d-bc03-45c7-8788-9b5a5db79ef6", "comment": "Malware payload (AgentTesla)", "value": "4f91ba5b28ee8195dd24aac3b123f7c5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686295893, "uuid": "028433bb-0212-4150-943a-76c395292ef1", "comment": "Malware payload (AgentTesla)", "value": "f48c27585b286af2312130e923a077ae9b441e10b54568e56be4eee3dbae1a99", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686295893, "uuid": "17b4c1d6-27ee-4278-920b-d9aed3441aec", "comment": "Malware payload (AgentTesla)", "value": "eac067c6cd49742e79ec40057f5b8f1e235f50ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686295893, "uuid": "991bb195-0bb1-42a7-b3e6-f1a5093cad73", "comment": "Malware payload (AgentTesla)", "value": "9167363b884a3812b7cd6d107e82c2b9be6460607bffe370ee769250f5e4868a30100f81e965f28d917fc0acbac4efad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686295893, "uuid": "25b0103f-83fb-4adb-bc7b-07c9c984592e", "value": "T177A423E733C0AB039EF247A67F1158467F6BEF8A8E7520423DE6855C8815BFC52A0B45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686295893, "uuid": "1fad6a16-e3fd-418f-9ead-31c3db860409", "value": "12288:DOitjE+q8L1X0LdWpbQndRcP3ivH3pWV/e5bxE2rH5:DtBqo1k2biQ+3EV/erE2rZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686295893, "uuid": "b8903a65-25d3-4eb9-a0f1-b6e5ead510be", "value": 485846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686295893, "uuid": "44dc8a35-2675-4d79-b0ca-18f673403b52", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686295893, "uuid": "7fdec402-fbcc-4787-b27b-fe2abbf0b406", "value": "payment instruction for payment inv#0095.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c896e5da-06a4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686301530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301530, "uuid": "5e9db02f-05fc-4965-845f-61e6a5ce9985", "comment": "Malware payload (SnakeKeylogger)", "value": "a2cb17d8f4b44d28e8f25e35c9bf6ef5", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301530, "uuid": "154a57c4-8230-40cf-9d07-cf582cb14026", "comment": "Malware payload (SnakeKeylogger)", "value": "f547ec43a3052eff8afc3e21f6fd0915c60cb967af4c8db1e7d9a9cf4fa7de88", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301530, "uuid": "6840604c-ede6-4965-b976-cdfae7786702", "comment": "Malware payload (SnakeKeylogger)", "value": "bab5932a01e33a80c27add26e890e4d1133dd831", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301530, "uuid": "8ed5a1d9-eee2-4d82-99d5-d5a11ab70139", "comment": "Malware payload (SnakeKeylogger)", "value": "3c4fc0b8ce376d7bd55d151cc2f48e037585437ac9930a66933dea53f2e96dfe24e1198f90399011ea83dae6234c3a40", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301530, "uuid": "6c9dd2ba-3907-44b5-beb9-a80dc87c6931", "value": "T104E4339502C15C4F6A4EEC25C0E1BE254948FB284624E8DC7655E5BFF92FD84E60FEC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301530, "uuid": "efa6f046-6b00-4188-951e-da571effc312", "value": "12288:DT6XrO3tjWMjaSiQXsz1EjTjktl9uIstSqFTN/+dcBmFYPwHQMgO4NDUmVzBnD0n:yXi3tyMjaWBjTjkn9uLvr/kc+YPwJbi8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686301530, "uuid": "7aae7d5f-f083-4993-94d6-0070fa715496", "value": 712430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686301530, "uuid": "20666f98-1aed-4c03-b5c8-f6bca4bf7af8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301530, "uuid": "6fb19f52-103e-499e-8937-a73b1d6737e6", "value": "PXU422.PDF.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbe47ea8-06b8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Stop)", "timestamp": 1686310125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310125, "uuid": "942cee07-0b67-4bc1-9808-d168130434dd", "comment": "Malware payload (Stop)", "value": "4073c1018faac68c18268510ee086a50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310125, "uuid": "74b60818-7664-4720-9c28-8d021ae6b973", "comment": "Malware payload (Stop)", "value": "f61e800bb8ce9112c67a82c7f840b2b910e151395045679896e9ea876f9c59d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310125, "uuid": "654192e7-37f0-4fe9-aa2b-93c1ebb4bec4", "comment": "Malware payload (Stop)", "value": "fd79bb378cf488d97d4e81dc320f9b30635cd1e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686310125, "uuid": "13f941b4-c98c-4551-a11f-61995ea83c66", "comment": "Malware payload (Stop)", "value": "1faf12bf88d53b92cf0e777d6a241d32aa6025b95dc26871703b9814427fd783e1644b8aa42e6aa1cc6a56f0a6f193da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310125, "uuid": "9438b46a-4104-436d-a577-a354c56b62f0", "value": "T174F4023356B07C61F3674B324E2EC2B8772FB6629E69675632881A2F0D73071E672711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310125, "uuid": "0777d28c-97d1-415c-a7dc-0fbb715b2a65", "value": "3109dd9f2a2e9aa597493f06eaedf5b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310125, "uuid": "e1e7a177-8dcd-4f7b-90bd-35283a13ae2a", "value": "12288:QK6nLQu2hDBM/iEq7AxTjN2pZzC7ESHhugFnmhIzcsWKiriiE:on8lhDG/iEqiTjgQ7FHhxFSsW7rL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686310125, "uuid": "6387862c-dd24-42a5-a38d-71205c2373ff", "value": 740352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686310125, "uuid": "6647bda1-7d34-4247-b9f7-4f9f8a372eb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686310125, "uuid": "a021c839-f7da-4878-95eb-94a7d2a4005e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b721e32d-06c0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686313527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686313527, "uuid": "7edb1fc8-d292-4add-b6de-a0d1806afbfe", "comment": "Malware payload (AgentTesla)", "value": "01cadc2bafe4bee8752d0913507505be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686313527, "uuid": "ef522428-c265-4fbf-9249-3ca734d3ee5e", "comment": "Malware payload (AgentTesla)", "value": "f750e50ad22a7171a24c23ee2879d2920d820fd5547f65da6bc15bc900d2119b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686313527, "uuid": "0d2d8660-b5b3-4f69-8f0b-335df051cb25", "comment": "Malware payload (AgentTesla)", "value": "fa9a862ad62896bd06db19874189c88605d3b302", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686313527, "uuid": "6be461b7-d4d4-47c1-b4c4-c6f8407fcc52", "comment": "Malware payload (AgentTesla)", "value": "179b78536334f103ff0701fb7eb72e9719598362d5a5a53838c3df9521724ce4aabf5c62d69077820b5094995da5098d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686313527, "uuid": "14e00dfe-870d-4d70-89a0-99628e9c84e1", "value": "T1A994237111EBDD4FD6FC816C91F93282BB480AB6B1EA0DE428F55E1B7344DB9264E483", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686313527, "uuid": "9a253cac-fa96-484c-994a-c3bceac4819e", "value": "6144:W038YtoaUr32jWYw5xhA1+DEaLD25HyDXF/bPu2xXVagLgiOhoZm8xOoQ28MyTN4:W0syEzEuxbFDPu2d9GWOZ2CTNnVQClg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686313527, "uuid": "daddf05f-b4f4-4964-900a-d647446e1cee", "value": 443784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686313527, "uuid": "53c59f24-6aec-4195-9f90-6996ea907752", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686313527, "uuid": "bd7dfa44-84d8-4574-ba88-588396f0c761", "value": "PRE ALERT DOCUMENTS.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af73cb8-06a5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686301668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301668, "uuid": "2c58cba0-af61-4326-bce6-f37f9e0cd238", "comment": "Malware payload (RedLineStealer)", "value": "ec9d7eb68b700dc7f81b7a808c4642ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301668, "uuid": "eabe7cb4-a819-47a3-9e92-8b783bee0368", "comment": "Malware payload (RedLineStealer)", "value": "f75de77adc9eed21ec758c9f4616bd5a3b83022ed16b682406befad45e6f105b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301668, "uuid": "e9973b07-df43-49e2-a1c8-fbfcd186de51", "comment": "Malware payload (RedLineStealer)", "value": "b9774feebd7f0c5335e50620dfb3659c7bb5d444", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301668, "uuid": "4675f5e3-bad5-4a16-bc59-44016c846ad4", "comment": "Malware payload (RedLineStealer)", "value": "ed7f8ab4778239269d9c1bcd069c0bd387912501db7d1ec82daaa7a59581daf0408bdb86d963166611a150aefaa7d9ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301668, "uuid": "38117ad5-4486-44b3-9a9d-0066f4aa86e0", "value": "T1AA4633FDB5551A07D5F110BD01E8C9B9C80A8E4401B20FD60BF9FE637B6BDDA8C28A59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301668, "uuid": "6da23fee-c085-4926-aba4-9660742f9d2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301668, "uuid": "3ea45901-73b4-41b2-89f6-d04074a9352c", "value": "98304:XRN2eOEkA62kikrRBDAlHXtA84Pzwa3PPFRSlNTVdmynxIRAEQO1T1tCneS:X/hy2ki0RZq36lLJ3PPFRSzTVcST1y1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686301668, "uuid": "92e2a140-4bf8-428f-b4fb-e6e0cdfc4cea", "value": 5537792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686301668, "uuid": "ab22db4e-14d8-4858-9438-96a282cf3b96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301668, "uuid": "a4910462-dcec-45c6-9ebf-c3db6f037f56", "value": "ec9d7eb68b700dc7f81b7a808c4642ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c12d255-0700-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1686340942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686340942, "uuid": "69862a94-b8ba-4f87-9377-c24888de0924", "comment": "Malware payload (Smoke Loader)", "value": "21d050c21197079204d5b24526522bb2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686340942, "uuid": "6cd0e2a3-a5d6-481d-902d-37027dc02852", "comment": "Malware payload (Smoke Loader)", "value": "f77c51eef33beedfd0b41c1f02ce5b5bab6499b9242831031906c9d66d331c73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686340942, "uuid": "e70ad8f8-b2cd-46d8-a670-a70995d97ef9", "comment": "Malware payload (Smoke Loader)", "value": "543ce104f1a4eb4c6d58ab3fc73e9a0f061f72ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686340942, "uuid": "f833d1cd-dd54-42f7-940d-ac9c0ae4f96e", "comment": "Malware payload (Smoke Loader)", "value": "4676d40876794b542458ab12151e5cabd2653cd17eaeeab7acf60e9c12ce3c5244d908d1c2b2679f2a30fce09da1292e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686340942, "uuid": "75beddc4-231b-4153-95f7-ee89b9424d5d", "value": "T15A84F03A7BADA46FF18416B08E63D35877B0ACE43DE1470B77433B2E5A3474296C524A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686340942, "uuid": "7fcc1106-dead-448b-9af6-c399ad9a75d1", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686340942, "uuid": "c32cdb7f-b303-4321-a100-30de2152f106", "value": "6144:N6dANzV+OT7cpZWsomsyMI5sPkuVdjfHLScxwGvG8G8WQ:bP+OTQ7a0OkuT/LSSvOvQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686340942, "uuid": "f5924b6a-1c60-49e8-ae6f-571c1597561b", "value": 390120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686340942, "uuid": "7ed99090-ff74-435c-9d87-61af40ea515b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686340942, "uuid": "29de2a9a-1933-4dc5-9830-54f55bed667b", "value": "21d050c21197079204d5b24526522bb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4aa0d27-065a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686269687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686269687, "uuid": "5bb9a5f9-3d82-4c62-9269-561bc59b7d9b", "comment": "Malware payload", "value": "df3795e6842e839cf45e694b7164ee17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686269687, "uuid": "102ac7bb-6030-40f8-9cb2-b74b70ba163a", "comment": "Malware payload", "value": "f7b3caf96d26314be264310c3440d238a22205e841c3991b508a920ac430d4b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686269687, "uuid": "acd56bd7-1b6d-446d-9927-c14d1e06f272", "comment": "Malware payload", "value": "7e4759a3f10adbea349df5be94c96cbf327e4ce7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686269687, "uuid": "5299de7a-0bc3-4735-9a49-9d18962987a0", "comment": "Malware payload", "value": "eab89375734a65f13b94da112b77f83f5e958653ea35043c64a5525fc5902113b78a49a028cbdc92eb6315c48d7ed54b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686269687, "uuid": "2216a1aa-447a-4394-85e3-c2022073e3df", "value": "T1FA84BF12E978449AD6EC20FA6D46E36C50D41DF4B77FCC53E3964A5A9F872C342E0A0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686269687, "uuid": "b70be6b6-4d72-4490-8b18-5a3d7daaf97f", "value": "86d018b5958d6ee3306f74df5ad0b6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686269687, "uuid": "ac1ee696-9f67-46f9-8059-850b19c6642f", "value": "6144:i1gh1VbPonZFGyykMuMn3ui8JLy74qbSIpHCbeIEnrTNx:i18OAyyk/23+JG74qbZikFx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686269687, "uuid": "7f6db0d0-2d30-44a2-84e1-9e505d4da9b1", "value": 375224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686269687, "uuid": "9cdb3a60-31b7-4de2-b2be-4db5059bbd4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686269687, "uuid": "c50a4997-9283-4161-bfad-e89b2dab3e4b", "value": "df3795e6842e839cf45e694b7164ee17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "639ba1c8-06cd-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686318970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686318970, "uuid": "6cd97081-4799-492e-8190-051c7c961c84", "comment": "Malware payload", "value": "70f6baf2d704b7c39b4c4d0a883401e5", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "PHPWebShellB374K", "colour": "#CCF23B", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686318970, "uuid": "c46c47cc-a469-4168-ac04-501e316273d4", "comment": "Malware payload", "value": "f7b95afaf6235c5db8fe19bcbad4a6ebb35786881759a351a24754bb7db71a7c", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "PHPWebShellB374K", "colour": "#CCF23B", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686318970, "uuid": "96c1d017-9a62-499f-af34-f7edd7b4f9ae", "comment": "Malware payload", "value": "a88a82a03abd1469cae2408218439b1a1c19d010", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "PHPWebShellB374K", "colour": "#CCF23B", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686318970, "uuid": "a733923c-2bce-45f3-b454-060e41ff9a16", "comment": "Malware payload", "value": "577d2c4afc13fa7eda56c34e7d9f5bb1486690c18782e7c06875cf004117c7dad70b2027f0e2918e8a95ea6053f73dbb", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "PHPWebShellB374K", "colour": "#CCF23B", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686318970, "uuid": "d75271e0-1290-434f-a3b3-95a61085d5cc", "value": "T1A1A44CD0354FB23A43E321B6827B2A89FCBEC47255094060F8EC54F5597892977E7EAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686318970, "uuid": "2e4cace7-ba6b-4977-812b-a3cceb525f87", "value": "12288:pnvrZ5G13tkARYEiBt+8cd5LdyUmkbdld3FVwN/bpKfcAnvrZ5G13tkARYEiBt+J:lvrZ5G13tkARYEiBt+8cd5LdyUmkbdDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686318970, "uuid": "4d231abd-6266-4224-852d-42e768f9c077", "value": 458404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686318970, "uuid": "e55b8b75-7f97-4b68-adb3-34b6f5d4aa18", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686318970, "uuid": "d94c4845-9ebb-4de1-b26a-8daa527bd396", "value": "bNsP.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f78a781-0693-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686294133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294133, "uuid": "f7f7e942-f8de-430a-babd-d115adb941f9", "comment": "Malware payload", "value": "d281a131e6df32fe6f0fbe1bf64b95ea", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294133, "uuid": "7b70980e-7338-4c69-9755-3e76a09e1306", "comment": "Malware payload", "value": "f861c2974820ea06bc38a5b23c6d21f2278e4152b51e4a31cc02d595aa55f0c0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294133, "uuid": "e3ac6630-b55f-4260-90fd-0e9227102e25", "comment": "Malware payload", "value": "4c82933daefb88ea2e0d15227f4cf5b23ab821fc", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686294133, "uuid": "94d33b7f-8fb0-47a1-a915-db615fccfe4c", "comment": "Malware payload", "value": "08c5ea4583e649583548ba91a68de93a86c23b2f18a3200192aaf35fe633e624460f22083a0d134963b958d4b7a01fd9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294133, "uuid": "26d30390-3557-4667-aec1-f7b7dde3cc33", "value": "T1E4E47CFAF87E7407FEAC903EC565897EDD68242490018E1A3188F949A1152C77FBE35E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294133, "uuid": "7de2c1b2-ad7a-4bc9-b459-ff6c6c2e58bb", "value": "680eaeed45a9e4829f6939c299b65e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294133, "uuid": "ecd1c365-82ce-4d2c-97f8-6ae6f9d473b2", "value": "6144:jX3Wfeg3SjKKn/HnG74LbGIiovV2Re4dl:jjjKu/m743GI/Qd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686294133, "uuid": "d8e9a181-dcbf-44df-90c2-445e19b1d755", "value": 692224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686294133, "uuid": "ef5786ca-135d-4a2b-942c-87c94dbd5362", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686294133, "uuid": "7918b8df-7cab-4ae0-b606-0bdbb052dcab", "value": "06845099.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffcc1ed3-06a4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686301623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301623, "uuid": "bcbbfe74-c94c-433b-a6b9-0c38ce05c02f", "comment": "Malware payload (RedLineStealer)", "value": "074f10e3171398d417f88386376174aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301623, "uuid": "dcee2644-ac2b-4a0a-b18d-dd9451eaf214", "comment": "Malware payload (RedLineStealer)", "value": "facefae11fd0db592cea87e2b45617052c35740735fa4f11be38fb54dce3f077", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301623, "uuid": "37a89d45-45e9-4c03-aa14-84373cf5ff0f", "comment": "Malware payload (RedLineStealer)", "value": "3b74a2774ea976fb176bad99342530a68230c8c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301623, "uuid": "8230b845-c6be-4a0b-baf9-14afa843264b", "comment": "Malware payload (RedLineStealer)", "value": "1ea82649de045c230cca9050dd156a447a2775663a32f61c2606e218f982aeadcaa9eec83a90f33ecd6c0c3bd3551575", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301623, "uuid": "db38e4d2-fdd2-4c43-9bc9-67f52bcd3d55", "value": "T1C724CE937A7A8A48C75C773530A987023F717EBA5423035F24DCBC2A1B7F6909E39256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301623, "uuid": "cc7c7ad4-09d4-4491-8ec8-af63764fb595", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301623, "uuid": "c1300aa4-3119-4a1a-a425-dbbbeb1e2596", "value": "3072:D+fIudvB/4u9x4gEWUHjmy+u33264nykAsWH2swsgr1HnZzjpMe+8Ti:1qp/zP4BSyG64nykAsc2sVghoe+8Ti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686301623, "uuid": "3acd2437-704f-4578-8ecc-9615815568bd", "value": 220672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686301623, "uuid": "979f278b-38ee-4d40-bc11-211c30c86342", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301623, "uuid": "fd6a5a52-373a-4d52-92cf-dd29d17bbca1", "value": "074f10e3171398d417f88386376174aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d9a6f70-0690-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1686292814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292814, "uuid": "41952f81-6f73-41a7-9d1f-6fdc167abafe", "comment": "Malware payload (AsyncRAT)", "value": "0e6861c721b9342f69eba894703f6484", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292814, "uuid": "c901a0c5-b57b-4768-a12a-9be0f82395ca", "comment": "Malware payload (AsyncRAT)", "value": "fb037edda6db14f4cc45540ee0719c8ca02cbc7636f48c14b6dca3bd187f3e44", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292814, "uuid": "1e77b9c9-b227-4a39-a053-aa6a0f3fcccc", "comment": "Malware payload (AsyncRAT)", "value": "6c9b0712a4c249805f2f2f1760cd72cf917aa7c6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686292814, "uuid": "90c3c59e-3f87-4845-9cc3-7eb65f3271b6", "comment": "Malware payload (AsyncRAT)", "value": "a50f8dc500f0e06e83a1626b4d6970bf558f685ceb1040a551990913c582c7e8409f11661877a23c21406ba119c070a9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292814, "uuid": "f84bde57-7a42-4e56-8906-6e6f97b1f89f", "value": "T1B6052EBC5D07E6EBCE38E25A95F02307B3715417B65EB98C6ADA3B850D939C132D060E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292814, "uuid": "abbd5a24-53e6-4e7a-97b0-cd5304cac136", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292814, "uuid": "68cde6f3-fcd7-426b-8985-0d3a3bfbec7c", "value": "6144:de/RS6Ugha13DnnTawr+BpIW85aDIamyJ95xuuEHQiljH6gnGJZ1ZnImK:deZB1hXwr+h85pMbxuuEHNe6IZBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686292814, "uuid": "a84762ed-b32d-4219-bd04-0e9b2394dbe9", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686292814, "uuid": "483bc9bb-75c7-48e0-84ce-392e9ad34ec0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686292814, "uuid": "002d16c6-77a1-4ca5-a532-e9fa172ed8ee", "value": "New Purchase Order SSRNSSIQ102-2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86aa9da8-065e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686271355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271355, "uuid": "34a7293b-be81-40db-8f05-b109dd7e7061", "comment": "Malware payload (Amadey)", "value": "f20494955a6ff506f8145d1f152a11e4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271355, "uuid": "9319aec5-c6c7-448c-8404-47c3f0b66772", "comment": "Malware payload (Amadey)", "value": "fba3c9a1a75c774d52d6d6e00603aae2f6799a0131148024031dbba4fd327a6d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271355, "uuid": "e50b8492-a1f1-48ef-9b64-eee8cff46bd6", "comment": "Malware payload (Amadey)", "value": "d41ad29bbc612cf2379e0a2f33692d1540d99c2a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686271355, "uuid": "bf9308cf-6716-4275-ac71-23705ca162ab", "comment": "Malware payload (Amadey)", "value": "b43ef1c7f05ba3375f60fe69bf03de734e6b96ccfbd51ccabdb48794dbaa04af8aa40c8d6516ea167a16a63aac47f8f2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271355, "uuid": "5a551580-b3f7-4900-b455-7d28837b13cb", "value": "T100F42313D7ED6072EEB56BB024FA13871A367CF2887093473B825D990C7279089B6776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271355, "uuid": "6b55eb00-5edc-4e85-ad0e-9c8d3d3956f9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271355, "uuid": "783706bd-63bc-4f6c-89a7-42ba4562e199", "value": "12288:OMroy90Urck3Uvba9+63sY/YWv6M8LeuxIPhIcuPYajyOQWsc4MmTQHkczn:KyF4kUT83V/YWv6M7Fnuw9cp4TOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686271355, "uuid": "d6c97063-48f8-4086-a9ab-96de4d1faee9", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686271355, "uuid": "e7cd962a-fd78-4204-8d20-9956335272c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686271355, "uuid": "cf42d89e-6d41-49e6-a895-1d784a65d91c", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b0c599-06a3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686301049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301049, "uuid": "ef43c412-3d78-4247-9928-36b8a67c815c", "comment": "Malware payload (Formbook)", "value": "e960f10f4c8fd0f6b380743439c91fdb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301049, "uuid": "e18af7e3-aace-4784-bca7-7ad8645ccca5", "comment": "Malware payload (Formbook)", "value": "fbaea63cf0928cdd548719ce257ea3813b92a8765f561bbe7e8842e7d830b87e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301049, "uuid": "c4c6dd3f-eaab-4fa7-bccc-e81e44236d07", "comment": "Malware payload (Formbook)", "value": "ccf3feb1d2f7e01c0732fee057e01d13285eb90d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686301049, "uuid": "6d3575f7-4033-4cdf-8ae2-f2705ac6e968", "comment": "Malware payload (Formbook)", "value": "d76d8856c036cc68bb91490a3fdbb5dc9bae3abb84d55a4592ec1f5d6895a76373b9c561da0abcafe09e223096c36554", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301049, "uuid": "1a5ce898-d8b8-4f1d-b5ac-dc9795784469", "value": "T10825703915AC0527C3B6A2BD6AD0F847FB809CD33A0D8D5F56C74F861522636E1CAD2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301049, "uuid": "faae04c5-2361-4707-90cf-2221f30eb75b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301049, "uuid": "deaeaea4-fd5a-48af-b0a5-593f4842bc7c", "value": "24576:PuHeMjlSADnET+YvWBThrbJnJz+ydKbxsg:2+Q7DErvchJ6QKFs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686301049, "uuid": "f2f8af72-9f06-4a9b-b25c-aad1570fb836", "value": 968704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686301049, "uuid": "ad5696ea-bfe3-4d04-be8b-1dd0b61f33ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686301049, "uuid": "5600d1ff-687f-4102-8055-ae9a230d683a", "value": "e960f10f4c8fd0f6b380743439c91fdb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "badd91d6-06c0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686313533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686313533, "uuid": "34c2b2be-6055-49de-8c6c-332e9a431b69", "comment": "Malware payload (AgentTesla)", "value": "a9c1fd60dc8362a8a7f504d613b4f66a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686313533, "uuid": "1c142551-3bca-48d7-9858-9eebcf6300a1", "comment": "Malware payload (AgentTesla)", "value": "fbc745c53390b016e0f8520fa691f4341559b57467515ea230ef7127232bce87", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686313533, "uuid": "aacaf6f5-7cee-42e9-bf88-68bdce22bcb5", "comment": "Malware payload (AgentTesla)", "value": "3337f85b2e148df0bc1e78d8ff244b259284c00e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686313533, "uuid": "9f720f5a-59d9-44a8-96c0-094df7d2a2e5", "comment": "Malware payload (AgentTesla)", "value": "b1ea7432dd844a1889320acfb83cd99322feb396e20ae38403b74f7e872a89ffe8a41aec076f4fda62b2ac52624c48d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686313533, "uuid": "ec42cc62-ad04-4c1c-8ced-02f5c4f4c5ee", "value": "T1E51561BC5D07E6EBCE38E26695F02307B3715417B65EB98C2ADA3B850D93DC122D064E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686313533, "uuid": "0bdaa5b7-9cf4-4581-9bed-4a3db93ef44e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686313533, "uuid": "c04ff75a-cf61-436f-8e1e-c4e83cf3a389", "value": "12288:vE6NBSJ1F7wr+FEa9YsRXzWLTcEx5lAmKW9Xg3k:MySZ7RXycvW9Xkk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686313533, "uuid": "1932ad77-3fb7-494b-ba83-c380407adc57", "value": 875520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686313533, "uuid": "b351a110-5a71-43bf-a4d4-46d7f0501403", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686313533, "uuid": "074ba636-be8c-4e00-81bc-3bc2b5880a75", "value": "PRE ALERT DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee94a71-06ca-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686317566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686317566, "uuid": "400fb7d4-6127-453a-a7d5-fd4f167ab336", "comment": "Malware payload (AgentTesla)", "value": "bee864bff5e11ac3fe30b9add4f72d09", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686317566, "uuid": "37fe2e31-d94a-4c70-8c74-30b741dc65d8", "comment": "Malware payload (AgentTesla)", "value": "fc54140655e3660dc45f2582c9fa41f4f957b22f86375e7c3ca723d28004d8f2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686317566, "uuid": "4aaac898-ad6c-4b45-b8fc-f385116e78f1", "comment": "Malware payload (AgentTesla)", "value": "6ec2a9bfac903b94e498400bd27027c650127866", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686317566, "uuid": "13ac49d5-bd4d-4cc2-9562-80230d44fd4d", "comment": "Malware payload (AgentTesla)", "value": "8bace4bba7690f947a33cc7035754de7213014d8f9fb8a712592d9495f8e5947dfbd4ff15ae42c70d4fc771ef87b4e1d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686317566, "uuid": "93030172-c524-4d0a-9465-24fd32fc2e4a", "value": "T11EF412BE0BA3482FD9863FBC9D202AB5D0EC96467177C56B8F63FD98CC40E484D91691", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686317566, "uuid": "5ae0514e-104b-42e7-b7fe-12f8f25edb71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686317566, "uuid": "5b291d1c-7b47-4dd5-92d1-9b63d2c16c2d", "value": "12288:DLPWR28Le0cY+Yg9fb99uGOu04+IGkpuPLdH3VNx7pApciCd0r0qfk:Dr+xL9Rk9HfOkYkpujdH3h7pApcZ0F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686317566, "uuid": "ec6c20f0-7932-4178-8814-96ac3ae530b7", "value": 747008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686317566, "uuid": "ec3bca60-debf-4334-b473-7c079513cc40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686317566, "uuid": "2e232b43-0dbe-4420-b6a9-3e630e9ad83c", "value": "Urgent request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a7ea579-06c0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686313371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686313371, "uuid": "b2068b35-4acf-4eb2-8e56-fadf0c195b9f", "comment": "Malware payload (RedLineStealer)", "value": "e21fcc025dc8345194558f42dccedd37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686313371, "uuid": "258b8141-8ae6-430e-92cb-18bbfe2c6453", "comment": "Malware payload (RedLineStealer)", "value": "fdd77d25eddc94adcb3596194e54381e736d9fc59c148d66cd3437e8cc3421d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686313371, "uuid": "9ed8d343-9087-4111-8d17-fbffd435e9e8", "comment": "Malware payload (RedLineStealer)", "value": "ebdea44d607a8189d36719792c8af1988c787297", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686313371, "uuid": "7f5968de-623a-4979-8bee-b3b537771827", "comment": "Malware payload (RedLineStealer)", "value": "4d7cc255e2b2d3a0b6f040193bf4f0990b3439170165a3e5eb3d092814dc03c45c1be8d0e53d3dc21b80de1137313543", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686313371, "uuid": "24f61840-7ca6-49b6-8281-daef37468fcf", "value": "T1B936B39259D28080E307323C329C3B99CA5FE4CD0D18678A1FF4A5EF1EEEE9196CB555", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686313371, "uuid": "60eda56d-e1d5-4f5a-b37f-c587eda9b90c", "value": "8a7b73deb4235c03206f536cd8119edc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686313371, "uuid": "dccc8ead-4d06-4057-9032-73da0f41c96f", "value": "49152:PoaoAe8nQ94j8EA/woOTXzjeHCILkhpZ3PGDvw2Ky450AkpqPMuq7LeWzyEzPCB6:PoaTlLl/cNklfK17GMuq7Leaz6Ri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686313371, "uuid": "c64a7ebc-af23-469d-a2ad-4c8832d7eaa4", "value": 5108872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686313371, "uuid": "19fc2865-babf-49aa-a566-9baba4b86ea6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686313371, "uuid": "d1646869-b164-4561-b88a-8054784219b5", "value": "doctorrecomend2023.pdf.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfd51617-06aa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686304092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686304092, "uuid": "4eb3bfee-57d7-4b23-b1d8-f669d3acfd5c", "comment": "Malware payload (AgentTesla)", "value": "4c0aa5cc9694551c9770ea0df67e2769", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686304092, "uuid": "a37d8a21-b0cb-4a0c-9c07-1e4cca3d5129", "comment": "Malware payload (AgentTesla)", "value": "fe3cb840122a59234336d168b149cf72c1c2740869bd64a5def2a8329e0ccebb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686304092, "uuid": "914f5df8-8926-43d4-8d0c-4eabbcf921f2", "comment": "Malware payload (AgentTesla)", "value": "748c4bced987a2bbd87fa4693f4326658108e6df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686304092, "uuid": "c6748f8e-52c3-427e-a0bb-dc1d013d6ea0", "comment": "Malware payload (AgentTesla)", "value": "547bee401f6f6977f6a86b0f89fe0349cf8bd0a860e00a75a3b2c1de98d091e6c6be922fcaef0554d1b11c7477ffab13", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686304092, "uuid": "978a1e74-7d44-474b-a820-529c63b87f3c", "value": "T16DE423323D4A0B2E0D8611CCFC6E36BADBD97A941C4139E4837DAEF45A338651B1E785", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686304092, "uuid": "26cc501c-4268-4605-b000-59e930b06769", "value": "12288:+6cnUfPD5LGvHhw4ai2VZ+4bm3OY8f8ruQWUMKtb09HVpM/3K:+DUflWh0VZ+l3OFQNze9HV2/3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686304092, "uuid": "b6f11bbc-11e6-4be0-b902-06de6a05b006", "value": 663049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686304092, "uuid": "cf210f55-e977-4dfb-9b24-cdd4d9ffce16", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686304092, "uuid": "1a90c50a-45c4-46c7-be80-81c6a55fd3fe", "value": "New Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c687d78a-06a2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (LgoogLoader)", "timestamp": 1686300668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686300668, "uuid": "327900e3-34ea-4cbd-a410-4989c319c36b", "comment": "Malware payload (LgoogLoader)", "value": "fea015b6e2f3c5dfed94fbd3935fb365", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686300668, "uuid": "551e6ea9-1061-4d37-86f8-340b850feb7a", "comment": "Malware payload (LgoogLoader)", "value": "fed161ae617fd483308f66110a4b43594e39602c7ba11dbb7fb6e79fd6f4fbbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686300668, "uuid": "65549da2-6fae-4f5e-a3e4-da960675f247", "comment": "Malware payload (LgoogLoader)", "value": "0ab3ccbef0de345f6fc3edb3e0320f77ddfa4255", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686300668, "uuid": "3db4f930-de29-4103-bcd8-aaa43c3f5053", "comment": "Malware payload (LgoogLoader)", "value": "b627bd8eb0adfc0837377232d269cb8f4263a6d6059ccfaaa3c3fa926dbfffdb89175e2576c1ff139013261cafe9bcb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LgoogLoader", "colour": "#FA0A6A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686300668, "uuid": "3167479a-eba3-49ad-a02a-394011085c54", "value": "T140137D053BA94A12D2FE033515F24190A3BC6E77AF2AC30A2DCB50DA99F37974706B53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686300668, "uuid": "39e24e6d-5e5b-4537-88b0-a4b16ecbc6f6", "value": "768:JOIW7du3neRXZHxjim11Nvw4/bTTay0CE5qb4rafFf9:JOdu3nIPR11R/bTTarefFf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686300668, "uuid": "f4625009-09c6-47de-b615-1d3033b3e9a9", "value": 43008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686300668, "uuid": "ee666415-b881-46c0-8b89-2df003c63d1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686300668, "uuid": "327a7bf2-2a5f-43ce-9eec-b42e951147d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }